It's yet another example of security technology that has too many adjustable knobs, is poorly documented, and fails subtly. The main benefit is that it makes i

It's yet another example of security technology that has too many adjustable knobs, is poorly documented, and fails subtly. The main benefit is that it makes it much harder to spoof DNS responses. Qbaka just had an invalid zone published for their domain. The Great Firewall of China has been leaking fraudulent DNS responses around the world. There's the Kaminsky attack. This is a real-world problem. Also, some people hope that such verified DNS records will allow them to sidestep the certificate authority problem, but I think that's futile. A side benefit I've been exploiting is that DNSSEC allows me to publish my domains on free secondary servers, confident that the secondary is not able to publish valid DNSSEC signatures on fraudulent records. I don't have a lot of domains, though. The main drawback is that it has so many moving parts that can break if improperly used. Which signing algorithm and key size to use? Should you use NSEC or NSEC3? How and when do you rotate the keys? (Default: no rotate.) Which key rotation technique should you use? Where do you generate and store your signing keys? If Microsoft can't consistently remember to renew their DNS registrations, then how will they remember to update their DNSSEC keys? Which brings me to a huge drawback: Now your DNS server and your DNS registrar are part of your security infrastructure. Do you trust your registrar to hold on to your DNS signing key? GoDaddy is happy to do so. If not, then you'll have to maintain your zone separately. And even if you maintain your own zone, both your registrar and the TLD administrator are free to publish an updated DS record claiming that your DNSKEY is invalid and theirs is the true DNSKEY for your domain. Another drawback is that DNSSEC zones are huge. Dan Bernstein calls DNSSEC a DDoS bandwidth amplifier, because adding DNSSEC signatures to DNS queries makes the responses so much bigger. DNS servers should have response rate limiting, anyway. So, there are very important benefits, and very big drawbacks. The way I see it, DNSSEC is horribly flawed, but it's the most widely deployed solution to fix certain real-world security problems, so we're stuck with it. At least it's designed to be backwards compatible and incrementally deployed, unlike the IPv6 fiasco.