5 ms·
There are tlds that are unsigned, and any domains that are unsigned. You can not verify the entire chain, because it is possible that the domain you are looking
by georgyo 8y ago
There are tlds that are unsigned, and any domains that are unsigned. You can not verify the entire chain, because it is possible that the domain you are looking up is infact unsigned. You can maybe pin some of the tld keys, but you can't pin all the domains under them.
- mike-cardwell 8y agoI don't know what the figures are today, but in 2016, 89% of TLDS were signed using DNSSEC - https://www.internetsociety.org/blog/2017/01/state-of-dnssec-deployment-2016-report-shows-over-89-of-top-level-domains-signed/ https://www.internetsociety.org/blog/2017/01/state-of-dnssec...
- Avamander 8y ago> You can not verify the entire chain, because it is possible that the domain you are looking up is infact unsigned. Then you conclude that it's okay that the domain is unsigned. Else - hard fail.