Tag Info

New answers tagged

2

If I sign up for DNSSec for my domain example.com, only Resolvers that support DNSSec will look for the signature. Resolvers/Clients without support for DNSSec will not look for a signature. This is equivalent to "falling back" to not using DNSSec. There are a few wrinkles with how DNSSec is implemented. Windows 7, for example, provides a ...


0

DNSSEC and DNSCurve essentially do the same thing. They allow a client to verify that the records in a DNS response are identical to what the zone owner initially configured. They're not bulletproof; parent zones, registrars and registries can still do whatever they want with zones they are directly or indirectly authoritative for. But it's still better than ...


1

It seems that the idea is to keep the RRs and their signatures close together. RFC 4035, Section 3.1.1, Including RRSIG RRs in a Response 3.1.1. Including RRSIG RRs in a Response When responding to a query that has the DO bit set, a security-aware authoritative name server SHOULD attempt to send RRSIG RRs that a security-aware resolver ...



Top 50 recent answers are included