2 ms·
The horse has been beaten to death - DNSSEC is dead. It continues to see adoption on the authoritative side because turning it on in a basic state and letting i
by mike_d 4y ago
The horse has been beaten to death - DNSSEC is dead. It continues to see adoption on the authoritative side because turning it on in a basic state and letting it limp along costs almost nothing.
Many recursive servers do validate DNSSEC, but disable it on a per-zone basis when validation failures happen and users start to complain.
tptacek raises an additional good point that DNSSEC does nothing to protect the last mile of a query. It also provides zero confidentiality.
dnscrypt was always a superior implementation, but saw little uptake because people blindly believed the DNSSEC propaganda.
- teddyh 4y agoFrom my perspective, DNSSEC is very much alive, and moreso every year. At work, we only ever see requests for more DNSSEC from everybody; both customers and TLDs/registries. Nobody at conferences, both formally and in informal conversations, has said anything against DNSSEC in principle. I used to say that I ever only saw one person argue against DNSSEC; and it was here on HN. I guess that I can now say that it is two people, both here on HN. If validation failures were that common, I would think I, working at a domain registrar and authoritative DNS provider, would hear about it. The last mile problem would be solved by DoT/DoH, no? If anything is a “dead horse”, it’s dnscrypt. Are you claiming that DNSSEC is some sort of industry conspiracy?
- tptacek 4y agoIt's a conspiracy, but not from the industry, which has broadly rejected it. :)
- teddyh 4y agoWhat “industry” would that be? Certainly not the DNS industry, or their customers (i.e. anybody who wants a domain name). Do you mean “rejected” in the same sense as how IPv6 is still only slowly being adopted?