Some additional arguments against DNSSEC and a FAQ from Thomas Ptacek: http://sockpuppet.org/blog/2015/01/15/against-dnssec/ http://sockpuppet.org/blog/2015/01

Some additional arguments against DNSSEC and a FAQ from Thomas Ptacek: http://sockpuppet.org/blog/2015/01/15/against-dnssec/ http://sockpuppet.org/blog/2015/01/15/against-dnssec/ http://sockpuppet.org/stuff/dnssec-qa.html http://sockpuppet.org/stuff/dnssec-qa.html I was not familiar with that EFF project. Looks like an interesting starting point. I wonder if, rather than maintaining a central configuration file, domain owners could vend configuration through canonical URLs on each domain, like https://example.com/.smtp-ssl https://example.com/.smtp-ssl for example.com - essentially bootstrap the security through another protocol that's more mature. (This could have the effect of using the existing CA system rather than relying on a government-controlled PKI.)