Besides DNSSEC there are also those who are still pushing DNS over SSL/TLS for www domainnames.
Forgive my obtuseness but I still do not understand.
With the availability of high speed encryption for individual DNS packets between stub resolver and authoritative nameservers with DNSCurve[FN1] why would I want to encrypt "connections" to caches with TLS? (Names in a shared cache will be deemed pseudo-authoritative because of DNSSEC? And third parties get the ability to censor any name?)
https://dnsprivacy.org/wiki/x/E4AT
https://dnsprivacy.org/wiki/download/attachments/1277971/dns...
FN1. Some still doubt DNSCurve. Elsewhere in this thread someone posted a pointer to ianix.com. That site runs DNSCurve. For the doubters, here is what end-to-end encryption of DNS looks like:
# already have root.zone from ftp.internic.net so we already have addresses for tld's such as com
# resolution of ianix.com takes 2 queries (nonrecursive, RD bit unset)
# com servers are not running DNSCurve (yet) so first query is unencrypted
# however com.zone is public data that anyone can request from verisign
# thus there are ways to get ianix's authoritative nameservers w/o using DNS
1 ianix.com:
197 bytes, 1+0+2+2 records, response, noerror
query: 1 ianix.com
authority: ianix.com 172800 NS uz5cjwzs6zndm3gtcgzt1j74d0jrjnkm15wv681w6np9t1wy8s91g3.ianix.com
authority: ianix.com 172800 NS uz5pn8hy1fy1d2nn445s2m1udbvtytp5kp65mutgn9nggq9njvfg7f.ianix.com
additional: uz5cjwzs6zndm3gtcgzt1j74d0jrjnkm15wv681w6np9t1wy8s91g3.ianix.com 172800 A 69.195.157.182
additional: uz5pn8hy1fy1d2nn445s2m1udbvtytp5kp65mutgn9nggq9njvfg7f.ianix.com 172800 A 104.207.139.192
# ianix.com authoritative nameservers are running DNSCurve
# 2nd query is end-to-end encrypted, no third parties needed
1 ianix.com - streamlined DNSCurve:
229 bytes, 1+2+2+2 records, response, authoritative, noerror
query: 1 ianix.com
answer: ianix.com 3600 A 104.207.139.192
answer: ianix.com 3600 A 69.195.157.178
authority: ianix.com 259200 NS uz5cjwzs6zndm3gtcgzt1j74d0jrjnkm15wv681w6np9t1wy8s91g3.ianix.com
authority: ianix.com 259200 NS uz5pn8hy1fy1d2nn445s2m1udbvtytp5kp65mutgn9nggq9njvfg7f.ianix.com
additional: uz5cjwzs6zndm3gtcgzt1j74d0jrjnkm15wv681w6np9t1wy8s91g3.ianix.com 259200 A 69.195.157.182
additional: uz5pn8hy1fy1d2nn445s2m1udbvtytp5kp65mutgn9nggq9njvfg7f.ianix.com 259200 A 104.207.139.192
Forgive my obtuseness but I still do not understand.
With the availability of high speed encryption for individual DNS packets between stub resolver and authoritative nameservers with DNSCurve[FN1] why would I want to encrypt "connections" to caches with TLS? (Names in a shared cache will be deemed pseudo-authoritative because of DNSSEC? And third parties get the ability to censor any name?)
https://dnsprivacy.org/wiki/x/E4AT
https://dnsprivacy.org/wiki/download/attachments/1277971/dns...
FN1. Some still doubt DNSCurve. Elsewhere in this thread someone posted a pointer to ianix.com. That site runs DNSCurve. For the doubters, here is what end-to-end encryption of DNS looks like:
# already have root.zone from ftp.internic.net so we already have addresses for tld's such as com
# resolution of ianix.com takes 2 queries (nonrecursive, RD bit unset)
# com servers are not running DNSCurve (yet) so first query is unencrypted
# however com.zone is public data that anyone can request from verisign
# thus there are ways to get ianix's authoritative nameservers w/o using DNS
# ianix.com authoritative nameservers are running DNSCurve# 2nd query is end-to-end encrypted, no third parties needed