The original intent behind dnssec is before my time working in the dns industry, and when it come the last couple decades the larger push seems to be focused on

The original intent behind dnssec is before my time working in the dns industry, and when it come the last couple decades the larger push seems to be focused on making people feel more secure in using dns for identification and authentication purposes. How well it does the job depend a lot on the threat model, and how large the actually risks are for that model. How likely is it that an attacker can take over an domain on say cloudflare/microsoft using dns authentication, or someone managing to spoofing an email by changing the dmarc signature? On the average case I suspect the risk is very small, but then I don't think that specific attack surface has been well tested enough to demonstrate how good the idea is to put keys and proof of identity in dns without any additional system to validate the records.