 
            
            
            
            
                12 Nov
                
                    2021
                
            
            
                12 Nov
                
                '21
                
            
            
            
        
    
                11:08 p.m.
            
        DNSSEC would help here. NetSol's rogue nameserver wouldn't be able to produce the signed zone if validation were required.
Nope, they could just remove the DS since they are the registrar for that domain. DNSSEC only protects against a DNS provider going rogue, not your own hired registrar. Rubens