News for hackers. Stuff that matters.
Re:It’s Time to Encrypt the Entire Internet by pdkl95 on Thursday April 17, 2014 @11:35AM (#7604237)
In addition to the other replies, which are also good reasons, remember that dns poisoning is a real thing. While running unbound[1] to check DNSSEC signatures HAS discovered invalid results, and you can bypass some (but not all[2]) of those problems if you bypass the bad (ISP/whatever) resolver.

There really isn't much of a performance hit by recursively resolving DNS - it all gets cached anyway.

[1] http://unbound.net/ (other servers may also work for this purpose)

[2] It protects against a resolver that lies, but race conditions (e.g. NSA/QUANTUM) are not affected. Hopefully, DNSSEC itself protects against poisoned results, regardless of the method.

There are no comments on this comment yet.