3 ms·

> * Resolver cache poisoning > * MitM upstream from resolver Only for clients that do DNSSEC validation. Ignoring the additional latency it comes with, virtual

• tptacek 3y ago
  This is a super important point! The parent post, which is quite good, forgets the qualifier that in practice DNSSEC is exclusively a server-to-server protocol: it's what your DNS server uses to attempt to authenticate records from other servers. But when you get the records, you don't get the signatures; you just get a single bit in the header that says "I pinky swear that I checked the signatures". It's wild that we're even considering rolling more of this out in 2023.
  • donttellmypeers 3y ago
    > But when you get the records, you don't get the signatures; you just get a single bit in the header that says "I pinky swear that I checked the signatures". Clients absolutely do get RRSIGs (and relevant NSEC/NSEC3) however they don't necessarily validate them.