5 ms·
Yes, unless you have some sort of protection. Protection could be validating DNSSEC (most likely not) Or using DoH (DNS over HTTPS) or DoT (DNS over TLS)
by georgyo 2y ago
Yes, unless you have some sort of protection.
Protection could be validating DNSSEC (most likely not)
Or using DoH (DNS over HTTPS) or DoT (DNS over TLS)
- terom 2y agoI don't think DNSSEC would help in the common case of non-validating stub resolvers querying a public resolver. My understanding is that the DNS query response from a DNSSEC-validating public recursive resolver doesn't contain the information required for the stub client to validate it, only a single AD bit.