Re:Calling time on DNSSEC: The costs exceed the benefits
by donttellmypeers on Saturday June 03, 2023 @05:27PM
(#36180694)
> But when you get the records, you don't get the signatures; you just get a single bit in the header that says "I pinky swear that I checked the signatures".
Clients absolutely do get RRSIGs (and relevant NSEC/NSEC3) however they don't necessarily validate them.
Clients absolutely do get RRSIGs (and relevant NSEC/NSEC3) however they don't necessarily validate them.