3 ms·
The good news is that we're seeing an increased deployment of DNSSEC-validating DNS resolvers - now about 12% of all DNS queries per APNIC stats - http://stats.
by danyork 12y ago
The good news is that we're seeing an increased deployment of DNSSEC-validating DNS resolvers - now about 12% of all DNS queries per APNIC stats - http://stats.labs.apnic.net/dnssec/XA?c=XA&x=1&g=1&r=1&w=7&g=0 http://stats.labs.apnic.net/dnssec/XA?c=XA&x=1&g=1&r=1&w=7&g...
Now we just need to get more domains signed so that MX records can be validated by those resolvers and these kind of redirections can be mitigated.
- danyork 12y agoThe step to go beyond that, of course, would be to use DANE with the SMTP connections so that the entire mail exchange could happen over TLS and using certs that have been validated via DNSSEC/DANE. But first step is to get the MX records signed and to have DNS resolvers validating that fact.