What's the deal with DNSSec for ordinary websites? Even if don't use Cloudflare (or Google Cloud, which also supports DNSSEC), signing your zone has gotten pre

What's the deal with DNSSec for ordinary websites? Even if don't use Cloudflare (or Google Cloud, which also supports DNSSEC), signing your zone has gotten pretty easy. All of the major authoritative DNS servers support automatic DNSSEC signing and automatic key rollover of the Key Signing Key (KSK) and Zone Signing Key (ZSK). For example, here's the configuration for automatic DNSSEC signing for Knot DNS [1]: zone: - domain: myzone.test dnssec-signing: on That’s all that’s required to DNSSEC sign a zone using Knot’s default settings. But if you want all of the bells and whistles, you can have that too. Let me say just having SSHFP support thanks to DNSSEC turns using SSH from annoying to "it just works" [2] if you admin a server. Setting up DNSSEC was difficult back in the day, but it’s pretty easy now. [1]: https://www.knot-dns.cz/docs/2.9/html/configuration.html#automatic-dnssec-signing https://www.knot-dns.cz/docs/2.9/html/configuration.html#aut... [2]: https://weberblog.net/sshfp-authenticate-ssh-fingerprints-via-dnssec/ https://weberblog.net/sshfp-authenticate-ssh-fingerprints-vi...