3 ms·
Presumably advanced users can pick a resolver with DNSSEC support?
by jopsen 9y ago
Presumably advanced users can pick a resolver with DNSSEC support?
- aaronmdjones 9y agoYou mean the resolver does the verifying? That doesn't solve anything; anyone doing an MITM attack between the user and their resolver can flip the 'ad' (Authenticated Data) bit to '1' even if the verification failed, and if the user isn't verifying the signatures too, they will blindly trust the value of this bit. Users need to run their own local /verifying/ resolvers for this to be secure (or have a trusted path between them and their remote resolver, e.g. IPsec-AH or DNScrypt).