> 1) "secure DNS" is a solved problem
No, not in practice. You can easily MitM DNS and nobody is verifying DNSSEC by default. On the current internet, secure DNS just doesn't exist.
No, not in practice. You can easily MitM DNS and nobody is verifying DNSSEC by default. On the current internet, secure DNS just doesn't exist.
That is because security is hard.
This doesn't mitigate MitM attacks, as upstream DNS records can still be spoofed
WE go from a fast, decentralised, resilient and low overhead system, to a centralised chatty and fragile behemoth.
It still doesn't give end to end encryption, its just a slow encrypted proxy.
Some measurements of DNSSEC validation show that as much as 15% of Internet domain lookups validate DNSSEC: http://stats.labs.apnic.net/dnssec/XA. Approximately half of that is due to Google Public DNS validation (many sites use both Google Public DNS and other resolvers that do not validate, so do not actually validate DNSSEC overall).
It is very true that less than 1% of DNS zones are signed with DNSSEC, so it is true that "secure DNS" doesn't practically exist, but this a serving side issue, not a lack of client validation.