3

Does setting up DNSSEC in client (systemd-resolved) with allow-downgrade option have any value? Does it improve security at all?

Improve this question

1 Answer 1

Reset to default
3

Yes, as the man page of resolved.conf states:

Client programs looking up DNS data will be informed whether lookups could be verified using DNSSEC, or whether the returned data could not be verified (either because the data was found unsigned in the DNS, or the DNS server did not support DNSSEC or no appropriate trust anchors were known). In the latter case it is assumed that client programs employ a secondary scheme to validate the returned DNS data, should this be required.

Thus, client programs can make appropriate use of the response, either warning the user of no dnssec validation or showing dnssec validation.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .