TLD DNSSEC Report

With DNSSEC, the DNS is spoofable. The two most common spoofing modalities in practice are LAN-style spoofing (airport and coffee shop wireless) and registrar ATO, both of which DNSSEC doesn't touch. Ironically, the former spoofing modality is directly addressed by DoH (or DoT, if you trust your network operator) and doesn't require coordinated or universal deployment.

There's a reason fewer than 2% of all .COM domains are signed; it's because DNSSEC is moribund.