4 ms·
How do you mean 'break'? As I understand it, NXDOMAIN also has to be signed with a trust chain back to a root authority. I guess what I don't know enough to a
by newhouseb 15y ago
How do you mean 'break'? As I understand it, NXDOMAIN also has to be signed with a trust chain back to a root authority. I guess what I don't know enough to answer is if there are other equally sufficient error codes that don't require a trust chain (which would be surprising because allowing any non-trusted responses would seem to defeat the entire purpose of a non-tamperable DNS service)
- koenigdavidmj 15y agoOnly the answers in the DNS response are signed. The DNS header (which is where the NXDOMAIN lives) is not signed.
- pyre 15y agoI think that DNSSEC is more concerned with preventing DNS poisoning and man-in-the-middle attacks than with using NXDOMAIN to block access.