3 ms·
We know that a very large group of internet users are directly or indirectly using Google's public resolvers, which do DNSSEC validation. Therefor, any DNS stu
by phicoh 8y ago
We know that a very large group of internet users are directly or indirectly using Google's public resolvers, which do DNSSEC validation.
Therefor, any DNS stub library in common use already has to know about DNSSEC failures, because in some countries, like The Netherlands, or Sweden, a very large fraction of the domains are DNSSEC signed.
Due to those Google public resolvers, broken DNSSEC doesn't go unnoticed. So broken DNSSEC is actually quite rare these days.
- tptacek 8y agoI didn't just make that up; there was a measurement study at last year's Usenix. It's a debacle. https://www.usenix.org/system/files/conference/usenixsecurity17/sec17-chung.pdf https://www.usenix.org/system/files/conference/usenixsecurit...
- phicoh 8y agoI have domains that have deliberate broken DNSSEC. Does that that count toward DNSSEC being broken? Same for TLS, I have websites with broken certs. If you want to say something about how the internet is broken, then look at production traffic. Don't just take the list of all .com domains. Because many of them will never see any traffic. Of course, nobody is going to report on the alexa 1 million. Because that would be completely boring.