That's fine, I understand. I'm not telling you how to live your life. All I'll say is: there are SOC2 firms that will also tell you to turn DNSSEC on. You can tell them to go fuck themselves, and you'll be just fine. I don't know if that's the case with your NY-FI customers (none of the major investment banks are signed, nor are any of the exchanges, nor are the largest hedge funds and prop traders, but that's neither here nor there); only you know how to handle them.
I'm just here to establish that the mainstream security audits definitely don't require DNSSEC. :)
I'm just here to establish that the mainstream security audits definitely don't require DNSSEC. :)