3 ms·
There's also https://tools.ietf.org/html/rfc4956 https://tools.ietf.org/html/rfc4956 , which allows a domain to sign that a range of DNS entries does not exist;
by raldi 9y ago
There's also https://tools.ietf.org/html/rfc4956 https://tools.ietf.org/html/rfc4956 , which allows a domain to sign that a range of DNS entries does not exist; under this system, a client resolver could demand cryptographic proof that a domain was missing certain records, which stops the MitM RR-stripping attack.