What is the point of enabling the "Use DNSSEC" option?

[ontherails]

When "Use DNSSEC" is enabled, I see there are different tags on queries:

SECURE
INSECURE
BOGUS

Most of them are INSECURE for my case so I am wondering if the option just tags them yet still allows them. If that is true, what does enabling it achieve functionally? Wouldn't you want "bad" ones (is that what BOGUS means) to get dropped?

[jfb]

How do I interperet the DNSSEC column in the query log?

As of Pi-hole 3.3, you can see the DNSSEC status in the query log. [40] SECURE are records that have been signed and verified to be unchanged from the authoritative DNS server INSECURE are records that either have no signature or DNSSEC is not implemented for the domain; either the domain is unsigned and not implementing DNSSEC or there are other issues BOGUS are records that have been signed but have changed or been altered from the authoritative DNS server You will see INSECURE, but that d…

It is normal (now) for most queries to show INSECURE, which indicates they don't have a DNSSEC record installed.

[ontherails]

TY for the link. Is there a way to drop BOGUS ones? Seems like they would be bad and should not be allowed.

[DanSchaper]

BOGUS responses don't return an IP address. There's no information that you can get from them. That's why you use DNSSEC.

[ontherails]

My bad then. I thought the corresponding webpage opened despite this.