Hacker News Reader

Does anybody know if it is the browser or the operating system that checks the validity of the dns records? Is it enabled on all clients?

No, but Google's public resolvers¹ support it and it's very easy to set up your own local validating resolver like Unbound².

You can track the progress of DNSSEC validation in Debian at https://wiki.debian.org/DNSSEC