News for hackers. Stuff that matters.

A comment on Getting Started with DNS over HTTPS on Firefox. Parent comment

Re:Getting Started with DNS over HTTPS on Firefox by Avamander on Friday July 20, 2018 @11:07AM (#17575577)
You can make your resolver verify the entire chain.
[ Parent | on HN ]
Re:Getting Started with DNS over HTTPS on Firefox by georgyo on Friday July 20, 2018 @12:06PM (#17576202)
There are tlds that are unsigned, and any domains that are unsigned. You can not verify the entire chain, because it is possible that the domain you are looking up is infact unsigned. You can maybe pin some of the tld keys, but you can't pin all the domains under them.
[ Parent | on HN ]
Re:Getting Started with DNS over HTTPS on Firefox by Avamander on Monday July 30, 2018 @11:10AM (#17644931)
> You can not verify the entire chain, because it is possible that the domain you are looking up is infact unsigned.

Then you conclude that it's okay that the domain is unsigned. Else - hard fail.

[ Parent | on HN ]
Re:Getting Started with DNS over HTTPS on Firefox by mike-cardwell on Friday July 20, 2018 @02:45PM (#17577726)
I don't know what the figures are today, but in 2016, 89% of TLDS were signed using DNSSEC - https://www.internetsociety.org/blog/2017/01/state-of-dnssec...
[ Parent | on HN ]