After reading about DNSSEC realization in Windows Server 2008 R2 it seems to me that it adds extra complexity without being fully secure anyway (I do understand that more security is always means more complexity in most of the cases).
1st DNS client is not aware about DNSSEC and ask the same server which resolved the record to check validity of this record and do it only in case of NRPT table presence (you need to configure this additionally - no table no check; and this is still the case in WS 2012/Win 8). Apart from looking somehow clumsy architecture-wise, the thing is that client doesn't have any options to validate DNS server (to be 100% secure in this respect you need IPSec deployed in Windows network which adds even more complexity).
So taking all this into account does deploying DNSSEC worthwhile in real world? Does it really improves security or just adds unnecessary complexity?
Does anybody really use this technology in enterprise Windows networks?