DNSSEC - how to cook it right?

Question

Domain Name System

A few practical questions about the practical - I'm not afraid of tautology - the use of DNSSEC:
1. Is it possible to use DNSSEC-based SSL not only for the web, but for example, for POP3 and SMTP, and if so, how?
2. I have a signed second level domain with a delegated third level domain - how do I sign the last one?
3. Recommend a DNS hosting based on BIND9 and possible conveniences like serial number checking, reverse zone calculators, IPv6 glue, etc.; Did you understand that I want to manually edit the zone files so that I can add all sorts of records of exotic types - like TYPEnnn? Preferably free or inexpensive.

The question was inspired by these posts:
habrahabr.ru/post/138490/
habrahabr.ru/company/webnames/blog/171177/

Answer 1

1. This is not explicitly stated, but dkim and dmarc are quite signed within DNSSec;
2. Create keys, sign, push the DS-record into the second-level domain, re-sign the last one.

Answer 2

1. MTA-MUA - no way, as far as I understand the postal business, it's more for the MTA-MTA.
DNSSec is generally pretty bad when it comes to end clients.
2. Everything is exactly the same as for second-level domains.