To this goal, DNSSEC has invented the RRSIG record type, the Resource Record Signature, and it is indeed sent with answers, it looks like this:
a.z.w.example. 3600 IN MX 1 ai.example.
a.z.w.example. 3600 RRSIG MX 5 2 3600 20040509183619 (
20040409183619 38519 example.
This is the MX record of a.z.w.example, which points to ‘ai.example’, followed by its signature. You can see in the RRSIG that this is a signature of the MX record of a.z.w.example.com, that the signature algorithm is number ‘5’.