4 ms·

mDNSResponder supports DNSSEC validation, please look at the source code: http://opensource.apple.com/source/mDNSResponder/mDNSResponder-522.92.1/mDNSMacOSX/DN

• tptacek 12y ago
  This is like saying "everyone can just run their own DNS server". Of course, as I said, they won't. The fact that Apple has a DNSSEC-resolving recursive lookup server and Safari doesn't use it strengthens my point instead of weakening it.
• tedunangst 12y ago
  That doesn't really respond to the point. Does Safari use DNSSEC or not?
  • blumentopf 12y ago
    Of course it does, Safari uses the resolver provided by OS X, which is mDNSResponder. (It superseded the stub resolver in libSystem.dylib starting with 10.6.)
    • sffho 12y ago
      You are mistaken. https://news.ycombinator.com/item?id=8896092 https://news.ycombinator.com/item?id=8896092
    • tedunangst 12y ago
      How's that saying go about only proving the code correct, but not testing it? I think there's a reason tptacek specifically asked about tcpdump of on wire traffic.