3 ms·

I feel that the article should make mention of dnssec which can guarantee non-existance of dns records by signing every response. Of course this relies on the e

by chaz6 7y ago

I feel that the article should make mention of dnssec which can guarantee non-existance of dns records by signing every response. Of course this relies on the end user having a dnssec-aware stub resolver.

tptacek 7y ago
It also relies on the zones being looked up actually being signed with DNSSEC, but virtually none of them are. After 25 years of standardization effort there is practically no deployment of DNSSEC among the popular Internet or in the US. The protocol is moribund; it's not worth configuring.