This doesn't really answer the argument that the parent comment made. You can say DNSSEC "works" in the presence of a caching resolver the same way you can say the TLS Heartbeat extension "works"; sure, it's there, and it's doing stuff that the RFC says it should do, but that begs the question: why is it there? There are really no meaningful use cases left for DNSSEC.