5 ms·

My usual alternative viewpoint whenever you try to claim that DNSSEC is dead: From where I sit, I work at a registry and DNS server host (among other things) w

by teddyh 3y ago

My usual alternative viewpoint whenever you try to claim that DNSSEC is dead: From where I sit, I work at a registry and DNS server host (among other things) where about 40% of all our domains have DNSSEC (and that number is constantly climbing). Every conference I go to, and in every webinar, people seemingly always talk about DNSSEC and how usage is increasing. From my perspective, your continuous claim that “nobody uses” DNSSEC is simply false. DNSSEC works, usage of DNSSEC is steadily increasing, and new protocols (like DANE) are starting to make use of DNSSEC for its features. Conversely, I only relatively rarely hear anything about MTA-STS. (Originally written as a two year old comment of mine: <https://news.ycombinator.com/item?id=27837530 https://news.ycombinator.com/item?id=27837530>, but the details given have not changed substantially.)

tptacek 3y ago
Start by convincing Geoff Huston, from who I could shoplift all the rebuttals I'd need to this argument. TLD DNSSEC signing stats are easy for people to look up, and people can quickly see I'm not making any of this up.
- mjl- 3y ago
  fwiw, i live in a country where rolling out dnssec apparently had some financial incentives for providers, which apparently helped adoption: https://stats.sidnlabs.nl/en/dnssec.html https://stats.sidnlabs.nl/en/dnssec.html adoption still growing, more than 60% of .nl domains currently dnssec-signed, and around 60% of queries are from validation resolvers. i looked up global stats. world map + tables about current validating resolver queries: https://stats.labs.apnic.net/dnssec https://stats.labs.apnic.net/dnssec. and this is the graph over time of for the world: https://stats.labs.apnic.net/dnssec/XA https://stats.labs.apnic.net/dnssec/XA (30% validating, don't know what the additional 10% mixed means). i did a quick search, but didn't find global stats about domains being dnssec-signed. dnssec is not easy/simple (especially when getting into the details), but i think the contemporary dns servers make it relatively easy to enable dnssec on a zone, managing the signing themselves. i do like the idea of being able to set up secure connections without relying on CAs.
  - ekr____ 3y ago
    The fraction of validating queries is misleading because practically all validation happens in the recursive resolver, which doesn't provide security all the way to the client. At least as far as browser clients goes, we're as far away from setting up connections based on DNSSEC-validated keys as ever.
    - mjl- 3y ago
      > The fraction of validating queries is misleading because practically all validation happens in the recursive resolver, which doesn't provide security all the way to the client. At least as far as browser clients goes, we're as far away from setting up connections based on DNSSEC-validated keys as ever. fair point, perhaps partially compensated through tls-protection for recursive dns. don't know how common that is. i wonder whether there is any move by e.g. linux distro's towards including a dnssec-verifying resolver by default. whether they think it's not worth the trouble, or what the inflection point will be. i usually install unbound on new machines. i believe openbsd comes with unbound by default? assuming that's with dnssec-validation enabled. i used to dislike the unhelpful generic error messages for dnssec-related problems (servfail). perhaps that was holding adoption back. but extended dns errors (ede) seem to solve that, though i don't know how commonly the detailed errors make it up the stack in old software.
