3 ms·

When you say bypass, do you mean disable DNSSEC on your own computer? Or are there known vulnerabilities in DNSSEC cryptography or software?

• tptacek 2y ago
  The stub resolver on your own computer doesn't actually speak DNSSEC. It speaks normal DNS to a recursing resolver, probably at your ISP or at Google, that itself does DNSSEC validation, and then just sets a bit in the response back to you that says "this is authentic".
  • kazinator 2y ago
    Glibc supposedly has DNSSEC, but does anyone use it: https://sourceware.org/glibc/wiki/DNSSEC https://sourceware.org/glibc/wiki/DNSSEC
    • tptacek 2y ago
      That page appears to be mostly about how to trust a real recursive cache from a glibc program.
      • kazinator 2y ago
        I'd hate to be pointed to that page and tasked with designing and implementing a test plan.
  • pabs3 2y ago
    The recursing resolver is on my local system, anything else is clearly madness.
    • tptacek 2y ago
      Always fascinating to hear about how the standard configuration for every workstation Linux distro, macOS, and Windows 10 are "clearly madness". Do go on!