4 ms·
Usually TXT is used to prevent spoofing (SPF etc.). If you can't rely on DNS to be giving you non-spoofed information, going to the wrong app is the least of yo
by danielrhodes 12y ago
Usually TXT is used to prevent spoofing (SPF etc.). If you can't rely on DNS to be giving you non-spoofed information, going to the wrong app is the least of your worries at that point.
- 0x0 12y agoWell, you can't rely on that. In fact, DNS is one of the most trivial protocols to spoof since it mostly runs on UDP.
- noir-york 12y agoIn theory, and on a lan, yes, UDP is trivial to spoof. However spoofing UDP packet source IP address is very hard on the open internet due to egress filtering.
- nothrabannosir 12y agoOn the contrary: you have to assume DNS is always compromised on the client (because it easily is). SPF records depend not on client DNS but on server DNS, so you have control over the lookups. That's a completely different ball-game.
- me1010 12y agoWide usage of DNSSEC is needed to trust DNS records. DNSSEC would also fully allow PGP keys to be stored in DNS... See STEED... http://g10code.com/docs/steed-usable-e2ee.pdf http://g10code.com/docs/steed-usable-e2ee.pdf But, yes! DNS is the correct and appropriate location for items like the OP posted... built-in widely used distributed 'trust'.