DNSSEC secures server-to-server DNS lookups, not the client-to-server lookups that your browser generates. I have heard that both CeroWRT and OpenWRT support D

DNSSEC secures server-to-server DNS lookups, not the client-to-server lookups that your browser generates. I have heard that both CeroWRT and OpenWRT support DNSSEC validation. There's also DNSSEC-trigger with Unbound for local DNSSEC validation. Maybe someone on here knows more, but I believe this directly addresses this issue. DNSSEC also is completely orthogonal to things like dprive which encrypt DNS queries. I'm not that familiar with DNSCurve but I believe it functions similar to dprive. its real use case, that of replacing the CAs with DNS TLD operators, has the net effect of signing Internet cryptographic trust over to the world governments that control the most important TLDs. I think you're referring to DANE, and DANE is not intended to replace the CA system, but instead augment it. See my article on this here: http://metafarce.com/adventures-in-dane/ http://metafarce.com/adventures-in-dane/. DANE simply provides another means to verify the authenticty of a TLS cert, it doesn't replace the CA system, and having multiple methods for ensuring cert integrity is a net positive for the Internet. The foundations of our CA system are not sound. Any compromised CA threatens sites secured by all CAs. In addition to specifying a hash of a site's TLS cert, DANE allows a site operator to lock down their trust anchor to the single CA they use. I also don't get the signing Internet cryptographic trust over to the world governments thing. Please explain how you reach this conclusion. I've deployed DANE on a .com, and I never gave any private keys to anyone. I only needed to provide a hash of my TLS cert to my DNS provider. Granted my DNS provider could change the hash to something else, or redirect my site to somewhere else. Also, the TLD operator for .com could redirect my NS records to somewhere else as well, and then sign it with the TLD's ZSK. But they can already do that without DNSSEC, and I would notice this pretty quickly and attribute the attack to them. the protocol is famously annoying to deploy and has caused major outages, including breaking the first day of HBO Now across all of Comcast. This is where I will agree with you. DNSSEC is tough and complicated to deploy. However, this does not mean it has no value. If companies like Cloudflare make it easier to deploy DNSSEC then that is a net win for Internet security. DNSSEC isn't about helping you with your security issues. I really like being able to trust what DNS servers tell me. That's an immediate benefit to me and my security.