Any domain experts here? i was looking at domain rating pages and stumbled upon DNSSEC.

Should I implement this?  (given the risk of this going catastrophically wrong, I can implement it on an unused domain first!)

I use cloudflare, which supports DNSSEC, but my domain provider has no clue.

Is that actually an issue? - I think they just need to add one DS record to the DNS, and cloudflare and the DNS's around the world do the rest.

Reading more on this, I wonder if this is worth doing at all? I notice that westpac, ANZ, BNZ (see https://dnprotect.com/bnz.co.nz/details ) don't bother.

The major NZ law firms in NZ do, but they have .com addresses. Maybe the TLD .NZ doesn't support this?

Thanks in advance for any pointers in the right direction!