Hacker News Reader

Comment by phillipseamore | Hacker News Reader

And at least Let's encrypt actually verifies DNSSEC before issuing certificates. IIRC it will become mandatory for all CA's soon. DNSSEC for a domain plus restrictive CAA rules should ensure that no reputable CA would issue a rogue cert.

View on HN

They do validate signed zones -- that is true. How do they run their own zones?

  $ dig +short letsencrypt.org DS
  $

It absolutely will not. Most domains aren't hijacked by spoofing the DNS to begin with.

"Most domains". Yes, it is possible that nobody bothers to DNS hijack your domains. Sadly I've worked for organizations where it did happen, and now they have DNSSEC.

I invite anybody who thinks this is a mic drop to pull down the Tranco research list of most popular/important domains on the Internet --- it's just a text file of zones, one per line --- and write the trivial bash `for` loop to `dig +short ds` each of those zones and count how many have DNSSEC.

For starters you could try `dig +short ds google.com`. It'll give you a flavor of what to expect.

And you still can't seem to make your mind up on whether this is because DNSSEC is still in its infancy or if it's because they all somehow already studied DNSSEC and ended up with the exact same opinion as you. I'm gonna go out on a limb and say that it's not the latter.

I've worked for these orgs on this exact problem.

It's the latter.

What do I have to make my mind up about? I worked on the same floor as the TIS Labs people at Network Associates back in the 1990s. They designed DNSSEC and set the service model: offline signers, authenticated denial. We then went through DNSSEC-bis (with the typecode roll that allowed for scalable signing, something that hadn't been worked out as late as the mid-1990s) and DNSSEC-ter (NSEC3, whitelies). From 1994 through 2025 the protocol has never seen double-digit percentage adoption in North America or in the top 1000 zones, and its adoption has declined in recent years.

You're not going to take my word for it, but you could take Geoff Huston's, who recently recorded a whole podcast about this.

The primary DNSSEC standards, RFC 4033-4035, are 20 years old. It isn't "in its infancy."

Reply on news.ycombinator.com