4 ms·

Outages and poor management are one possibility. Other is the fact that you have to trust the country running the ccTLD with DNSSEC keys. This might rule out th

Outages and poor management are one possibility. Other is the fact that you have to trust the country running the ccTLD with DNSSEC keys. This might rule out things like using TLSA/DANE or SSHFP records.

EE84M3i 2y ago
I think more relevantly than DNSSEC, couldn't they issue TLS certificates using DNS-01 validation? You have to trust your DNS registry.
- Avamander 2y ago
  They could, but WebPKI things get logged, doing split-horizon DNS for your victims doesn't.