[progval]

> nothing about DNSSEC prevents a DNS server (or middlebox) from denying results to a disfavored domain

But at least it is detectable thanks to NSEC and NSEC3 records.

[cyounkins]

Kind of. An intermediary can drop packets and the client will never get the response.

[tptacek]

It's detectable when the site that the DNS provider is censoring falls off the Internet!