News for hackers. Stuff that matters.

A comment on Using DNSSEC and DNSCrypt in Debian. Parent comment

Re:Using DNSSEC and DNSCrypt in Debian by tptacek on Tuesday April 26, 2016 @04:17PM (#11575246)
Nope! They fixed that: there's now SMTP Strict Transport Security, sponsored by Google, Microsoft, and Yahoo. SMTP STS explicitly does not require DNSSEC --- because nobody thinks at-scale DNSSEC is going to happen anymore.
[ Parent | on HN ]
Re:Using DNSSEC and DNSCrypt in Debian by totony on Tuesday April 26, 2016 @10:01PM (#11577323)
Isn't this still a draft? Also, it does not fix MX record spoofing, only downgrade attacks IIRC?

EDIT: Just reviewed the draft, seems like it addresses MX spoofing, but it seems to do it either via HTTPS or DNSSEC, so DNSSEC seems to be used by it

[ Parent | on HN ]
Re:Using DNSSEC and DNSCrypt in Debian by tptacek on Wednesday April 27, 2016 @11:08AM (#11581044)
What does "still a draft" mean? That a bunch of randos at IETF haven't approved it yet? Three of the most important email providers on the planet sponsored it. It's what's going to happen.
[ Parent | on HN ]
Re:Using DNSSEC and DNSCrypt in Debian by totony on Wednesday April 27, 2016 @04:51PM (#11584428)
It means it's not implemented in most SMTP clients/SMTP servers. The randos have a huge impact.

Not everyone uses Gmail/Outlook

[ Parent | on HN ]