5 ms·
Domain name registrar like Hover, NameCheap, NameBright and NameSilo still do not yet support DNSSEC (nor have an ETA for it!). Here is a list of DNSSEC support
by bwblabs 12y ago
Domain name registrar like Hover, NameCheap, NameBright and NameSilo still do not yet support DNSSEC (nor have an ETA for it!). Here is a list of DNSSEC supporting registrars: https://www.icann.org/en/news/in-focus/dnssec/deployment https://www.icann.org/en/news/in-focus/dnssec/deployment
Based on pricing ($9.99/.com) and a growing irritation with GoDaddy, I finally moved my domains to Dynadot:
https://www.dynadot.com/ https://www.dynadot.com/
They have a (custom) 2FA app and 2FA SMS. BTW this friend referral https://www.dynadot.com/?s9N6j7d9G8B07i73 https://www.dynadot.com/?s9N6j7d9G8B07i73 gives you & me $5 after purchase.
- lobster_johnson 12y agoDynadot doesn't support .io, looks like?
- bwblabs 12y agoCorrect, no .io support.
- desufnoc 12y agoAre you doing anything interesting with DNSSEC?
- AlyssaRowan 12y agoTake a look at the RFCs coming out recently. DANE, in particular. DNSSEC is an important trust root that can be used to pin certificates in addition to PKIX (CAs), or, in some practical cases (such as mailservers), instead of them. Are you still running Telnet?
- desufnoc 12y agoSo you have deployed DNSSEC and are actively using DANE?
- mike-cardwell 12y agoFWIW, I left Namecheap for GKG.net for the sole reason that Namecheap didn't support DNSSEC. And yes, I have deployed DNSSEC and DANE. On https for emailprivacytester.com, and on https, smtp, imap and xmpp for grepular.com.
- desufnoc 12y agoNeat. It's probably difficult to tell but do you have any idea what usage is like?
- mike-cardwell 12y agoI'm guessing for DNSSEC, the usage is probably low and for DANE it's probably almost non-existant. FWIW, I use the Firefox addon "DNSSEC Validator" (also does DANE) - https://www.dnssec-validator.cz/ https://www.dnssec-validator.cz/ - So if somebody managed to MITM my connection and insert a different, but still trusted, cert in the way, I'd notice. DNSSEC/DANE would probably see a lot more adoption if one or more of the main browsers did this sort of validation by default.
- mschout 12y agogkg.net supports a restful api to update DNSSEC DS records https://www.gkg.net/ws/ds.html https://www.gkg.net/ws/ds.html FYI
- desufnoc 12y agoWas this reply destined to https://news.ycombinator.com/item?id=7934758 https://news.ycombinator.com/item?id=7934758 (Slightly confused by this board.)
- rhizome 12y agoThat registrar list is way out of date. Sadly, none of the entities involved nor historical list maintainers have made it easy to find an updated one, but if they did, Joker would be on it. https://joker.com/faq/content/6/461/en/dnssec-support.html https://joker.com/faq/content/6/461/en/dnssec-support.html
- bwblabs 12y agoIt was one of the few lists I found. Although the url redirects to an url containing 'deployment-2012-02-25-en' the page actually states 'Last updated: 27 May 2014', so it's not so out of date. If your registrar currently accepts DS records, please send an email with subject "DNSSEC REGISTRAR UPDATE" and body containing company name, country location, URL, what TLDs you accept DS records for, whether your Web interface supports DS records, whether you provide DNSSEC signing services to dnssec@icann.org and the Security team will add your registrar to this DNSSEC page.