1. SMTP email isn't end-to-end secure with DNSSEC, SPF, DKIM, and DMARC. It isn't even close. It is unsafe to authenticate CA certificate requests via email before DNSSEC and remains so after DNSSEC. SMTP is insecure. Making it secure is the biggest problem in Internet cryptography and we aren't anywhere near solving it. If domain-validated certificates scare you, the solution is to eliminate DV certs.
2. The roots control delegations. The keys you store in your zone don't matter if surveillance targets never see them, because the government-controlled roots switch delegations to zones they control. DNSSEC is a PKI controlled by NSA and GCHQ. That is literally what it is is.
3. DNSSEC is 90s cryptography. 90s cryptography has been discredited. The DNSSEC roots use an archaic flavor of RSA. ECC DNSSEC records break zillions of deployed implementations. The flavor of ECC that DNSSEC supports is also archaic. This stuff is in the FAQ for the post they're rebutting.
4. The phrase "good money after bad" comes to mind.
5. Here is a list of major DNSSEC outages. DNSSEC reliability is komedy gold:
http://ianix.com/pub/dnssec-outages.html
6. No it's not.
7. 7 years ago, this argument would have been written "DNSSEC reveals hostnames now, but there's something called NSEC3 that's going to make that better".
8. There is a finite amount of money and energy to be spent on cryptographically improving core Internet infrastructure, and the many deficiencies of DNSSEC are why virtually nobody credible in the cryptographic engineering community thinks DNSSEC is a good use of that money. We can't spend tens of millions of dollars forklifting in a baroque new cryptosystem that doesn't actually encrypt anything.
9. The sole important application for DNSSEC is storage of TLS certificates.