The countermeasure to DNS poisoning is DNSSec. How does it work?

A.
All DNS servers encrypt the data sent back and forth between them.

B.
All DNS servers digitally sign messages between them.

C.
All DNS servers authenticate to the requesting clients.

D.
All clients and DNS servers carry out mutual authentication.

Explanation:
If DNSSEC (DNS security, which is part of the DNS Bind software) was
enabled, then when a DNS server received a response from another DNS server, it
would validate the digital signature on the message before accepting the information
to make sure that the response was from an authorized DNS server.