DNSSEC adoption rate means that this would be insufficient to detect (let alone prevent) that type of tampering for most domains. The correct solution is identified the the first paragraph of the post, which is to use a tamper resistant transport to the dns server (eg DoT, or DoH if you like everything being wrapped in http)

Which DNS server? Your client talks to a central cache (of your choice) which talks to the chain of servers for all relevant domains, most of which don't support DoT or DoH.