Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

"DNS resolvers are the ones in charge of tracking down this information for you."

If one uses them.

One can alternatively use iterative queries where no "DNS resolver", i.e., recursive resolver, is used.

Many years ago I wrote a system for interative resolution for own use, as an experiment. I learnt that it can be faster than recursive resolution.

People have since written software for iterative resolution, e.g., https://lizizhikevich.github.io/assets/papers/ZDNS.pdf

Unfortunately authoritative servers generally do not encrypt their responses. IMO this would be more useful than "DNSSEC".

"And that data is often provided by authoritative servers."

What are examples of data not provided by authoritative servers.



One could argue the primary (not the only) risk addressed by DNSSEC is third party DNS service, i.e., shared caches accessible from the internet

If this is true, then one might assume DNSSEC is generally unnecessary if one is running their own unshared cache only accessible from the loopback or the LAN

Software like djb's dnscache, a personal favourite, has no support for DNSSEC

NLNet's unbound places a strong emphasis on supporting DNSSEC. The unbound documentation authors recommend using it

https://unbound.docs.nlnetlabs.nl/en/latest/getting-started/...


Or run "unbound" as your own local recursive resolver.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: