3 ms·

DNSSEC is widely supported and used in some countries but practically unused in others (https://stats.labs.apnic.net/dnssec https://stats.labs.apnic.net/dnssec)

DNSSEC is widely supported and used in some countries but practically unused in others (https://stats.labs.apnic.net/dnssec https://stats.labs.apnic.net/dnssec) How easy it is to set up depends on where you host and bought your domain. In my experience, I needed to copy-paste two keys and it Just Worked. It's barely used in .COM though, so companies like Amazon took ages to implement even basic support for it, and their buggy services took down various websites. To top it all off, mistakes by badly managed TLDs caused downtimes for various TLDs over time, of "someone told the root servers to redirect .NZ to localhost for a week" severity. If whoever is managing your TLD cannot be trusted to maintain a TLD, don't enable DNSSEC. The protocol is Very 90s ("computers aren't fast enough to validate RSA signatures so let's centralise it"), but modern clients take all of the 90s bullcrap out of the picture. DNSSEC is in dire need of a v2 that fixes this, but I've never had much trouble with it in practice, other than when websites misconfigure their DNSSEC config.

thayne 3y ago
> other than when websites misconfigure their DNSSEC config One major problem with DNSSEC is that it is relatively easy to misconfigure it, especially in more complicated scenarios, and a misconfiguration can take you down for a long time.
- bodgie 3y ago
  It can also be quite easy. Buggy complicated Route 53 and self-hosting with a buggy bespoke solution aren't the only options, but they are the only kinds of DNSSEC failures I've seen on the HN front page.
  - tptacek 3y ago
    The only failures you see on the HN front page are the ones that occur to gigantic companies we've all heard of, with huge networking teams and all the advantages you can ask for in getting DNSSEC working. When random small shops fall off the Internet because they broke DNSSEC, nobody cares; it never makes any front page anywhere.
    - bodgie 3y ago
      I would dispute that the entities that make the HN homepage have all the advantages. Off the top of my head, Slack clearly did not have in-house DNS expertise though they could have if they valued it, and '.nz' seems to be run by at best a skeleton crew.

thayne 3y ago

> other than when websites misconfigure their DNSSEC config One major problem with DNSSEC is that it is relatively easy to misconfigure it, especially in more complicated scenarios, and a misconfiguration can take you down for a long time.

bodgie 3y ago
It can also be quite easy. Buggy complicated Route 53 and self-hosting with a buggy bespoke solution aren't the only options, but they are the only kinds of DNSSEC failures I've seen on the HN front page.
- tptacek 3y ago
  The only failures you see on the HN front page are the ones that occur to gigantic companies we've all heard of, with huge networking teams and all the advantages you can ask for in getting DNSSEC working. When random small shops fall off the Internet because they broke DNSSEC, nobody cares; it never makes any front page anywhere.
  - bodgie 3y ago
    I would dispute that the entities that make the HN homepage have all the advantages. Off the top of my head, Slack clearly did not have in-house DNS expertise though they could have if they valued it, and '.nz' seems to be run by at best a skeleton crew.