DNSSEC uses NSEC (or NSEC3) records to indicate that requested domain name does not exist. NSEC has been criticized because it allows zone enumeration.
What breaks, if dnssec is implemented without nsec records, that is, what if there is no authentication of nonexistant domains? (if domain exists, response is authenticated, if domain does not exist, response is unauthenticated)
As I understand, DANE uses NSEC to protect against MITM, but do not understand exactly how. Wouldn't attacker just drop or corrupt authenticated NSEC responses?
Could it be that there is no way of knowing whether DNS response were supposed to be DNSSEC authenticated or was (proposed unimplemented) NSEC, subsequently modified by attacker to unauthenticated DNS response pointing to attacker controlled host.
Am I getting it right? Are there other problems?