3 ms·
Does that mitigate this scenario? In many cases, clients may be talking directly to 1.1.1.1, not servers. At least that is a pattern I have seen people using.
by LinuxBender 6y ago
Does that mitigate this scenario? In many cases, clients may be talking directly to 1.1.1.1, not servers. At least that is a pattern I have seen people using. Only servers validate DNSSEC. So people using Unbound DNS at home or in their corporate network may be protected from this, but I am not aware of any local OS resolvers that validate DNSSEC. You are right though, people should certainly be using DNSSEC on all their zones.
- alwillis 6y agoYou can use Unbound as your local resolver pretty easily. I run it on an old laptop running FreeBSD and have my other machines use it as their DNS server.
- LinuxBender 6y agoAbsolutely. I do this as well on a couple laptops so I get the same anti-adware my home network has. I've even managed to get a couple other people to try it out.
- tptacek 6y agoThat solves that one DNSSEC problem for you, but no mainstream operating system deploys a local DNSSEC-validating recursive cache, and something like half of all Internet usage comes from mobile/tablet devices where you can't do that at all. Realistically, to a first approximation, nobody is going to do this.