Check the DNSSEC public keys published for a domain and whether the answer validates.
Plain DNS has no way to prove an answer came from the real owner of a domain. An attacker positioned between you and a resolver can hand back a forged address and your browser has no reason to doubt it. That is cache poisoning.
DNSSEC fixes this by signing records. The zone owner publishes public keys in DNSKEY records, signs each record set producing RRSIG records, and lodges a fingerprint of the key with the parent zone as a DS record. A validating resolver walks that chain from the root down and rejects anything that fails.
The AD flag (Authenticated Data) in the result is what matters. If it is set, the resolver validated the full chain of trust for this answer. If a domain publishes DNSKEY records but the AD flag is not set, the chain is broken somewhere — most often a missing or stale DS record at the registrar.
That broken state is worse than having no DNSSEC at all: validating resolvers will refuse to answer for your domain entirely, and the site goes dark for a slice of the internet while working fine for everyone else. If you are turning DNSSEC off, always remove the DS record at the registrar first, then the keys.