4 ms·
DNSSEC wouldn't stop this... unless the resolver knew to require DNSSEC and ignored unsigned responses (which is unlikely). DNSCrypt could help here... but cha
by davidu 13y ago
DNSSEC wouldn't stop this... unless the resolver knew to require DNSSEC and ignored unsigned responses (which is unlikely).
DNSCrypt could help here... but chances are their middleware would just barf on it.
You need something more evasive.
- axaxs 13y agoIt wouldn't prevent getting the wrong answer, sure. But a smart resolver would see DS records at the parent and recognize it as an unsigned, thereby invalid, response.
- nahlio 13y agoThus, DNSSEC doesn't protect against censorship. It's hilarious that people are saying DNSSEC can be used in Turkey (or anywhere else) to defend against censorship. Either they don't know what they're talking about or don't care about having an honest discussion. Or both.