Universal DNSSEC: Secure DNS for Every Domain

Re:Universal DNSSEC: Secure DNS for Every Domain by jedisct1 on Tuesday November 10, 2015 @01:40PM (#10541352)

Yep, dnsmasq finally supporting DNSSEC is an excellent thing.

Alternative router firmwares such as Tomato Shibby support DNSSEC validation out of the box, thanks to this.

I wish more and more routers (most of them running dnsmasq) would also do this.

[ Parent | on HN ]

Re:Universal DNSSEC: Secure DNS for Every Domain by rb12345 on Tuesday November 10, 2015 @06:15PM (#10543373)

On recent Ubuntu releases, you can enable DNSSEC resolving by adding the following to "/etc/NetworkManager/dnsmasq.d/dnsmasq.conf":

    dnssec
    #dnssec-check-unsigned
    conf-file=/usr/share/dnsmasq-base/trust-anchors.conf

Of course, it's possible to strip the signing unless you use Google DNS or whatever and uncomment the "dnssec-check-unsigned" line.

[ Parent | on HN ]

Re:Universal DNSSEC: Secure DNS for Every Domain by jedisct1 on Friday November 13, 2015 @06:51AM (#10559309)

Why isn't is enabled by default?

[ Parent | on HN ]