Re:Ask HN: Neutral DNS servers?
by tptacek on Friday March 11, 2022 @04:19PM
(#30646147)
It doesn't solve the "manipulate" problem we're talking about here, either: nothing about DNSSEC prevents a DNS server (or middlebox) from denying results to a disfavored domain; it only (situationally) prevents them from redirecting it somewhere else. (And, of course, it only works if you're running your own recursive server; it does nothing whatsoever in the 8.8.8.8-type use case).
[ Parent
| on HN ]
> nothing about DNSSEC prevents a DNS server (or middlebox) from denying results to a disfavored domain
But at least it is detectable thanks to NSEC and NSEC3 records.
Kind of. An intermediary can drop packets and the client will never get the response.
It's detectable when the site that the DNS provider is censoring falls off the Internet!