4 ms·
dnsmasq, unwind and others all support DNSSEC If you can get a DNS path with DNSSEC, this bypasses the ISP's ability to manipulate your DNS. Of course, DNS over
by teunispeters 6y ago
dnsmasq, unwind and others all support DNSSEC
If you can get a DNS path with DNSSEC, this bypasses the ISP's ability to manipulate your DNS.
Of course, DNS over HTTP is another solution to the same, for browsers.
Of course one could also tunnel through.
(YMMV again with trust paths but eyes open helps)
- tptacek 6y agoIt doesn't matter how much of your own software supports DNSSEC: if the sites you talk to on the Internet don't explicitly support it, DNSSEC does nothing for you. This is a problem, because most sites on the Internet don't support it. Several of the most important sites on the Internet, with some of the largest security teams in the industry, have said they don't intend ever to support it. On the other hand, DNS over HTTPS defeats ISP DNS interception regardless of who supports it, which is why so many more people use it than use DNSSEC, which is moribund.