> it's getting a critical mass of the Internet to reconfigure their DNS, in an environment where the last several years shows well-funded shops blowing themselv

> it's getting a critical mass of the Internet to reconfigure their DNS, in an environment where the last several years shows well-funded shops blowing themselves up just trying to get this done. You mentioned yourself that DNSSEC can be activated automatically by registries, like what has been done in Europe, so I don't really see that as being an issue. Sure, you can fuck up if you start messing around with DS records and whatnot, like Slack did (and BTW, they're still using DNSSEC even after experiencing that outage), but once you start messing around with DNS you can also fuck up in many other ways that have nothing to do with DNSSEC. So that is not really a problem with DNSSEC itself. > The protocol was designed to trust the link between the OS stub resolver and the DNS server, because it was designed in 1995 when even small networks ran and trusted their own BIND servers. Sure, but we're not in 1995 anymore, so there's no issue with running a resolver with DNSSEC validation at the client level anymore. > What you're really saying is that Linux nerds can just run their own DNS servers. No, I'm saying OS manufacturers like Google, Apple and Microsoft can implement DNSSEC validation on the DNS resolvers of their OSes, just like Google implemented DNS-over-HTTPS transport (which also wasn't an option in 1995). > But we don't design global Internet security to serve people who want to sysadmin their own phones. Fortunately, that's not what I'm proposing. > It has to work for normal people. Agreed :)