Hacker News Reader

Comment by tptacek | Hacker News Reader

DNSCrypt is marginally useful. But don't bother with DNSSEC. It does more harm than good.

http://sockpuppet.org/blog/2015/01/15/against-dnssec/

Every time there's an article on DNSSEC here I find you bringing out the same mischaracterized arguments against it.

If you are ever in the Washington DC area I would be happy to take you out to dinner/beers and have a long friendly conversation about DNSSEC and why you dislike it so much. I'm completely serious, and I'm paying.

DNSSEC is a terrible idea, and articles encouraging people to set it up and describing the security benefits that work will bring deserve an informed rebuttal.

If you feel any of my arguments are "mischaracterized", you are welcome to try to rebut them.

Alright, I'll bite: I run a small personal network from soup to nuts - I host the DNS, the web server(s), the mail server(s), you name it. Why should I not set up DNSSEC - what's the downside for me?

See above blog post.

DNSSEC is useful for SMTP SSL encryption (at least from you to your server).

https://blog.filippo.io/the-sad-state-of-smtp-encryption/

Nope! They fixed that: there's now SMTP Strict Transport Security, sponsored by Google, Microsoft, and Yahoo. SMTP STS explicitly does not require DNSSEC --- because nobody thinks at-scale DNSSEC is going to happen anymore.

Isn't this still a draft? Also, it does not fix MX record spoofing, only downgrade attacks IIRC?

EDIT: Just reviewed the draft, seems like it addresses MX spoofing, but it seems to do it either via HTTPS or DNSSEC, so DNSSEC seems to be used by it

What does "still a draft" mean? That a bunch of randos at IETF haven't approved it yet? Three of the most important email providers on the planet sponsored it. It's what's going to happen.

It means it's not implemented in most SMTP clients/SMTP servers. The randos have a huge impact.

Not everyone uses Gmail/Outlook

Reply on news.ycombinator.com