I was looking at verisign's public dns whois checker and I got this crazy result.
Amazon.com doesn't have dnssec enabled.
# To verify run:
~ ❯ delv amazon.com
; unsigned answer
amazon.com. 2 IN A 98.82.161.185
amazon.com. 2 IN A 98.87.170.71
amazon.com. 2 IN A 98.87.170.74