3 ms·
Yep, this discussion about DNSSEC happens here from time to time usually with the same arguments. Once Chrome even supported DANE certs for domains but depreca
by hdhzy 9y ago
Yep, this discussion about DNSSEC happens here from time to time usually with the same arguments.
Once Chrome even supported DANE certs for domains but deprecated it for I think performance reasons:
> Some years ago now, Chrome did an experiment where we would lookup a TXT record that we knew existed when we knew the Internet connection was working. At the time, some 4–5% of users couldn't lookup that record; we assume because the network wasn't transparent to non-standard DNS resource types. DANE records are going to be even more non-standard, are going to be larger and browsers would have to fetch lots of them because they'll need the DNSKEY/RRSIG chain up from the root. Even if DNSSEC record lookup worked flawlessly for everyone, we probably still wouldn't implement this aspect of DANE because each extra lookup is more latency and another chance for packet loss to cause an expensive timeout and retransmit.
Source: https://www.imperialviolet.org/2015/01/17/notdane.html https://www.imperialviolet.org/2015/01/17/notdane.html
Is DANE currently used for anything? XMPP certs?
- toast0 9y agoI don't think DANE is really in use; although there's some hints it may be usable with SMTP (postfix has support). I'm not sure DANE is realistically usable anyway -- unless it was for a protocol which specified DANE only, you'd need to have a CA signed cert for interoperability with clients that didn't support it; in which case, you may as well just use that. I guess it makes sense for SMTP -- generally certificates are not validated when delivering mail, under the theory that encryption with an invalid cert is better than plaintext, and there's not a usable UI to let the sender pick what to do. In that case, DANE can work, but I kind of doubt there's much adoption still.