3 ms·
How do they pick out the target domain without packet inspecting all your DNS traffic?
by eikenberry 7y ago
How do they pick out the target domain without packet inspecting all your DNS traffic?
- tptacek 7y agoIf they were "packet inspecting all your DNS traffic", DNSSEC wouldn't matter to begin with, because it's a server-to-server protocol; your browser's resolver can't cryptographically verify anything. But that's not in fact what's happening.
- eikenberry 7y agoBut we are specifically talking a using a recursive resolver communicating with the root servers, server-to-server. The browser only comes into play here as a client to the local resolver. The original context was about a pi-hole running a recursive resolver directly against the root servers instead of the ISP's.