Anyone here speaks DNSSEC?

I have a fundamental problem understanding DNSSEC. Perhaps one of you can help me grasp the error (mine or the one in the protocol).

If I am an attacker that can manipulate your DNS traffic, why should I respond to DNSKEY queries?

If I can manipulate DNS, I can just leave out the signature. As long as there is no side channel for DNSKEY queries, and as long as the traffic can be manipulated, I can completely "disable" DNSSEC.

And I'm not yet speaking about the problem with only the DNS resolvers verifying the signatuers (if they actually do it), instead of the clients. I'm thinking of something like HSTS, but for DNS queries...

Or do I have a fundamental error in understanding here?

#dnssec #dnskey #dns #infosec