What DNSSEC protects against
Without DNSSEC it is in theory possible to inject false DNS answers and send your visitors to the wrong server, or capture mail at the wrong mail server. This is called DNS spoofing.
DNSSEC signs every answer cryptographically. The party asking can then verify that the answer is genuine and was not altered in transit. This closes off an entire class of attacks against the lookup itself.
When it is worth the effort
For many smaller organisations the risk of active DNS spoofing is low, in which case DNSSEC is a bonus rather than a must. If you handle sensitive data, financial services or public-sector work, the benefit weighs heavier.
Factor in that DNSSEC needs maintenance. If you change DNS provider or miss a key rotation, the domain can stop responding entirely. Turn it on once you have a routine to manage it.
How to turn it on
First enable DNSSEC at your DNS provider. Your zone is then signed and a DS record is generated, a small key fingerprint.
You then add the DS record at your registrar, that is, where the domain is registered. That is what links the chain up to the top-level domain. Without the DS record the signing has no effect. Once both steps are done the chain is complete.
It is not mandatory
DNSSEC is not a requirement for mail and web to work, and its absence is not a serious fault in itself. Think of it as an extra layer for those who want to harden the lookup.
Run a check in KOLLEN to see whether your domain is signed and whether the DS record is correctly placed at the registrar.