New answers tagged

0

It does seem to work in practice with most validating resolvers. However, a strict interpretation of RFC 4035 Section 2.2 (specifically "There MUST be an RRSIG for each RRset using at least one DNSKEY of each algorithm in the zone apex DNSKEY RRset.") could imply that if you have different KSK and ZSK algorithms, a validating resolver may require all RRsets ...


1

It depends on what you are trying to achieve. If you are trying to prevent DNS leaks, DNSCrypt isn't what you need. DNSCrypt is intended to prevent DNS spoofing, which is quite different. You could think of it as Privacy vs Man-in-the-Middle. DNSCrypt is a protocol that authenticates communications between a DNS client and a DNS resolver. It prevents ...



Top 50 recent answers are included