alt Hacker News> plenty of middleboxes freak out when they see DNS packets with DNSSEC records in them. People see this and want a best-effort system that uses DNSSEC in the majority cases where it does work
Who? Companies whose audiences are certain kinds of corporations?
I've never worked in an environment where I really had to care (well, check that: at Fly.io we had to switch to tunneling WireGuard over WebSockets because UDP turns out not to be reliably deliverable) but I imagine the most common reason are company border security devices --- those devices also sometimes get deployed on places like public library wi-fi, too.