Assuming properly issued certificate, Web PKI on the browser<=>server side is quite well protected against DNS spoofing of all kinds, and this is where DNSSEC i

Assuming properly issued certificate, Web PKI on the browser<=>server side is quite well protected against DNS spoofing of all kinds, and this is where DNSSEC is pointless. Users don't need to have DNSSEC-supporting resolvers, and not supporting DNSSEC only improves reliability of their browsing. CAs are deterred from misissuing by CA/B forum and CT logs. This is actually stronger than DNSSEC where browsers have no power to catch and punish malicious/incompetent CAs. Web PKI is vulnerable to DNS spoofing when issuing domain-validated certificates, and this is kinda crapshoot. It is getting "patched" with things like querying from multiple vantage points, push for RPKI to make BGP attacks harder, and certificate transparency to catch spoofing after the fact. This is a weakness, but somehow TLS hasn't collapsed yet because of that.