3 ms·

I said however, it’s likely the majority of resolvers that have been deployed in the last few years support DNSSEC The word deploy should have been a hint. IT

I said however, it’s likely the majority of resolvers that have been deployed in the last few years support DNSSEC The word deploy should have been a hint. IT departments deploy resolvers, not consumers. BIND is the most widely used DNS resolver and authoritative server; it’s had DNSSEC support since version 9, released 20 years ago. People using 8.8.8.8 aren't using DNSSEC… As far as DNSSEC is concerned, there’s no difference between using 8.8.8.8 or a DNSSEC-aware resolver on their network or laptop. Either one will validate signed DNS records. Does the macOS resolver support it? Does the iOS resolver support it? The resolvers in laptops, desktops and smartphones are stub resolvers; all they do forward to a recursive resolver on the internet. If you're a macOS user on Comcast for example, the Mac’s stub resolver forwards to 75.75.75.75, Comcast’s DNSSEC-aware resolver. This also allows a user of a VPS like Digital Ocean, Vultr, etc. and is running email, web, ssh, etc. to take advantage of DANE features like TLSA, SSHFP, OPENPGPKEY and SMIMEA [1] because their zone is signed and they’re using one of the DNSSEC-aware resolvers like 1.1.1.1, 75.75.75.75, etc. Regarding macOS and iOS, they both ship with the dnssd framework, which supports DNSSEC. [2] So an app can use DNSSEC to validate DNS records. If my ISP's resolver doesn't support DNSSEC and I want it for an iOS device, there are apps for that, like Cloudflare’s that gives iOS users access to 1.1.1.1 [3] Perhaps Apple has more planned; I suspect they didn’t create the .Apple brand TLD for nothing. We’ll see what happens but it has 13 parked domains and is obviously DNSSEC-signed. [4] apple. 900 IN SOA a0.nic.apple. noc.afilias-nst.info. ( 1000003970 ; serial 10800 ; refresh (3 hours) 3600 ; retry (1 hour) 2764800 ; expire (4 weeks 4 days) 900 ; minimum (15 minutes) ) apple. 900 IN RRSIG SOA 7 1 86400 ( 20200317052047 20200225042047 10359 apple. Ts3cLQHsuWUuH9RZrYXbNJyh1yuUgob/3zcqiknFvQaa Eh0piMqozTeXziVKVBWoejC/AV9XjJEfeMAEs/ccaIsR GWDVJCDG/X+b/ocdEuQnYEMvaF9F8rFLgA8ILzru8DI5 SBCiRNqWtgjwcRuoEZQ6vGf0inm/eJsoJA2z+j4= ) [1]: https://greatdane.io https://greatdane.io [2]: https://developer.apple.com/documentation/dnssd/1823436-anonymous/kdnsserviceflagsvalidate?language=occ#declarations https://developer.apple.com/documentation/dnssd/1823436-anon... [3]: https://apps.apple.com/us/app/1-1-1-1-faster-internet/id1423538627 https://apps.apple.com/us/app/1-1-1-1-faster-internet/id1423... [4]: https://www.apple.com/legal/intellectual-property/tld/dps/ https://www.apple.com/legal/intellectual-property/tld/dps/

tptacek 7y ago
That was a very long way to type the words "no, they don't".
- alwillis 7y ago
  No, that was a comprehensive answer that explained why the question of whether the stub resolvers in macOS or iOS “supports” DNSSEC didn’t make sense to begin with. But I should clarify further: the Unix part of macOS does what all Unix-style operating systems do: the stub resolver forwards the requests to whatever is in /etc/resolv.conf. But the Foundation Kit part of macOS indeed supports DNSSEC and has for years; I gave the link to the docs that describe how an app can use it. I suspect Apple and various 3rd parties have been using it for years. Macs are popular in higher ed and government; I’m sure enough of these accounts required macOS to have DNSSEC capability built-in. Same thing for iOS.
  - tptacek 7y ago
    Neither higher ed nor government services require DNSSEC. It's understandable why you'd think they do, because for several years the federal government did require it. They rescinded that requirement. CLOUD.GOV doesn't even support DNSSEC. By the way, .APPLE? New gTLDs are required to be DNSSEC-signed. It's no surprise that ICANN supports DNSSEC.
    - alwillis 7y ago
      It’s not a matter of thinking DNSSEC is required by every government or higher ed account; it’s obviously not. But different government agencies, colleges and universities have their individual requirements and for some of them, that may include DNSSEC. Everyone knows all new gTLDs are DNSSEC-signed. Like most global-scale companies, apple.com isn’t signed because of 40+ years of technical debt as the internet evolved. But if Apple wanted to utilize DNSSEC features for future services, they could do so by using the .Apple TLD.
      - tptacek 7y ago

tptacek 7y ago

That was a very long way to type the words "no, they don't".

alwillis 7y ago
No, that was a comprehensive answer that explained why the question of whether the stub resolvers in macOS or iOS “supports” DNSSEC didn’t make sense to begin with. But I should clarify further: the Unix part of macOS does what all Unix-style operating systems do: the stub resolver forwards the requests to whatever is in /etc/resolv.conf. But the Foundation Kit part of macOS indeed supports DNSSEC and has for years; I gave the link to the docs that describe how an app can use it. I suspect Apple and various 3rd parties have been using it for years. Macs are popular in higher ed and government; I’m sure enough of these accounts required macOS to have DNSSEC capability built-in. Same thing for iOS.
- tptacek 7y ago
  Neither higher ed nor government services require DNSSEC. It's understandable why you'd think they do, because for several years the federal government did require it. They rescinded that requirement. CLOUD.GOV doesn't even support DNSSEC. By the way, .APPLE? New gTLDs are required to be DNSSEC-signed. It's no surprise that ICANN supports DNSSEC.
  - alwillis 7y ago
    It’s not a matter of thinking DNSSEC is required by every government or higher ed account; it’s obviously not. But different government agencies, colleges and universities have their individual requirements and for some of them, that may include DNSSEC. Everyone knows all new gTLDs are DNSSEC-signed. Like most global-scale companies, apple.com isn’t signed because of 40+ years of technical debt as the internet evolved. But if Apple wanted to utilize DNSSEC features for future services, they could do so by using the .Apple TLD.
    - tptacek 7y ago