How to compromise DNSSEC

The article mentions:

"Thus, an attacker would have to compromise the DNSSEC server in addition to intercepting the SMTP handshake."

Just to be clear, a DNS server may or may not be a "DNSSEC server" (this is not a term that is normally used in DNS).

DNSSEC is designed so that the DNS servers can be compromised and it would still not allow an attacker to send unauthorized answers. The DNS zones can be signed offline or with a HSM (hardware security module), and in either case compromising the DNS server would not help, since the keys needed to make an invalid version of the zone are not available.

Some DNS servers do online signing (PowerDNSSEC works this way, as does the proprietary CloudFlare DNS service). Also, a lot of DNS servers do keep the keys on unencrypted disks (I run my own servers like this, because the operational annoyance doesn't justify the additional security gained for my vanity domains). In all of these cases a compromise of the DNS server would indeed allow an attacker to send the DNS answers that it wants to complete the attack on the SMTP service.