3 ms·
Not tamper with the record directly, but MitM it on the way to a target.
by franga2000 11mo ago
Not tamper with the record directly, but MitM it on the way to a target.
- crote 11mo agoThat's what DNSSEC is for.
- franga2000 11mo agoYes, but that's just PKI again, which is what the OP was trying to avoid.
- ishouldbework 11mo agoThat should be prevented by dnssec no?
- tptacek 11mo agoDepends on who your adversary is. If it's your ISP: no, DNSSEC doesn't prevent that (in every mainstream deployment scenario, your upstream DNS recursive server is the only thing really doing DNSSEC validation).