Comment by gzread

You requested:

> real world compromises of major sites that don't use DNSSEC?

Without any other changes to this infrastructure DNSSEC by itself wouldn't have prevented this, but it could have been combined with something else like a CAA record.