3 ms·
The tweet you linked to is making false claims about dnssec. It doesn't "blow up the sizes of dns requests" If you aren't explicitly looking up dnssec signatur
by Abekkus 8y ago
The tweet you linked to is making false claims about dnssec. It doesn't "blow up the sizes of dns requests" If you aren't explicitly looking up dnssec signatures, a signed zone's responses will be the same length as an unsigned zone's responses.
Also, dnssec for their real website, icann.org, is properly configured.
- agwa 8y ago> The tweet you linked to is making false claims about dnssec. It doesn't "blow up the sizes of dns requests" If you aren't explicitly looking up dnssec signatures, a signed zone's responses will be the same length as an unsigned zone's responses. Unbound 1.6.0, BIND 9.9.5, and Google Public DNS all set the DO bit in their queries even when there's no DS record in the parent zone, so the DSSEC records will indeed be included in responses. And that's not even addressing the amplification risk. > Also, dnssec for their real website, icann.org, is properly configured. Are you disputing that ICANN owns and operates icann.com?