> DNSSEC doesn't encrypt your DNS traffic before sending it to a resolver. It uses cryptographic signatures to verify that the DNS data is authentic and hasn't been tampered with. But the problem here remains the same: your DNS traffic is still unencrypted in transit. Which means, your ISP can still snoop on it or mess with the responses.

The "mess with the responses" part makes no sense. The point of signatures/authentication is to prevent tampering, and DNSSEC does that successfully.

For that to work, of course you need to validate the signatures on your own infrastructure and not rely on your ISP's resolver to do that.