How can I explain a non-technical person the purpose of Domain Name System Security Extensions (DNSSEC) and the risks of not using DNSSEC? It would be nice to use a metaphor, so that it's also easy to remember for a non-technical person.
Regular DNS responses are like business cards - while you can generally trust them when someone hands theirs to you, they're actually just ink and card stock, and anyone who is even a little motivated can get their own made by a print shop. And there's no way to enforce their validity; I can go to (for example) VistaPrint and they'll ship my "He-Man, Master of the Universe" cards right to me.
DNSSEC DNS responses are like drivers licenses. They've got a picture. They've got a mag strip with a copy of the information. They've got holographs that are difficult to forge. They've got layers printed in special ink that only show up under ultraviolet light. In short, a number of technical measures have been taken to make them hard to forge.
When authentic data is important, DNSSEC/licenses are preferred. Just as the Post Office requires a license and not a business card for identification, so your business might require DNSSEC data for use in connecting to your bank.
At the request of @schroeder (I'll also give it a shot myself).
A customer goes weekly to a
local store because a friend told him that
company A (who runs the store) is trustworthy. The customer does not actually know
company A, he just knows the
local store because the store is in his area.
company A got bankrupt and a not so trustworthy
company B buys the
local store, continuing it's original business exactly the same as before. The customer doesn't notice a difference and keeps buying at the
local store that is now owned by a not so trustworthy
company B, without knowing the difference.
local store was protected with DNSSEC, the
local store would actually notify the customer that
company A changed to
company B and reject the customer from entering the store.