DNSSEC only seems unnecessary under the assumption that you&#x27;re already making full use of existing security measures everywhere else in the stack. If you live in a world where unencrypted HTTP still exists then it&#x27;s nice to have some defense against ISPs who like to lie in DNS responses. And even if I am connecting over HTTPS through a shady ISP, I&#x27;d prefer not to send any packets at all to the wrong IP rather than wait until it presents the wrong certificate.