>Since they can intercept all DNS traffic you send they could actually emulate all the way up to the root servers and sign with keys they generated themselves.

>Since they can intercept all DNS traffic you send they could actually emulate all the way up to the root servers and sign with keys they generated themselves. This is probably overly complex but is possible and would allow a false dns entry to be accepted even by resolvers configured to only accept responses for domains which are signed. this is not how DNSSEC works, if it did work this way it would be trivial for anyone to mitm it, thus render its entire purpose null and void. Resolvers are preloaded with the dns root public key, that key signs the tld root keys, which sign your registrars key, which sign your domain. There is no effective way for comcast to spoof replies in this setup, as they have no access to any of these private keys.