2 ms·
> if you can spoof DNS replies, you can probably strip the DNSSEC records You can't. DNSSEC has explicit protections against that.
by Ajedi32 8y ago
> if you can spoof DNS replies, you can probably strip the DNSSEC records
You can't. DNSSEC has explicit protections against that.
- rocqua 8y agoThose don't work if you claim to be a non DNSSEC compliant resolver. Should clients really fail closed when faced with a non DNSSEC resolver they got from e.g. the starbucks WiFi DHCP? And if they should, do you really think they will? Because users will complain loudly.
- Ajedi32 8y agoClients, no. Certificate Authorities like Let's Encrypt, yes. (And in fact, they already do behave that way.)