4 ms·

DH exchange on its own isn't secure against active MITM attackers.

• aaomidi 9y ago
  You can use a public key in the dns record and also activate dnssec. But dnssec isn't really that secure so...
  • gruez 9y ago
    >You can use a public key in the dns record and also activate dnssec. then you dont even need certificates, just use DANE.
  • topranks 9y ago
    DNSSEC is secure. The root is well protected. It's not trying to solve the problem of privacy, only authentication.