It can be verified by the client [1] (wikipedia link also has RFC source), but typically the verification is done by the resolver, which introduces the problem that a client has to trust the resolver and the network from resolver to the client (last mile problem)

1: https://en.wikipedia.org/wiki/Domain_Name_System_Security_Ex...