4 ms·

There are two things mixed up. "We need secure DNS" != "we need DNSSEC". There is a huge demand for securing DNS-related things, but DNSSEC seems to be a poor

by nine_k 1y ago

There are two things mixed up. "We need secure DNS" != "we need DNSSEC". There is a huge demand for securing DNS-related things, but DNSSEC seems to be a poor answer. DoH is a somehow better answer, with any shortcomings it may have, and it's widely deployed. I suspect that a contraption that would wrap the existing DNS protocol into TLS in a way that would be trivial to put in front of an existing DNS server and an existing DNS client (like TLS was trivial to put in front of an HTTP server), might be a runaway success. A solution that wins is a solution which is damn easy to deploy, and not easy to screw up. DNSSEC is not it, alas.

TZubiri 1y ago
DoH is like VPNs, used by paranoids and criminals
iscoelho 1y ago
DoH does not solve anything that DNSSEC solves. They have almost no overlap.
- pvg 1y ago
  That's a pretty damning indictment of DNSSEC.
- nine_k 1y ago
  Yes. But DoH was built in a way which is reasonably easy to adopt, and offers obvious benefits, hence it was adopted. DNSSEC lacks this quality, and I think this quality is essential.
ClumsyPilot 1y ago
But TLS relies on having a domain If domain intern depends on tls you have chicken and egg problem
- nine_k 1y ago
  TLS internally does not depend on a domain in the DNS sense, it basically certifies a chain of signatures bound to a name. That chain can be verified, starting from the root servers. The problem is more in the fact that TLS assumes creation of a long-living connection with an ephemeral key pair, while DNS is usually a one-shot interaction. Encrypting DNS would require caching of such key pairs for some time, and refreshing them regularly but not too often. Same for querying and verifying certificates.