3 ms·
Which would make sense because they may be set to use Google's Public DNS Servers (8.8.8.8 and 8.8.4.4 and the IPv6 equivalents). Google Public DNS has been pe
by danyork 12y ago
Which would make sense because they may be set to use Google's Public DNS Servers (8.8.8.8 and 8.8.4.4 and the IPv6 equivalents).
Google Public DNS has been performing full DNSSEC validation since May 2013: http://www.internetsociety.org/deploy360/blog/2013/05/confirmed-googles-public-dns-now-performs-dnssec-validation-for-all-queries-by-default/ http://www.internetsociety.org/deploy360/blog/2013/05/confir...
- yuhong 12y agoYea, it is fortunate that people on Twitter quickly figured this out.
- rb12345 12y agoTo be fair though, it's not that hard to test for DNSSEC breakage if you have dig available. If "dig +cdflag example.com A IN" works and "dig +adflag example.com A IN" returns SERVFAIL, it's DNSSEC's fault. (If that latter command returns responses without the ad flag, the domain lacks DNSSEC signing.)