3 ms·
If someone can tamper with your DNS TXT records now they can get a certificate for your domain.
by tzs 11mo ago
If someone can tamper with your DNS TXT records now they can get a certificate for your domain.
- franga2000 11mo agoNot tamper with the record directly, but MitM it on the way to a target.
- crote 11mo agoThat's what DNSSEC is for.
- franga2000 11mo agoYes, but that's just PKI again, which is what the OP was trying to avoid.
- ishouldbework 11mo agoThat should be prevented by dnssec no?
- tptacek 11mo agoDepends on who your adversary is. If it's your ISP: no, DNSSEC doesn't prevent that (in every mainstream deployment scenario, your upstream DNS recursive server is the only thing really doing DNSSEC validation).
- arp242 11mo agoThat's already the case with dns-01 verification, no? Besides, if someone has access to your TXT records then chances are they can also change A records, and you've lost already.