You generate keys, sign the zone, and publish DNSKEY records. Each set of records (an RRset) gets an RRSIG. The parent zone publishes a DS record that hashes your key, chaining trust up to the signed root. A validating recursor walks that chain. If a signature is missing or wrong, the answer is SERVFAIL, not a silent lie.
Operational reality
DNSSEC fails closed. Expired signatures take a domain offline for validating resolvers. If you enable it, you need a host that rolls keys and re-signs automatically. Transferring a domain to a registrar that does not copy DS records is a common outage. Disabling DNSSEC means removing DS at the parent first, waiting, then turning off signing.
DNSFetch’s lookups show the unsigned record data resolvers return for everyday types. They are not a full DNSSEC auditor. Use dig +dnssec or your provider’s debugger when signatures misbehave. Enabling HTTPS does not replace DNSSEC; they cover different hops.