4 ms·
DNSSEC doesn't prevent them from serving you false DNS results. DNSSEC doesn't protect the communication between your resolver and the DNS server. DNSSEC allows
by tssva 14y ago
DNSSEC doesn't prevent them from serving you false DNS results. DNSSEC doesn't protect the communication between your resolver and the DNS server. DNSSEC allows for signing DNS entries with keys.
Since a large portion of DNS isn't signed in order to function on the Internet most resolvers with DNSSEC enabled will still allow results from domains which aren't signed for instance google.com. The easiest thing for Comcast to do is to return their false result indicating that the domain is not signed.
Since they can intercept all DNS traffic you send they could actually emulate all the way up to the root servers and sign with keys they generated themselves. This is probably overly complex but is possible and would allow a false dns entry to be accepted even by resolvers configured to only accept responses for domains which are signed.
- throwaway2048 14y ago>Since they can intercept all DNS traffic you send they could actually emulate all the way up to the root servers and sign with keys they generated themselves. This is probably overly complex but is possible and would allow a false dns entry to be accepted even by resolvers configured to only accept responses for domains which are signed. this is not how DNSSEC works, if it did work this way it would be trivial for anyone to mitm it, thus render its entire purpose null and void. Resolvers are preloaded with the dns root public key, that key signs the tld root keys, which sign your registrars key, which sign your domain. There is no effective way for comcast to spoof replies in this setup, as they have no access to any of these private keys.