I'll throw my $.02 in here since this is getting some traction: DNSSEC validation should be used, no exceptions, no excuses. If you're running a local resolver, turn on stub validation for DNSSEC - it prevents anyone (even a DOH/DOT upstream forwarding cache) from lying to you without your knowledge. If you run a domain name: turn on DNSSEC. It's 2026 - not 2012. DNSSEC works great, we validate it on 100% of our queries, and is one of the tools needed to stop people from meddling with the DNS. https://circleid.com/posts/common-beliefs-about-dnssec-put-t...

Also, encrypt everything. DOT/DOH/DOH3/DOQ - leave no packet available for observation. Criminals, nosy network snoopers, and governments either want to know what you're doing or they want to break the integrity of the internet for profit or political reasons, and it is work to keep them out of your business.

context: I work at Quad9, one of the larger public resolvers.