Ignore DNSSEC if you like MITM attacks
Summary
The article argues that ignoring DNSSEC leaves email and other services vulnerable to MITM via DNS spoofing, illustrating how spoofed DNS can redirect mail delivery and force TLS handshakes for attacker-controlled servers. It discusses MTA-STS caveats, Matrix/XMPP impacts, and advocates for local DNS validation (e.g., unbound) and DNSSEC-enabled configurations to reduce risk.