top | item 47184227

(no title)

tptacek | 2 days ago

This is an on-path attacker. In end-user DNS configurations, attackers can simply disable DNSSEC; it's 1 bit in the DNS response header ("yeah, sure, I verified this for you, trust me").

discuss

order

jcalvinowens|1 day ago

No, modern resolvers like systemd-resolved actually check the dnssec signatures on the client.

tptacek|1 day ago

To check the DNSSEC signatures on the client, you have to do a full recursive lookup. You've always been able to run your own DNS cache, if you want your host to operate independently of any upstream DNS server. But at that point, you're simply running your own DNS server.

akerl_|1 day ago

Can you link to a distro config that defaults to that?