      - ekr____ 3y ago
        > fair point, perhaps partially compensated through tls-protection for recursive dns. don't know how common that is. Yes, but this isn't a replacement for the WebPKI because it would allow the recursive to impersonate any site, which is obviously unacceptable. > i wonder whether there is any move by e.g. linux distro's towards including a dnssec-verifying resolver by default. whether they think it's not worth the trouble, or what the inflection point will be. i usually install unbound on new machines. i believe openbsd comes with unbound by default? assuming that's with dnssec-validation enabled. A year or so ago we took some measurements of DNSSEC success rates with Firefox on known-good domains that we controlled and the results were very bad. I don't have the data to hand right at the moment, but requiring DNSSEC validation would have produced unacceptably high failure rates.
- teddyh 3y ago
  If we’re OK with just throwing references around, in liu of actually making arguments ourselves, here are a couple of them: • <https://blog.technitium.com/2023/05/for-dnssec-and-why-dane-is-needed.html https://blog.technitium.com/2023/05/for-dnssec-and-why-dane-...> • <https://www.redpill-linpro.com/techblog/2019/05/06/sshfp-and-dnssec.html https://www.redpill-linpro.com/techblog/2019/05/06/sshfp-and...>
  - tptacek 3y ago
    These are randos. I cited Geoff Huston. You know, the chief scientist at APNIC? And he's a DNSSEC proponent.
    - teddyh 3y ago
      I prefer arguing by reason, not making arguments from authority. Please, make your arguments yourself instead of telling us how your dad is the boss of Xbox or whatever.
      - tptacek 3y ago
        No, I'm pretty comfortable with what this particular authority means to this argument.
        teddyh 3y ago
        I.e. precisely nothing? Arguments form from two things, reason and experience, both of which can be respected. Mere authoritarian titles, however, should not. Also, you keep not actually making any actual arguments about DNSSEC.
        tptacek 3y ago
        If you're comfortable concluding your argument by saying Geoff Huston's take means "precisely nothing", I'm comfortable with you concluding there too.
simoncion 3y ago
> ...new protocols (like DANE)... DANE? New? It's at least ten years old.
- tptacek 3y ago
  It's old enough to have been attempted in Chrome more than a decade ago, and then removed, a decade ago.
silisili 3y ago
I'm usually on your side in these perennial debates, but I worked at a registry also. Tons of inquiries, requests for assistance with it, and requirements for zone signing. Maybe the registry side views things a lot differently than the end user side.
rezonant 3y ago
I'm not sure where I stand on the efficacy of DNSSEC but... 2024: > where about 40% of all our domains have DNSSEC (and that number is constantly climbing) > Originally written as a two year old comment of mine: <https://news.ycombinator.com/item?id=27837530 https://news.ycombinator.com/item?id=27837530> 2021: > where about 40% of all our domains have DNSSEC (and that number is constantly climbing) Guessing it isn't increasing very fast then? That's 2.5 years and there's no update on that 40% figure?
- teddyh 3y ago
  It used to be just a bit below 40%, and now it’s a bit above. It has always been steadlily increasing.
  - tptacek 3y ago
    DNSSEC delegation stats are not hard to come by. Several entities (most notably APNIC) do routine surveys and collect historical data. Here's one: https://rick.eng.br/dnssecstat/ https://rick.eng.br/dnssecstat/ Here's another: https://www.statdns.com/ https://www.statdns.com/ Notice the shape of the histograms. Things are not exactly going up and to the left, are they?

