DNSSEC
Cryptographic signatures on DNS responses — proves the answer came from the right source and wasn't tampered with.
Protection against DNS spoofing and cache poisoning. Hierarchical: the root signs TLDs, which sign domains. Not universally rolled out; the .se zone is unusually far along. DoH/DoT protects the transport — DNSSEC protects the content.