5 ms·

The rate of DNSSEC signed zones is growing, but the number of recursive resolvers that hard fail on validation failures is static or going down. Unfortunately

by mike_d 4y ago

The rate of DNSSEC signed zones is growing, but the number of recursive resolvers that hard fail on validation failures is static or going down. Unfortunately the user experience for a DNSSEC signature failure is so bad, the only option if you run a large ISP or corporate network is to just use the answer you get anyway.

teddyh 4y ago
Since (regrettably, for other reasons), many people seem to be moving to use centralized resolvers which all, incidentally, do validate DNSSEC strictly, I doubt whether “number of recursive resolvers” is a valid proxy for “number of users using DNSSEC validation in practice” anymore. In fact, I see a lot of people advocating for using centralized resolvers, and not even once have I seen a counter-argument in the form of DNSSEC validation being a problem.
- tptacek 4y ago
  What does it matter if your centralized resolver across the Internet is doing DNSSEC? The same on-path attacker DNSSEC was designed to address can defeat DNSSEC on the path between you and the resolver. It's a baffling design.
  - teddyh 4y ago
    It matters because the topic was whether DNSSEC is growing or not, specifically whether more or fewer users are using DNSSEC validating resolvers. You’re not just moving the goalposts, you’re changing the topic entirely.
    - mike_d 4y ago
      The horse has been beaten to death - DNSSEC is dead. It continues to see adoption on the authoritative side because turning it on in a basic state and letting it limp along costs almost nothing. Many recursive servers do validate DNSSEC, but disable it on a per-zone basis when validation failures happen and users start to complain. tptacek raises an additional good point that DNSSEC does nothing to protect the last mile of a query. It also provides zero confidentiality. dnscrypt was always a superior implementation, but saw little uptake because people blindly believed the DNSSEC propaganda.
      - teddyh 4y ago
        From my perspective, DNSSEC is very much alive, and moreso every year. At work, we only ever see requests for more DNSSEC from everybody; both customers and TLDs/registries. Nobody at conferences, both formally and in informal conversations, has said anything against DNSSEC in principle. I used to say that I ever only saw one person argue against DNSSEC; and it was here on HN. I guess that I can now say that it is two people, both here on HN. If validation failures were that common, I would think I, working at a domain registrar and authoritative DNS provider, would hear about it. The last mile problem would be solved by DoT/DoH, no? If anything is a “dead horse”, it’s dnscrypt. Are you claiming that DNSSEC is some sort of industry conspiracy?
        tptacek 4y ago
        It's a conspiracy, but not from the industry, which has broadly rejected it. :)
        teddyh 4y ago
        What “industry” would that be? Certainly not the DNS industry, or their customers (i.e. anybody who wants a domain name). Do you mean “rejected” in the same sense as how IPv6 is still only slowly being adopted?

by mike_d 4y ago

teddyh 4y ago

Since (regrettably, for other reasons), many people seem to be moving to use centralized resolvers which all, incidentally, do validate DNSSEC strictly, I doubt whether “number of recursive resolvers” is a valid proxy for “number of users using DNSSEC validation in practice” anymore. In fact, I see a lot of people advocating for using centralized resolvers, and not even once have I seen a counter-argument in the form of DNSSEC validation being a problem.

tptacek 4y ago
What does it matter if your centralized resolver across the Internet is doing DNSSEC? The same on-path attacker DNSSEC was designed to address can defeat DNSSEC on the path between you and the resolver. It's a baffling design.
- teddyh 4y ago
  It matters because the topic was whether DNSSEC is growing or not, specifically whether more or fewer users are using DNSSEC validating resolvers. You’re not just moving the goalposts, you’re changing the topic entirely.
  - mike_d 4y ago
    The horse has been beaten to death - DNSSEC is dead. It continues to see adoption on the authoritative side because turning it on in a basic state and letting it limp along costs almost nothing. Many recursive servers do validate DNSSEC, but disable it on a per-zone basis when validation failures happen and users start to complain. tptacek raises an additional good point that DNSSEC does nothing to protect the last mile of a query. It also provides zero confidentiality. dnscrypt was always a superior implementation, but saw little uptake because people blindly believed the DNSSEC propaganda.
    - teddyh 4y ago
      From my perspective, DNSSEC is very much alive, and moreso every year. At work, we only ever see requests for more DNSSEC from everybody; both customers and TLDs/registries. Nobody at conferences, both formally and in informal conversations, has said anything against DNSSEC in principle. I used to say that I ever only saw one person argue against DNSSEC; and it was here on HN. I guess that I can now say that it is two people, both here on HN. If validation failures were that common, I would think I, working at a domain registrar and authoritative DNS provider, would hear about it. The last mile problem would be solved by DoT/DoH, no? If anything is a “dead horse”, it’s dnscrypt. Are you claiming that DNSSEC is some sort of industry conspiracy?
      - tptacek 4y ago
        It's a conspiracy, but not from the industry, which has broadly rejected it. :)
        teddyh 4y ago
        What “industry” would that be? Certainly not the DNS industry, or their customers (i.e. anybody who wants a domain name). Do you mean “rejected” in the same sense as how IPv6 is still only slowly being adopted?