3 ms·
"DNS resolvers are the ones in charge of tracking down this information for you." If one uses them. One can alternatively use iterative queries where no "DNS
by 1vuio0pswjnm7 1y ago
"DNS resolvers are the ones in charge of tracking down this information for you."
If one uses them.
One can alternatively use iterative queries where no "DNS resolver", i.e., recursive resolver, is used.
Many years ago I wrote a system for interative resolution for own use, as an experiment. I learnt that it can be faster than recursive resolution.
People have since written software for iterative resolution, e.g., https://lizizhikevich.github.io/assets/papers/ZDNS.pdf https://lizizhikevich.github.io/assets/papers/ZDNS.pdf
Unfortunately authoritative servers generally do not encrypt their responses. IMO this would be more useful than "DNSSEC".
"And that data is often provided by authoritative servers."
What are examples of data not provided by authoritative servers.
- unbindme5 1y agoOr run "unbound" as your own local recursive resolver.
- 1vuio0pswjnm7 1y agoOne could argue the primary (not the only) risk addressed by DNSSEC is third party DNS service, i.e., shared caches accessible from the internet If this is true, then one might assume DNSSEC is generally unnecessary if one is running their own unshared cache only accessible from the loopback or the LAN Software like djb's dnscache, a personal favourite, has no support for DNSSEC NLNet's unbound places a strong emphasis on supporting DNSSEC. The unbound documentation authors recommend using it https://unbound.docs.nlnetlabs.nl/en/latest/getting-started/configuration.html https://unbound.docs.nlnetlabs.nl/en/latest/getting-started/...