3 ms·
NXDOMAIN can't be signed. DNSSEC only insures that a positive answer is traceable to the trust anchor.
by formerly_proven 5y ago
NXDOMAIN can't be signed. DNSSEC only insures that a positive answer is traceable to the trust anchor.
- bawolff 5y agoNSEC can and are signed under dnssec. Its impossible to prevent denial of service generally, but you can use crypto to detect when it might be happening.
- formerly_proven 5y agoThanks for the correction, I wasn't aware of the NSEC/NSEC3 "non-existence" proofs.