DNSSEC only secures DNS records, and on its own does not help at verifying certificates. This mitigates DNS hijacking (when some man in the middle, for example a network provider threatened by governments) returns faked DNS records.
It does not help against other attacks, especially redirecting the traffic (without spoofing the DNS records) or tampering the traffic in-between (and wrapping it in TLS again). In this case, an attacker could use a valid certificate issued by a compromised CA.
DANE uses special, DNSSEC-signed DNS records (TLSA-records) which declare what certificates are allowed for a domain. If you put together DNSSEC and DANE, it is possible to either declare self-signed certificates as trusted (verified against the DNSSEC trust hierarchy), or have a second validation path of CA-signed certificates.
The large disadvantage of DANE: implementation coverage is still very, very low; pretty much nobody is using (or even able to use) it at the time of this answer: Firefox and Chrome plugins are available, and Postfix has support for it.