There is nothing stopping you from doing online signing with DNSSEC. FWIW, DNSSEC is on it's third major iteration, 2/3rds of the TLDs have deployed it, and major DNS service providers are getting into the act.

You can even avoid domain enumeration by doing online signing with DNSSEC. It's just that people still prefer the offline option.

And the offline signing option adds complexity to the protocol.

Ok, my point about people preferring the offline option wasn't criticism.

I'd it being the preferred option is strong evidence that the extra complexity is worth it.

So you are arguing to remove the offline signing capabilities?

Yes.

That would force companies to either own all of the front-end server farms or store their keys on machines in untrustworthy environments.

Yes: a choice between two very unattractive options. Isn't DNSSEC great?

Uh? You can run everything in offline mode, unless you really care about trivial zone enumeration.

I am not talking about the current DNSSEC, of course.

I.E. the way SSL/TLS is run today.

What do you mean?

Signing DNS records using a machine connected to the internet, instead of passing the zone files to an air-gapped signing machine over a sneakernet. Eventually, you run into the issue of updating the "offline" machine and many places just have an "online" machine that gets the zone files through a highly restricted interface.

We're currently working on providing DNSSEC for our customers. The problem with only signing is that we really don't want all the keys to be physically present on our DNS servers, as many of them are hosted in other companies data centres.

Having a central online signing server is bad for availability, as DNS down time is really not acceptable.

That basically only leaves offline signing.

So have three online signers.

Yea, HSMs are not that expensive I think.

DNSSEC has several problems some of which is in the design, as tptacek likes to mention.

This post directly addresses each point that Ptacek raised in his "Against DNSSEC" blogpost and FAQ.

Poorly and unconvincingly addresses. Same argument we've seen over and over -- now in a nice clean FAQ!

Doesn't change the design problems. Just tries to hide them behind half-truths and "but there's nothing better..."

But what do you mean by "online signing" ?

One of the problems is that it exposed DNS zone information, and one of the reason it did that was it was designed to require signing only once and after that the private key didn't have to be used again until the zone info changes.

Are you talking about zone enumeration? That's covered in the article.

Can you provide an NSEC white-lie response to an arbitrary query without an online key?

(I'm not sure if this is what was being asked, but I'm curious about the answer to that, either way.)

No, not in the narrowest way. You can go 'somewhere in between' at the cost of blowing up your zone size tremendously, but it's not worth it.

Don't think so.

I believe so: http://dankaminsky.com/2011/01/05/djb-ccc/#whitelies

(Phreebird is an online signer, but I don't see why an offline signer couldn't generate these proofs.)

Because you can't predict offline which names you need to obscure with fake NSEC records.

If there is any company in the world actually using Phreebird in production, I'd --- for more than one reason --- like to know about it.

I don't know of any either, but there are plenty running PowerDNS in online 'white lies' signing mode. And then, of course, there is Cloudflare.

(And indeed, it cannot be done offline - although doing much narrower NSEC/NSEC3 ranges than 'normal' could be done offline).