> DNSSEC doesn't help in almost every other practical attack scenario It helps against BGP attacks. https://www.blackhat.com/docs/us-15/materials/us-15-Gavrich

> DNSSEC doesn't help in almost every other practical attack scenario It helps against BGP attacks. https://www.blackhat.com/docs/us-15/materials/us-15-Gavrichenkov-Breaking-HTTPS-With-BGP-Hijacking.pdf https://www.blackhat.com/docs/us-15/materials/us-15-Gavriche... DNSSEC + a CAA record with the validationmethods parameter set to DNS would prevent that attack.