Re:Calling time on DNSSEC: The costs exceed the benefits
by tptacek on Saturday June 03, 2023 @02:55PM
(#36179480)
This is a super important point! The parent post, which is quite good, forgets the qualifier that in practice DNSSEC is exclusively a server-to-server protocol: it's what your DNS server uses to attempt to authenticate records from other servers. But when you get the records, you don't get the signatures; you just get a single bit in the header that says "I pinky swear that I checked the signatures".
It's wild that we're even considering rolling more of this out in 2023.
Re:Calling time on DNSSEC: The costs exceed the benefits
by donttellmypeers on Saturday June 03, 2023 @05:27PM
(#36180694)
> But when you get the records, you don't get the signatures; you just get a single bit in the header that says "I pinky swear that I checked the signatures".
Clients absolutely do get RRSIGs (and relevant NSEC/NSEC3) however they don't necessarily validate them.
Only for clients that do DNSSEC validation. Ignoring the additional latency it comes with, virtually no home routers nor operating systems do.