Which three statements best describe how DNSSEC prevents DNS cache poisoning attacks from succeeding?