This is the fourth time in the last 30 days I have seen some blog post about DNSSEC on the front page.  Three overtly pushing Cloudflare DNSSEC and one about email and DNSSEC written by a Cloudflare employee.<p>But still no discussion of cache poisoning.<p>So if a user runs their own personal cache bound to the loopback do they need DNSSEC?<p>What if they run their own root?<p>What if they have local copies of all the zones they need?<p>DNSSEC gives control to untrusted third parties to periodically determine what is and what is not a &quot;valid&quot; domain name.<p>What are the protections against abuse of this control?<p>I would not call DNSSEC &quot;secure DNS&quot;.  I would call it &quot;validated DNS&quot;.<p>The question is who is doing the &quot;validation&quot;?<p>And why should we as users trust them more than the endpoint we&#x27;re trying to reach?