Comment by c4mpute

Because a DNSSEC attestation is usually public, except if you maybe use NSEC 3 and hide the RR behind some random name.