One could argue the primary (not the only) risk addressed by DNSSEC is third party DNS service, i.e., shared caches accessible from the internet If this is tru

One could argue the primary (not the only) risk addressed by DNSSEC is third party DNS service, i.e., shared caches accessible from the internet If this is true, then one might assume DNSSEC is generally unnecessary if one is running their own unshared cache only accessible from the loopback or the LAN Software like djb's dnscache, a personal favourite, has no support for DNSSEC NLNet's unbound places a strong emphasis on supporting DNSSEC. The unbound documentation authors recommend using it https://unbound.docs.nlnetlabs.nl/en/latest/getting-started/configuration.html https://unbound.docs.nlnetlabs.nl/en/latest/getting-started/...