The concern I have with DNSSEC is that if it&#x27;s adopted --- where &quot;adopted&quot; means &quot;by the major email providers and by browsers&quot; --- there&#x27;s <i>not</i> much you can do to protect yourself from the SIGINT agencies that control the top of the DNS tree.<p>If there was a significant benefit to users for DNSSEC adoption, I&#x27;d be my normal tedious &quot;maybe it&#x27;s good, maybe it&#x27;s bad&quot; self. But the benefits aren&#x27;t there. Instead, DNSSEC will impose immense operational costs and in some ways <i>reduce</i> security:<p><a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=10541719" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=10541719</a><p>This isn&#x27;t a hard decision and I don&#x27;t have a hard time siding with the anti-surveillance crowd on it.