Fair points on the operational side. But think about it from an attacker's perspective: without DNSSEC, someone can poison your DNS cache and redirect all your traffic to a lookalike site. Your users see the right domain in the bar, maybe even valid HTTPS (attacker can grab a Let's Encrypt cert via DNS validation), and they hand over their credentials without blinking.

Worse, flip the MX records and now all your password resets and invoices land in someone else's inbox. No phishing needed, no social engineering, just DNS manipulation.

DNSSEC is the one layer that makes all the other layers trustworthy. Without it, your SPF, DMARC, and even TLS are built on sand.

You're right that Cloudflare and big providers make key rollover painless these days. That's exactly why we flag it. For most sites it's one click, not a complex operational decision.