4 ms·
What's the use case? Thanks to TLS, you don't need DNSSEC for the Web. For email, if your DNSSEC-enabled domain delegates to a provider that isn't DNSSEC-enable
by hsivonen 11y ago
What's the use case? Thanks to TLS, you don't need DNSSEC for the Web. For email, if your DNSSEC-enabled domain delegates to a provider that isn't DNSSEC-enabled, you haven't accomplished anything of true value.
- captn3m0 11y agoI was gonna reply how we need to prevent DNS queries from being eavesdropped. But it seems, DNSSEC does not support traffic encryption: >DNSSEC does not provide confidentiality of data; in particular, all DNSSEC responses are authenticated but not encrypted. (From the wiki) However, DNS poisoning attacks are still relevant because not all of the web is on HTTPS.
- hsivonen 11y agoAddressing non-HTTPS Web issues with migration to DNSSEC instead of migration to HTTPS is totally bogus. It's especially bogus as a use case in the Cloudflare case, since Cloudflare had HTTPS first.