4 ms·
Or, if the site you're visiting is DNSSEC enabled, you could just look for a TLSA record. If the TLSA record is present, don't allow unencrypted connectivity.
by AndyMcConachie 11y ago
Or, if the site you're visiting is DNSSEC enabled, you could just look for a TLSA record. If the TLSA record is present, don't allow unencrypted connectivity.
That's probably how you could replace HSTS with DNS.
- cbsmith 11y agoEven without DNSsec, HSTS could pretty much work as advertised.