Re:Universal DNSSEC: Secure DNS for Every Domain
by peterwwillis on Tuesday November 10, 2015 @03:06PM
(#10542066)
To recap the ways DNSSEC sucks for users:
* The server/nameserver must have DNSSEC configured properly
(CloudFlare have solved this for their customers)
* Your client's DNS resolving server must support DNSSEC properly
(which they might not, depends on the user's network)
* Your client's stub resolver must verify all DNSSEC records
(most do not currently)
If any of the above fail, you will not have any indication whatsoever and you will be using regular DNS.
The only time that a user will ever know if DNSSEC is working (for them) is if the server/nameserver are configured correctly, your client's dns resolver supports DNSSEC, your client's stub resolver verifies requests, and then the user tries to look up a known-invalid domain and it gives them a resolving error. Otherwise, they will never know if DNSSEC is in use.
Oh, and you can still MITM the data connection between the client and server even if DNSSEC works.
The only time that a user will ever know if DNSSEC is working (for them) is if the server/nameserver are configured correctly, your client's dns resolver supports DNSSEC, your client's stub resolver verifies requests, and then the user tries to look up a known-invalid domain and it gives them a resolving error. Otherwise, they will never know if DNSSEC is in use.
Oh, and you can still MITM the data connection between the client and server even if DNSSEC works.