Hacker News Reader

Comment by captn3m0 | Hacker News Reader

I’d been wanting to use this for a while, but support is lacking for most DNS providers. Maybe it should go the way of SPF and reuse TXT instead.

CloudFlare added support in 2018: https://blog.cloudflare.com/additional-record-types-availabl...

AWS still doesn’t support it: http://web.archive.org/web/20210429183447/https://forums.aws...

Namecheap doesn’t: https://www.namecheap.com/support/knowledgebase/article.aspx...

GCP doesn’t: https://cloud.google.com/dns/docs/records

Azure doesn’t: https://learn.microsoft.com/en-us/azure/dns/dns-zones-record...

View on HN

It specifically needed to be its own record as the record requires DNSSEC to verify that the returned SSH key is trusted. Using TXT would be ridiculously insecure as it cannot force the DNSSEC verification step that SSHFP as a unique record gives.

Definitely annoying, but does ensure that the returned SSH key is always correct and not from a forged record.

Can you clarify the issue? Are you saying that DNSSEC doesn't allow verification of TXT records, but does support SSHFP records? I'm not seeing a reference to that online.

> Using TXT would be ridiculously insecure as it cannot force the DNSSEC verification step that SSHFP as a unique record gives.

I don't believe that that is true. DNSSEC RRSIG records are created over the entire result set. So even if there are numerous records returned, you should still be able to verify the signature. Also, there is nothing stopping you from also returning multiple SSHFP records in a single query.

However, SPF does have a design flaw (amongst many other) that the record is placed under the domain root, which is often already polluted with other records. This is why other standards that use TXT (DMARC, DKIM, BIMI, MTA-STS, TLSRPT, etc.) use a specific label prefix, or a selector. But this is not because of DNSSEC.

What are you talking about? DNSSEC can sign TXT records perfectly well, just as any other RR type. Of course, it’s much cleaner, design-wise, to have its own RR type, and any resolvers which cannot tolerate unknown types are seriously obsolete and should be replaced.

Reply on news.ycombinator.com