DNSSEC

[varudurock]

How does the resolver know the public key of root server ? Let us assume that the public key of root server is known to anyone since it is a public key and hence anyone who has the public key can understand the reply sent by root server. Is it possible for the attacker to tamper the response sent by the root and send a new response instead to the resolver with modified Ip and the public key of a new malicious server ? Kindly correct me if I have any misunderstanding of any of the basic concepts here. Thanks in advance !!!