I'm still going to use it but I'm not going to evangelize it the way I would if it actually provided encryption and trust. It was never supposed to encrypt loo

I'm still going to use it but I'm not going to evangelize it the way I would if it actually provided encryption and trust. It was never supposed to encrypt lookup; that was mostly a disingenuous strawman argument from the usual suspects. It does provide a chain of trust. By using the public key published in your zone, a validating resolver checks the digital signatures from the root to your zone. It’s no different than when a browser checks the digital signatures on a certificate that’s signed by an intermediate certificate that was signed by a root certificate. For authentication and trust purposes, every resource record in a DNSSEC-signed zone is cryptographically signed and validating resolvers--Unbound, Knot Resolver, BIND--confirm them.