3 ms·
Do whatever you want as your proposed mitigation, but we are talking about the root zone here, which is signed.
by AndyMcConachie 6y ago
Do whatever you want as your proposed mitigation, but we are talking about the root zone here, which is signed.
- tptacek 6y agoMy proposed mitigation is being deployed in every modern browser, and completely eliminates the ISP-spoofed NXDOMAIN problem. Yours asks users to install their own DNS server, and still doesn't eliminate the problem. I'm comfortable saying that my advice is correct, and the advice to use DNSSEC to solve this problem is malpractice.