Let&#x27;s not lose sight of the fact that DNSSEC purports to make client connections more secure.<p>Does it?<p>- If the server in question doesn&#x27;t have DNSSEC set up: No.<p>- If there is a problem with one of the pieces of DNS infrastructure between the server and client: No.<p>- If the DNS resolver server the client is using doesn&#x27;t support DNSSEC: No.<p>- If the client&#x27;s stub resolver isn&#x27;t a validating one: No.<p>- The user is never notified if DNSSEC is working for them or not. They can only determine this by making queries with a command-line tool, or when they get a &#x27;could not resolve domain&#x27; error on an invalidly-configured domain.<p>---<p>Compare this to HTTPS, where the only thing the client needs to verify a secure connection is:<p>- The server delivering its certificate and certificate chain to the client<p>- The client validates the certificates<p>- If it isn&#x27;t validated the user knows immediately.<p>You can go ahead and implement DNSSEC for your server, but when it comes to HTTPS connections, this does not improve user security over what we have now.