3 ms·
You can run a local resolver that forwards all queries to 8.8.8.8 while still running dnssec validation, and get both the speed benefit of a caching infrastruct
by Abekkus 8y ago
You can run a local resolver that forwards all queries to 8.8.8.8 while still running dnssec validation, and get both the speed benefit of a caching infrastructure, and the authentication of dnssec. With only one trusted key.
- tptacek 8y agoYes, DNSSEC works fine for endpoints if we eliminate globally the concept of a DNS client and a shared cache and just have everyone run their own DNS servers.
- Abekkus 8y agoThe configuration I spoke of does not eliminate a shared cache, it uses the existing shared cache. In addition, a validating endpoint resolver is no more a "dns server", than a stub resolver is.
- tptacek 8y agoYour proposal drastically changes the role of all mainstream endpoint resolvers, which today delegate the recursive part of the lookup to "DNS servers" and which, in the world you're thinking of, would own that lookup completely and use DNS servers, if at all, as mere request forwarders. Not for nothing, but even the IETF doesn't want you to do this.