Which of the following is designed to protect the Internet resolvers (clients) from forged DNS data created by DNS cache poisoning?

A stub resolver is a lightweight DNS client that simply forwards queries to a full recursive resolver - it has no mechanism to validate the authenticity of DNS data.

BINDER is not a recognized DNS security technology; BIND is a widely-used DNS server implementation but provides no inherent protection against cache poisoning on its own.

Split-horizon DNS returns different DNS answers based on the query source (internal vs. external), which is a segmentation technique and does not authenticate or verify the integrity of DNS responses.

DNSSEC (Domain Name System Security Extensions) uses public-key cryptography to digitally sign DNS resource records, enabling resolving clients to verify that responses originate from an authoritative source and have not been tampered with. This directly addresses DNS cache poisoning, where an attacker injects fraudulent DNS records into a resolver's cache. Without DNSSEC, a resolver has no way to distinguish a legitimate response from a forged one.