&gt; 1. DNSSEC doesn&#x27;t protect against ISPs hijacking DNS responses<p>DNSSEC protects signed zones by allowing clients to notice a suspicious lack of a valid signature on responses that should have been signed. DNSSEC doesn&#x27;t protect unsigned zones, but that shouldn&#x27;t surprise anyone and isn&#x27;t really an indictment of DNSSEC&#x27;s capabilities.<p>&gt; I&#x27;m not sure what difference it makes to be sending packets to the wrong IP.<p>That malicious IP gets to record what kind of connection my computer was trying to make to that domain, even if the connection attempt is aborted relatively early. That&#x27;s more information being leaked than if my computer had been able to determine that it got a probably-spoofed DNS response and aborted there.<p>Playing shenanigans with the DNS server is a lot easier than full-scale snooping and tampering on all traffic, which is why ISPs commonly do the former but the latter is usually only done with NSA involvement.<p>It needs to be <i>hard</i> for ISPs to direct all mistyped domain names to their own advertising (and in the process, implicitly pretending that the Web is the only use for the Internet) or to claim that sites they don&#x27;t like don&#x27;t exist. DNSSEC helps with that.