DNS delegation errors are kind of rare. There are so many configuration errors in web deployment, and the most common errors I see which causes websites to be inaccessible are misconfigured certificates where:

• You get the default certificate for the web server rather than the correct one for the vhost.

• You have a redirect from www->bare or bare->www and the redirect vhost don't have a certificate.

• The certificate don't include the www subdomain name.

• A wild card certificate doesn't include the bare name.

• There are multiple web servers listed in DNS but only a subset has a correct HTTPS configuration.

Just like you can f* up HTTPS when you have Strict Transport Security, you can f* up DNSSEC. While I don't really like current DNSSEC implementations, this is not DNSSEC's fault really. The idea I do like, that recursive resolvers can't tamper my resolving - that the recursive resolver is left out of the trust chain.

I can't wait to see what disingenuous statements he makes about a config failure.