4 ms·
Sadly, if you can spoof DNS replies, you can probably strip the DNSSEC records. You need fail-closed systems for security, but fail-closed systems are not user
by rocqua 8y ago
Sadly, if you can spoof DNS replies, you can probably strip the DNSSEC records. You need fail-closed systems for security, but fail-closed systems are not user friendly, and thus won't be accepted.
- Ajedi32 8y ago> if you can spoof DNS replies, you can probably strip the DNSSEC records You can't. DNSSEC has explicit protections against that.
- rocqua 8y agoThose don't work if you claim to be a non DNSSEC compliant resolver. Should clients really fail closed when faced with a non DNSSEC resolver they got from e.g. the starbucks WiFi DHCP? And if they should, do you really think they will? Because users will complain loudly.
- Ajedi32 8y agoClients, no. Certificate Authorities like Let's Encrypt, yes. (And in fact, they already do behave that way.)