Anyone is free to se up their own DNS, which they can tweak however they want.

An interesting thing about DNS is that there is absolutely no validation done that requires the server you talk to to have a chain of authority back to the official root servers.

You can use DNSSec to add validation and encryption layers, but nobody’s forcing you to use that at this point.

So go ahead… set up your own virtual lab and play around. Get a feel for how it all works, and what breaks/works unexpectedly when you tweak a component.

Just don’t mess with an authoritative server.