Re:DNSSEC: Complexities and Considerations
by rdl on Wednesday November 05, 2014 @05:58PM
(#8564776)
I've been pretty down on DNSSEC due to the "baroque" nature of the whole thing (which this blog post shows); also, giving extra power to country-level ccTLDs vs. the slightly-more-independent SSL/x509 CAs.
However, DANE makes DNSSEC make sense in some cases, especially when you start using it for things other than web traffic. DNSSEC/DANE for STARTTLS SMTP would be a good improvement over the "no cert checking at all, and even cert failures are ignored" model today.
However, DANE makes DNSSEC make sense in some cases, especially when you start using it for things other than web traffic. DNSSEC/DANE for STARTTLS SMTP would be a good improvement over the "no cert checking at all, and even cert failures are ignored" model today.