4 ms·
In theory, this could be relatively easily circumvented with DANE. The problem is getting businesses to implement it for their domains when even simple things l
by 2000UltraDeluxe 4y ago
In theory, this could be relatively easily circumvented with DANE. The problem is getting businesses to implement it for their domains when even simple things like SPF and DKIM is a complete mess aleready.
- LeonM 4y ago> relatively easily Don't forget that DANE requires DNSSEC, which your DNS service provider must support (and switching DNS provider is not 'relatively easy'). Another problem with DNSSEC is that there are some people (and with 'some people' I mean tptacek) who are ferociously against it. Also, TLSA records require maintenance. If you forget to update them you will break things. Had to rotate your keys unexpectedly? Well now you have to wait for DNS propagation and explain your boss that some of your customers may get scary warning messages for a few hours when they try to reach you, and there will be nothing you can do about it.
- tptacek 4y agoDANE does the opposite of circumventing this problem: it ratifies it. The DANE authorities are, de jure, the world governments that control the major DNS TLDs.