3 ms·

> nothing about DNSSEC prevents a DNS server (or middlebox) from denying results to a disfavored domain But at least it is detectable thanks to NSEC and NSEC3

> nothing about DNSSEC prevents a DNS server (or middlebox) from denying results to a disfavored domain But at least it is detectable thanks to NSEC and NSEC3 records.

cyounkins 5y ago
Kind of. An intermediary can drop packets and the client will never get the response.
tptacek 5y ago
It's detectable when the site that the DNS provider is censoring falls off the Internet!