Let's Encrypt now supports ACME-CAA: closing the DV loophole

Re:Let's Encrypt now supports ACME-CAA: closing the DV loophole by rosnd on Sunday December 18, 2022 @03:15PM (#34042576)

I think the hardcoded IPs are typically only used as hints to initially resolve the root-servers.net domains.

[ Parent | on HN ]

Re:Let's Encrypt now supports ACME-CAA: closing the DV loophole by belorn on Sunday December 18, 2022 @06:57PM (#34046018)

Hints are used by the bind resolver software. It hard code the A -> M root servers and use those to initialize a cache. Naturally bind developers could change this behavior, and in the case that none of the hints works, the current behavior is to use a static compiled list that the software also include.

[ Parent | on HN ]

Re:Let's Encrypt now supports ACME-CAA: closing the DV loophole by rosnd on Sunday December 18, 2022 @08:16PM (#34046913)

Not just bind, unbound also. Unbound uses the hardcoded list of IPs to resolve a-m once and build it's cache, the hardcoded IPs are never used again.

[ Parent | on HN ]