Okay, I'll admit something first-off: I don't really understand some of the practical aspects of how DNSSec protections work very well.(Even after reading resources like this.)
Well, I certainly understand why anti-spoofing protections for DNS name-to-address resolution lookups are very necessary. And I even understand (roughly, at a basic level) how the cryptographic trust chain mechanisms work, from the DNS root servers and top-level domains down to the lowest-level ISP and internal/corporate nameservers to provide a foundation for the DNSSec role of cryptographically attesting that a given domain name really is linked to one or more given IP addresses.
But my understanding gets hazy at the point where an end-user's device actually takes advantage of the DNSSec system's capabilities to verify that the DNS server the client is dealing with is telling the truth when it says that a certain domain name is legitimately supposed to resolve to a certain IP address. That, for eg.,
www.example.com really is intended by the people who own it to point to 220.127.116.11, and that 18.104.22.168 isn't just some spoofed, malicious substitute server telling, say, my browser to go to an attacker-controlled web page instead of the genuine one.
Anyway, my actual question here isn't quite "I don't fully understand how DNSSec works at a client/DNS server-level. Please explain that." I have a more pragmatic concern: Can one actually configure an end-user client PC or device to force it to accept & use only DNS lookup results that are cryptographically-verified under DNSSec? Configuring a PC to use certain specific DNS servers is easy enough, obviously; how does one configure a PC to use only DNS lookup results that are verified as legitimate by the DNSSec infrastructure? Or can that even be done; is there something I'm missing about how DNSSec works at the client/DNS server level that means my whole question is off-base? Or is something else going on?
( Note: I suppose I'm asking with the picture of a typical Windows client environment in my head, but really I mean to ask in a more general context of "Is there some kind of verification/checking in DNSSec that actually occurs at the client level, or is DNSSec some purely external thing were a client is expected to "just trust" the end-output of some DNS server?" And the latter sounds a lot like it would just have the some of the same issues that make the legacy DNS system problematic.)