Comment by peanut-walrus

> also, doesn't DNSSEC prevent this anyway?

As per usual, the answer is no. DNSSEC prevents resolver cache poisoning for trusted resolvers which validate DNSSEC. That is literally it. It provides no security against the vast majority of attacks against DNS.

Also limited protection against MitM upstream of the resolver, spoofing is prevented but denial of service is still possible.