3 ms·
> the page you're citing talks (1) about stub-to-cache DNS lookups that DNSSEC doesn't protect at all, but DoH does Both DNSSEC and DoH can protect against DNS
by wizeman 4y ago
> the page you're citing talks (1) about stub-to-cache DNS lookups that DNSSEC doesn't protect at all, but DoH does
Both DNSSEC and DoH can protect against DNS hijacking. DNSSEC can give you end-to-end protection if you use a DNSSEC-enabled resolver and the domain supports DNSSEC, while DoH can only protect one link in the chain, no matter what you do.
> whatever weird thingy your system does, I respect it
What is weird about running a local caching resolver? Most modern Linux systems do that, as far as I know. I simply use one that does DNSSEC verification by default.
I don't see why Android/iOS phones or Windows systems wouldn't be able to do that by default in 2022, if their developers really wanted to implement that.
> it is simply not the case that millions of mainstream users are going to run fully recursive DNS caches on their phones and laptops any time soon.
Yeah, not with that attitude :)
- tptacek 4y agoNot with any attitude: what you and the phone sysadmins propose is, effectively, to eliminate all shared DNS caching from the Internet. A beautiful dream! But that's all it is. That no mainstream operating system in the world does this is all the evidence I need to dispose of this part of the argument.
- wizeman 4y ago> Not with any attitude: what you and the phone sysadmins propose is, effectively, to eliminate all shared DNS caching from the Internet. A beautiful dream! But that's all it is. No, a local caching resolver (with or without DNSSEC verification enabled by default) would talk to the upstream DNS server by default, like a stub resolver, so it benefits from the upstream DNS server cache.