by teddyh 3y ago

tptacek 3y ago

Start by convincing Geoff Huston, from who I could shoplift all the rebuttals I'd need to this argument. TLD DNSSEC signing stats are easy for people to look up, and people can quickly see I'm not making any of this up.

mjl- 3y ago
fwiw, i live in a country where rolling out dnssec apparently had some financial incentives for providers, which apparently helped adoption: https://stats.sidnlabs.nl/en/dnssec.html https://stats.sidnlabs.nl/en/dnssec.html adoption still growing, more than 60% of .nl domains currently dnssec-signed, and around 60% of queries are from validation resolvers. i looked up global stats. world map + tables about current validating resolver queries: https://stats.labs.apnic.net/dnssec https://stats.labs.apnic.net/dnssec. and this is the graph over time of for the world: https://stats.labs.apnic.net/dnssec/XA https://stats.labs.apnic.net/dnssec/XA (30% validating, don't know what the additional 10% mixed means). i did a quick search, but didn't find global stats about domains being dnssec-signed. dnssec is not easy/simple (especially when getting into the details), but i think the contemporary dns servers make it relatively easy to enable dnssec on a zone, managing the signing themselves. i do like the idea of being able to set up secure connections without relying on CAs.
- ekr____ 3y ago
  The fraction of validating queries is misleading because practically all validation happens in the recursive resolver, which doesn't provide security all the way to the client. At least as far as browser clients goes, we're as far away from setting up connections based on DNSSEC-validated keys as ever.
  - mjl- 3y ago
    > The fraction of validating queries is misleading because practically all validation happens in the recursive resolver, which doesn't provide security all the way to the client. At least as far as browser clients goes, we're as far away from setting up connections based on DNSSEC-validated keys as ever. fair point, perhaps partially compensated through tls-protection for recursive dns. don't know how common that is. i wonder whether there is any move by e.g. linux distro's towards including a dnssec-verifying resolver by default. whether they think it's not worth the trouble, or what the inflection point will be. i usually install unbound on new machines. i believe openbsd comes with unbound by default? assuming that's with dnssec-validation enabled. i used to dislike the unhelpful generic error messages for dnssec-related problems (servfail). perhaps that was holding adoption back. but extended dns errors (ede) seem to solve that, though i don't know how commonly the detailed errors make it up the stack in old software.
    - ekr____ 3y ago
      > fair point, perhaps partially compensated through tls-protection for recursive dns. don't know how common that is. Yes, but this isn't a replacement for the WebPKI because it would allow the recursive to impersonate any site, which is obviously unacceptable. > i wonder whether there is any move by e.g. linux distro's towards including a dnssec-verifying resolver by default. whether they think it's not worth the trouble, or what the inflection point will be. i usually install unbound on new machines. i believe openbsd comes with unbound by default? assuming that's with dnssec-validation enabled. A year or so ago we took some measurements of DNSSEC success rates with Firefox on known-good domains that we controlled and the results were very bad. I don't have the data to hand right at the moment, but requiring DNSSEC validation would have produced unacceptably high failure rates.
teddyh 3y ago
If we’re OK with just throwing references around, in liu of actually making arguments ourselves, here are a couple of them: • <https://blog.technitium.com/2023/05/for-dnssec-and-why-dane-is-needed.html https://blog.technitium.com/2023/05/for-dnssec-and-why-dane-...> • <https://www.redpill-linpro.com/techblog/2019/05/06/sshfp-and-dnssec.html https://www.redpill-linpro.com/techblog/2019/05/06/sshfp-and...>
- tptacek 3y ago
  These are randos. I cited Geoff Huston. You know, the chief scientist at APNIC? And he's a DNSSEC proponent.
  - teddyh 3y ago
    I prefer arguing by reason, not making arguments from authority. Please, make your arguments yourself instead of telling us how your dad is the boss of Xbox or whatever.
    - tptacek 3y ago
      No, I'm pretty comfortable with what this particular authority means to this argument.
      - teddyh 3y ago
        I.e. precisely nothing? Arguments form from two things, reason and experience, both of which can be respected. Mere authoritarian titles, however, should not. Also, you keep not actually making any actual arguments about DNSSEC.
        tptacek 3y ago
        If you're comfortable concluding your argument by saying Geoff Huston's take means "precisely nothing", I'm comfortable with you concluding there too.

simoncion 3y ago

> ...new protocols (like DANE)... DANE? New? It's at least ten years old.

tptacek 3y ago
It's old enough to have been attempted in Chrome more than a decade ago, and then removed, a decade ago.

silisili 3y ago

I'm usually on your side in these perennial debates, but I worked at a registry also. Tons of inquiries, requests for assistance with it, and requirements for zone signing. Maybe the registry side views things a lot differently than the end user side.

rezonant 3y ago

I'm not sure where I stand on the efficacy of DNSSEC but... 2024: > where about 40% of all our domains have DNSSEC (and that number is constantly climbing) > Originally written as a two year old comment of mine: <https://news.ycombinator.com/item?id=27837530 https://news.ycombinator.com/item?id=27837530> 2021: > where about 40% of all our domains have DNSSEC (and that number is constantly climbing) Guessing it isn't increasing very fast then? That's 2.5 years and there's no update on that 40% figure?

teddyh 3y ago
It used to be just a bit below 40%, and now it’s a bit above. It has always been steadlily increasing.
- tptacek 3y ago
  DNSSEC delegation stats are not hard to come by. Several entities (most notably APNIC) do routine surveys and collect historical data. Here's one: https://rick.eng.br/dnssecstat/ https://rick.eng.br/dnssecstat/ Here's another: https://www.statdns.com/ https://www.statdns.com/ Notice the shape of the histograms. Things are not exactly going up and to the left, are they?