What it protects against

Forged DNS responses directing visitors to an attacker's server — an attack invisible to the user because the domain in the address bar is correct.

Why adoption lags

Key management adds operational risk. A misconfigured signature makes a domain unreachable, which is a worse day than the attack it prevents.