People have created DNS problems since the early days of DNS. For example, in the Slack case, they found that they had a 'CNAME at APEX' which caused problems.

People have created DNS problems since the early days of DNS. For example, in the Slack case, they found that they had a 'CNAME at APEX' which caused problems. That construction has been invalid since the beginning of DNS. People often have zones with wrong information and high TTLs and then ask around on mailing lists for other operators to clear DNS caches. There have been a few DNS flags days in recent years where recursive DNS resolvers would remove certain work arounds for bugs in authoritative DNS servers (or server configs). In short, classical DNS has a long list of issues. As for caching the NSEC or NSEC3, that's an optimization that is not possible without DNSSEC, but DNS resolution would work equally well without this feature. Most recursive resolvers are not open to the public, so they don't need extensive protection from malicious clients. Caching an NSEC or NSEC3 helps against certain denial of service attacks. But it has a cost in term of failing in the case of bad NSEC/NSEC3 data. That said, point of DNS flags days is to just break protocol violations instead of creating a work around. If you don't, you get into the mess where certain websites only work with certain browsers, etc. Many years ago, browsers would take a very lenient stance at wrong web PKI certificates allowing the user to grant an exceptions. These days, that is mostly over.