3 ms·
It protects against targeted DNS poisoning, but that is already covered by TLS.
by rocqua 8y ago
It protects against targeted DNS poisoning, but that is already covered by TLS.
- ancarda 8y agoHow is that protected by TLS? Wouldn't you need a good A/AAAA record to make a connection to a TLS server? Or do you perhaps mean DNS over (TLS|HTTPS)? I never saw that as a complete replacement for DNSSEC; it provides transport security, yes, but how do we know we aren't talking to a malicious resolver? Maybe that's not as much of a threat if people aren't using DNS servers from their ISP -- which sometimes inject ads or otherwise tamper with traffic.