I'm trying to understand the benefits of DNSSEC.
If a user goes to my site example.com
and the DNS cache was poisoned redirecting the user to the bad guy's IP, what would happen?
I've enabled HSTS.
My understanding is the user would see the 'Your connection is not private screen' and would not be able to continue (unless they are using an older browser like IE 10 which doesn't support HSTS).
Could the bad guy redirect my site to another domain bypassing the HSTS protection or does HSTS stop the redirect happening because it can't find a valid cert?
With DNSSEC enabled would this stop the bad guy poisoning the cache and the user would be none the wiser or would they see a different error page?
I know DNSSEC doesn't protect the last hop.