DNS hijacks at routing level are not common. But they do happen: https://www.theregister.co.uk/2018/04/24/myetherwallet_dns_h...
DNSSEC fully supports DNSSEC validation on the host. So the main reason you have to trust your ISP's recursive resolvers is that software vendors, in particular browser vendors, don't want to do DNSSEC validation.
Of course you can run your own local validating resolver.
An attacker that controls routing can bypass the DNS entirely, so it's hard to see how protecting the DNS from that attacker serves any meaningful purpose.
> Literally the only attack scenario that DNSSEC protects from is when someone is MITMing your ISP, which, I believe, is something that practically never happens.
It also helps when your ISP is MITMing your attempts to get accurate DNS information. That happens all the time, though most of it is just sending you to advertisements when you're supposed to get NXDOMAIN.
Re:ICANN urges adopting DNSSEC now
by xeeeeeeeeeeenu on Saturday April 20, 2019 @06:25PM
(#19709280)
No, it does not protect from that. Stub resolvers (i.e. DNS clients) fully trust recursive resolvers by design and don't validate DNSSEC signatures.
In theory the client can validate them but, for various reasons, pretty much none of the implementations do that.
It doesn't do anything about the most common attack scenarios, such as MITM between the client and the last mile DNS server or hackers stealing your domain registrar credentials.
To be honest, it seems to me that the real purpose of this protocol is to make people/enterprises feel safer without actually doing anything useful.