3 ms·
No, that was a comprehensive answer that explained why the question of whether the stub resolvers in macOS or iOS “supports” DNSSEC didn’t make sense to begin w
by alwillis 7y ago
No, that was a comprehensive answer that explained why the question of whether the stub resolvers in macOS or iOS “supports” DNSSEC didn’t make sense to begin with.
But I should clarify further: the Unix part of macOS does what all Unix-style operating systems do: the stub resolver forwards the requests to whatever is in /etc/resolv.conf.
But the Foundation Kit part of macOS indeed supports DNSSEC and has for years; I gave the link to the docs that describe how an app can use it. I suspect Apple and various 3rd parties have been using it for years.
Macs are popular in higher ed and government; I’m sure enough of these accounts required macOS to have DNSSEC capability built-in. Same thing for iOS.
- tptacek 7y agoNeither higher ed nor government services require DNSSEC. It's understandable why you'd think they do, because for several years the federal government did require it. They rescinded that requirement. CLOUD.GOV doesn't even support DNSSEC. By the way, .APPLE? New gTLDs are required to be DNSSEC-signed. It's no surprise that ICANN supports DNSSEC.
- alwillis 7y agoIt’s not a matter of thinking DNSSEC is required by every government or higher ed account; it’s obviously not. But different government agencies, colleges and universities have their individual requirements and for some of them, that may include DNSSEC. Everyone knows all new gTLDs are DNSSEC-signed. Like most global-scale companies, apple.com isn’t signed because of 40+ years of technical debt as the internet evolved. But if Apple wanted to utilize DNSSEC features for future services, they could do so by using the .Apple TLD.
- tptacek 7y agoApple can do whatever they want. The fact that their TLD is DNSSEC-signed is not an indication of what they will do, despite your claim to the contrary.