News for hackers. Stuff that matters.

A comment on Universal DNSSEC: Secure DNS for Every Domain.

Re:Universal DNSSEC: Secure DNS for Every Domain by ausjke on Tuesday November 10, 2015 @12:44PM (#10540877)
That's what I want to do: enabled dnssec in dnsmasq and run it on my router.
[ Parent | on HN ]
Re:Universal DNSSEC: Secure DNS for Every Domain by jedisct1 on Tuesday November 10, 2015 @01:40PM (#10541352)
Yep, dnsmasq finally supporting DNSSEC is an excellent thing.

Alternative router firmwares such as Tomato Shibby support DNSSEC validation out of the box, thanks to this.

I wish more and more routers (most of them running dnsmasq) would also do this.

[ Parent | on HN ]
Re:Universal DNSSEC: Secure DNS for Every Domain by rb12345 on Tuesday November 10, 2015 @06:15PM (#10543373)
On recent Ubuntu releases, you can enable DNSSEC resolving by adding the following to "/etc/NetworkManager/dnsmasq.d/dnsmasq.conf":

    dnssec
    #dnssec-check-unsigned
    conf-file=/usr/share/dnsmasq-base/trust-anchors.conf
Of course, it's possible to strip the signing unless you use Google DNS or whatever and uncomment the "dnssec-check-unsigned" line.
[ Parent | on HN ]
Re:Universal DNSSEC: Secure DNS for Every Domain by jedisct1 on Friday November 13, 2015 @06:51AM (#10559309)
Why isn't is enabled by default?
[ Parent | on HN ]