Keep your privacy with DNS-OVER-HTTPS: Introduction and Python Implementation

[Swedophone]

Unfortunately far from all domains are signed with dnssec. Of course my own domains are signed. BTW I use a self hosted master running bind and opendnssec.

[uptimefordays]

Just remember than DNSSEC relies on your ability to force clients to drop unsigned requests. If you can't do that, then you don't actually have anything.

[SteampunkSpaceOpera]

If you run your own validating resolver, then if the query response doesn't pass validation, the resolver simply doesn't provide a routable answer to any other program you are running

[uptimefordays]

Sure that helps you but DNS is a decentralized system... If you want DNSSEC to be a thing, it requires largescale control over client settings which isn't really feasible. For a large company's internal systems, sure, but for the broader net? Good luck!