3 ms·
DANE is relatively new, but already we have over 50,000 MX records with associated TLSA records. So DANE is actually being used regularly, and these numbers are
by AndyMcConachie 10y ago
DANE is relatively new, but already we have over 50,000 MX records with associated TLSA records. So DANE is actually being used regularly, and these numbers are growing. There's more to the Internet than just the web and browsers.
> Practically 100% of all commercial DNS lookups --- that is, lookups done in the service of actual commerce --- are done without DNSSEC.
Wait what? I'm not sure what you categorize as a 'commercial DNS lookup', and I'm not even sure it matters, because this statement is so completely false I don't even know where to begin. All of Comcast's subscriber base are using recursive resolvers that use DNSSEC, are none of them performing 'commercial DNS lookups'?
- tptacek 10y agoNo, in fact, virtually nobody in the real world uses DANE, because no browser supports DANE. Chrome and Firefox briefly attempted DANE a few years ago, and both removed it. The Chromium team --- the single most important mover in SSL/TLS security --- has been pretty plain about the fact that DANE isn't on the agenda. You might start with this Adam Langley post: https://www.imperialviolet.org/2015/01/17/notdane.html https://www.imperialviolet.org/2015/01/17/notdane.html
- AndyMcConachie 10y agoSo after I bring up the fact that DANE is being used for SMTP you state that no one is using it because it's not being used for HTTPS? BTW I'm not even arguing for DANE in this thread. I was arguing for DNSSEC specifically. You brought up DANE to make some point about DNSSEC. But we can have DNSSEC without DANE.