3 ms·
It's explicitly not the point of DNSSEC, which has for most of its entire existence been designed to be run as a server-to-server protocol, with stub resolvers
by tptacek 9mo ago
It's explicitly not the point of DNSSEC, which has for most of its entire existence been designed to be run as a server-to-server protocol, with stub resolvers trusting their upstream DNS servers.
I agree with you, though. It's utterly pointless.
- jcalvinowens 9mo agoNot true, RFC4035 says all security aware resolvers SHOULD verify the signatures. It's far from pointless when actually implemented. Don't dismiss a whole protocol just because some historical implementations have been half assed.
- tptacek 9mo agoThe RFC uses "security-aware" to set them apart from ordinary resolvers, which are what every mainstream resolver uses.