Re:Bizarre and Unusual Uses of DNS
by skissane on Saturday February 25, 2023 @11:53PM
(#34943157)
There should be an option for "validate but still return invalid data, just reflect validity in the AD bit". Is there?
That way most things will still work even DNSSEC is broken, and apps with higher security requirements can opt-in to "fail if invalid", by passing setting the AD bit on queries, and checking if it is still there on responses.
That way most things will still work even DNSSEC is broken, and apps with higher security requirements can opt-in to "fail if invalid", by passing setting the AD bit on queries, and checking if it is still there on responses.