Re: [LINK] Calling time on DNSSEC?

Grant Taylor <gtaylor@tnetconsulting.net> writes:

On 11/26/24 16:44, Computer Nerd Kev wrote:

  How have we got to this point?" ...

>
Too many people stop once they achieve what they think is the minimum
viable product.  Basic insecure DNS is that MVP when it comes to name
resolution.
 
People move on to other MVP tasks that demand their attention and
never get back around to DNSSEC.
>
I've been using DNSSEC for 10-15 years with effectively minimal
problems.

I use it too, a bit.

It’s not enough. It can secure the name-to-address mapping but does
nothing for the security of any data sent or received. You need TLS (or
SSH, or whatever) as well, and those already deal with naming.  So it’s
natural to ask why someone would bother with DNSSEC as well, and hardly
surprising that mostly the answer is that people don’t.

--
https://www.greenend.org.uk/rjk/