4 ms·
I'd also add insecure DNSSEC implementations that allow you to "walk" the entire record chain for the domain.
by Zuiii 3y ago
I'd also add insecure DNSSEC implementations that allow you to "walk" the entire record chain for the domain.
- kevincox 3y agoCalling this "insecure" is a bit harsh. This is required for offline signing which provides better security but worse privacy.
- Zuiii 3y agoSorry, you're right. I mistakenly thought this issue was solved by a later standard.
- imrejonk 3y agoCould that later standard be NSEC3? It’s like the easily walkable NSEC, but with hashed names and special flags for opting out of delegation security features. The 3 appears to stand for the number of people that fully understand how it works…