3 ms·

> with the exception of Cloud Flare, which provides DNSSEC services, and some Paypal domains, no major tech companies sign their zones with DNSSEC. I was curio

• tptacek 7y ago
  No, this is super helpful. Booz Allen, United Technologies, and Raytheon are government contractors. For several years, the USG had a policy of requiring DNSSEC for its own internal zones and had sent signals that its partners would require DNSSEC as well. But a year and a half ago, the USG rescinded the requirement, and no longer recommends DNSSEC even for internal .gov zones. Comcast is an interesting example because their adoption of DNSSEC broke a major project rollout: the week HBO NOW became available, it was unreachable from their networks due to a DNSSEC misconfiguration. Another data point: of the Alexa Top 50 in the US, only FORCE.COM is DNSSEC-signed. But SALESFORCE.COM isn't; similarly, Paypal is signed, but its popular subsidiaries like Braintree and Venmo aren't. Or take the Moz 500; you'll find Mozilla is signed, as are a bunch of .GOV sites (see above), some European sites, and, if we're keeping score in the US, also Fox News, Time, Mediafire, and, weirdly, Themeforest. For reasons I do not understand, Stanford, Berkeley, and CMU have taken the time to sign as well. And that's it. (For others reading: you can take a list of domains and do a quick spot check for DNS by just running "host -t ds (domain)".)
  • Abekkus 7y ago
    Where is there a rescindment of usg public dnssec requirements? It's still a requirement even for fedramp-low. https://www.fedramp.gov/search-results/?search=dnssec https://www.fedramp.gov/search-results/?search=dnssec
    • tptacek 7y ago
      https://cloud.gov/docs/compliance/domain-standards/#dnssec https://cloud.gov/docs/compliance/domain-standards/#dnssec Note that cloud.gov is FedRAMP-authorized and does not itself support DNSSEC, which I point out in addition to the rationale cloud.gov provides on that link (which answers your direct question).