News for hackers. Stuff that matters.

A comment on Calling time on DNSSEC: The costs exceed the benefits. Parent comment

Re:Calling time on DNSSEC: The costs exceed the benefits by tptacek on Saturday June 03, 2023 @02:55PM (#36179480)
This is a super important point! The parent post, which is quite good, forgets the qualifier that in practice DNSSEC is exclusively a server-to-server protocol: it's what your DNS server uses to attempt to authenticate records from other servers. But when you get the records, you don't get the signatures; you just get a single bit in the header that says "I pinky swear that I checked the signatures".

It's wild that we're even considering rolling more of this out in 2023.

[ Parent | on HN ]
Re:Calling time on DNSSEC: The costs exceed the benefits by donttellmypeers on Saturday June 03, 2023 @05:27PM (#36180694)
> But when you get the records, you don't get the signatures; you just get a single bit in the header that says "I pinky swear that I checked the signatures".

Clients absolutely do get RRSIGs (and relevant NSEC/NSEC3) however they don't necessarily validate them.

[ Parent | on HN ]