DNSSEC cryptographically signs DNS records so resolvers can verify they have not been tampered with. Strong defence in depth, but only with full registrar and registry support.
RFC 4033 — DNS Security Introduction and Requirements
RFC 4035 — Protocol Modifications for the DNS Security Extensions