> If that is true, and that is what I would expect, and we've minimized the risk of cache poisoning by using a localhost cache exlcusively (no third party caches), then why use DNSSEC?
How have you authenticated that your ISP isn't intercepting DNS requests and serving them out of their own cache that lies?
How have you authenticated that your ISP isn't intercepting DNS requests and serving them out of their own cache that lies?