4 ms·

Thanks! Not sure I made that point clearly but I'm not saying that performing validation against the MX target is wrong. However it requires the MX to be authe

Thanks! Not sure I made that point clearly but I'm not saying that performing validation against the MX target is wrong. However it requires the MX to be authenticated (i.e. signed with DNSSEC), otherwise the attacker can just falsify the MX and have mail delivered to a server for which it has a valid certificate, making validation useless.

jcrites 11y ago
Some additional arguments against DNSSEC and a FAQ from Thomas Ptacek: http://sockpuppet.org/blog/2015/01/15/against-dnssec/ http://sockpuppet.org/blog/2015/01/15/against-dnssec/ http://sockpuppet.org/stuff/dnssec-qa.html http://sockpuppet.org/stuff/dnssec-qa.html I was not familiar with that EFF project. Looks like an interesting starting point. I wonder if, rather than maintaining a central configuration file, domain owners could vend configuration through canonical URLs on each domain, like https://example.com/.smtp-ssl https://example.com/.smtp-ssl for example.com - essentially bootstrap the security through another protocol that's more mature. (This could have the effect of using the existing CA system rather than relying on a government-controlled PKI.)