[georgyo]

Yes, unless you have some sort of protection.

Protection could be validating DNSSEC (most likely not)

Or using DoH (DNS over HTTPS) or DoT (DNS over TLS)

[terom]

I don't think DNSSEC would help in the common case of non-validating stub resolvers querying a public resolver. My understanding is that the DNS query response from a DNSSEC-validating public recursive resolver doesn't contain the information required for the stub client to validate it, only a single AD bit.