News for hackers. Stuff that matters.

A comment on Comcast Shot Themselves in the Foot with MTA-STS. Parent comment

Re:Comcast Shot Themselves in the Foot with MTA-STS by AndyMcConachie on Wednesday January 19, 2022 @06:14PM (#30001863)
comcast.net is DNSSEC signed and Comcast was one of the first major ISPs to implement DNSSEC validation. Comcast's MX records are DNSSEC signed.

> dig +dnssec comcast.net MX

This has nothing to do with DNSSEC.

[ Parent | on HN ]
Re:Comcast Shot Themselves in the Foot with MTA-STS by Dylan16807 on Wednesday January 19, 2022 @06:26PM (#30001976)
It has nothing to do with Comcast not liking DNSSEC.

But if the ecosystem as a whole was happy about DNSSEC and DANE, it's somewhat doubtful we'd have both specs and the involvement of https.

[ Parent | on HN ]
Re:Comcast Shot Themselves in the Foot with MTA-STS by tptacek on Wednesday January 19, 2022 @06:34PM (#30002035)
We would not. There'd be no reason to have MTA-STS if there was universal DNSSEC deployment. Of course, outages like this would be vastly more common, because DNSSEC includes a large superset of the failure modes of MTA-STS.
[ Parent | on HN ]