Hacker News Reader

I don’t work for AWS, but I’ve talked to people that work on Route53. Amazon just isn’t willing to support it, none of their large customers care about it enough it seems like. Plus DNSSEC has all sorts of issues, some of which people in the thread have mentioned. Actually, tptacek has a blog post that summarizes a lot of what’s wrong with DNSSEC iirc.

View on HN

This unwillingness may indicate a lack of competency, complacency as a market leader, or complicity with censoring regimes.

How f difficult is it to sign a zone?

DNSSEC isn't perfect (indeed it only provides assurances of record integrity and doesn't secure the channel); but it's certainly better than nothing, than no signature at all.

If route53 can't or won't or doesn't have to because they don't want to implement DNSSEC, route53 is not suitable for .gov and .mil domains.

It's really that simple.

I get that you want to use terraform; I don't see why you think route53 is the only DNS that terraform works with.

Reply on news.ycombinator.com