Calling time on DNSSEC: The costs exceed the benefits

Re:Calling time on DNSSEC: The costs exceed the benefits by donttellmypeers on Friday June 02, 2023 @09:28PM (#36172813)

Does Route53 let you manage the DNSKEY RRset (so you can add a DNSKEY to the set yourself) or do they have some sort of facade you have to interact with instead?

[ Parent | on HN ]

Re:Calling time on DNSSEC: The costs exceed the benefits by X-Istence on Friday June 02, 2023 @09:36PM (#36172852)

Route53 signs the zone itself, and the key is managed using AWS KMS.

[ Parent | on HN ]

Re:Calling time on DNSSEC: The costs exceed the benefits by donttellmypeers on Friday June 02, 2023 @09:49PM (#36172933)

That's an answer to a different question. I asked if they let you put a DNSKEY RR in the RRset they serve. (To be clear: I'm not asking if they will import private keys and sign with them or anything like that, just if they'll let you place an additional DNSKEY in the RRset they serve.)

[ Parent | on HN ]

Re:Calling time on DNSSEC: The costs exceed the benefits by wlonkly on Sunday June 04, 2023 @04:47PM (#36189433)

I had to add a DS record to a Route53 zone just the other day, and when I did, I didn't see a DNSKEY option in the list of records. Don't count on that 100% because I wasn't looking for it, but I definitely don't recall seeing it.

[ Parent | on HN ]