3 ms·

I was not implying the opposite (and I agree that all of this without end-to-end is less than effective), simply stating that DNSSEC is used much more than the

• tptacek 10y ago
  Since very little of the Internet is DNSSEC-signed, I think it's used a lot less than you think it is.
  • okket 10y ago
    1493 TLDs in the root zone in total 1343 TLDs are signed; 1330 TLDs have trust anchors published as DS records in the root zone; 5 TLDs have trust anchors published in the ISC DLV Repository. http://stats.research.icann.org/dns/tld_report/ http://stats.research.icann.org/dns/tld_report/
    • tptacek 10y ago
      It matters that the TLDs are signed in the sense that DNSSEC is on its face a weird joke if BANKOFAMERICA.COM can get a signature, but .COM is itself not signed. After 20+ years of standardization effort, we finally reached the point just a few years ago where Bank of America could theoretically get a meaningful signature, because .COM was signed (chaining to an RSA-1024 signature!). But BANKOFAMERICA.COM is not signed. Nor is the overwhelming majority of the Internet. Most of the TLD's are signed, because they can be required to sign by fiat, and were. But for BANKOFAMERICA.COM to be signed, the market has to recognize some value for the effort of signing and then keeping the site signed (because if they screw it up somehow once they do sign, they'll be taken off the Internet by the small but unfortunately significant portion of end-users whose ISPs are, without them asking for it, validating DNSSEC lookups). Smart operators are unlikely to do anything like that, because they all saw (for instance) what happened to HBO NOW, which was unavailable to anyone with a Comcast connection on its launch day due to a DNSSEC glitch.