There's a couple things about modern DNS that just doesn't make sense. There's probably a good explanation buried somewhere in a mailing list or three.
The other one that still astounds me is that DV certificates rely entirely on DNS control for validation prior to issuance, and browsers trust that system, but there still exists no way for me to cut out the middle man and put my own domain-specific CA Cert in DNS directly.
The other one that still astounds me is that DV certificates rely entirely on DNS control for validation prior to issuance, and browsers trust that system, but there still exists no way for me to cut out the middle man and put my own domain-specific CA Cert in DNS directly.