§ 01
Definition
DNS Security Extensions are defined in RFC 4033-4035. They protect integrity, not privacy: queries and answers still travel unencrypted unless you also use DNS over HTTPS or DNS over TLS.
§ 02
How it works
Each signed zone publishes keys and signatures. A validating resolver follows a chain of trust from the DNS root down to the domain. If a signature fails, the resolver refuses the answer, which defeats cache poisoning and many spoofing attacks.
§ 03
Why it matters
People often confuse DNSSEC with encrypted DNS. For VPN users, the useful point is that a VPN's own resolver should validate DNSSEC, while encrypted DNS and the VPN tunnel hide your lookups from the local network.