Hmm. A bit gutted that AWS route 53 does not support DNSSec unless I’m missing something.

well there are always options, so I am contemplating spinning up 1 or 2 Digital Ocean droplets to run DNS for my sites.

However, the plan is to set it up on my local Bind server and then decide whether it’s worth it!!