6 ms·
I don’t think so. Instead you would want DoH (dns over https). DNSSEC is designed to protect against MiTM and is not really effective at anything else.
by xfitm3 8y ago
I don’t think so. Instead you would want DoH (dns over https). DNSSEC is designed to protect against MiTM and is not really effective at anything else.
- renholder 8y agoFair enough. Cloudflar's promotional site for 1.1.1.1 seems to tout DNSSEC pretty heavily and only mentions DoH once, I believe. Still, clients still need to be configured for DoH, yeah?
- xfitm3 8y agoCorrect - third party software is needed (as far as I know) for DoH.
- acdha 8y agoYou do need client support but these days that’s not uncommon: Android Pie, Chrome, Firefox, and curl all have built-in support and there are apps for iOS and Android, and once you’ve enabled it it will work almost everywhere. I believe most clients default to dual resolution so it won’t break if you’re on a network which interferes (e.g. a ton of Cisco captive portals used that address in error) unless you’ve enabled hard-fail mode.