aws.com and google.com don't have DNSSEC enabled

dnssec.md

I was looking at verisign's public dns whois checker and I got this crazy result.

Amazon.com doesn't have dnssec enabled.

# To verify run:
~ ❯ delv amazon.com
; unsigned answer
amazon.com.             2       IN      A       98.82.161.185
amazon.com.             2       IN      A       98.87.170.71
amazon.com.             2       IN      A       98.87.170.74

Surely aws.com has it enabled?

~ ❯ delv aws.com
; unsigned answer
aws.com.                59      IN      A       143.204.142.107
aws.com.                59      IN      A       143.204.142.125
aws.com.                59      IN      A       143.204.142.53
aws.com.                59      IN      A       143.204.142.119

Okay google.com has it enabled:

~ ❯ delv google.com
; unsigned answer
google.com.             141     IN      A       173.194.42.101
google.com.             141     IN      A       173.194.42.113
google.com.             141     IN      A       173.194.42.102
google.com.             141     IN      A       173.194.42.138
google.com.             141     IN      A       173.194.42.100
google.com.             141     IN      A       173.194.42.139

Okay there's something seriously wrong, this tool is broken, or my client is wrong. what about cloudflare:

~ ❯ delv cloudflare.com
; fully validated
cloudflare.com.         134     IN      A       104.16.132.229
cloudflare.com.         134     IN      A       104.16.133.229
cloudflare.com.         134     IN      RRSIG   A 13 2 300 20260612003424 20260609223424 34505 cloudflare.com. bK9MssAMDa7/6dM0CJ0tRYisBorQ8vaDDWrhyvvzJjO7qp6ogft0eUdy c22Loq0Lw172ClsPmz2CWW5WLBMWfQ==

So it's not my tool because cloudflare is working.

Can someone please explain what is happening?

AWS themselves has an article about this.

With no dnssec, there is no way to cryptographically prove that the DNS records are accurate, so DNS server's cache could return an attacker IP.

Checkout https://moquilabs.com

Thank you! Related: https://dnssecmenot.fly.dev/ (DNSSEC Adoption In The Tranco Top 1000...)