I start learning about DNS and DNSSEC. I discovered DNSSEC work similar to a PGP signature. A piece of data signed by a key and the key signed by another key. So, I have an attack might work with some assumption, but I want some validation will this work.
Assuming an attacker had intercepted a network, and able to manipulate the packet. A client request a DNS record from Google's public DNS. DNS responses with legit answer. Now the attacker intercept the response packet, modify the answer and remove any DNSSEC related information. Client directed to attacker's site.
The attack basically remove the DNSSEC related information. Since client doesn't have any info to verify the data, it only can trust and connect the IP address within the DNS answer. And the attacker don't need to spoof the target domain and its parent because it is just a simple subtraction.
Is this attack possible or DNSSEC have some kind of mechanism to prevent this happen?