Re: [Add] data integrity and DNSSEC or DoH/DoT

[Willem Toorop <[e-mail]>]

On 22-08-19 13:28, Ralf Weber wrote:
> Moin!
> 
> On 22 Aug 2019, at 0:18, Rob Sayre wrote:
> 
>> On Wed, Aug 21, 2019 at 3:15 PM David Conrad <[e-mail]> wrote:
>>
>>> My response to Ted that caused me to get sucked into this particular
>>> swamp
>>> (something I already regret)
>>>
>>
>> Is that the swamp where the only significant DNSSEC providers are Google
>> and Cloudflare?
> I assume you are talking about validating recursive resolvers here.
> There are
> way more, e.g Comcast, all the swedish ISP, a couple of ISPs in South
> America
> and I know that there are more European ISPs that are planning to turn
> it on.

Yes, on RIPE Atlas 60% of the resolvers now does DNSSEC validation:

	https://dnsthought.nlnetlabs.nl/#rsasha256

And here is the graph showing the top ASNs of the IPs seen at the
authoritative for those DNSSEC validating resolvers:

	https://dnsthought.nlnetlabs.nl/can_rsasha256/#top_auth_asns

Yes, Google & Cloudflare count for 43.7% of validating resolvers, but
validation is increasing also without them.  One noteworthy party that
started DNSSEC validation recently is Deutsche Telekom, see:

	https://dnsthought.nlnetlabs.nl/auth_AS3320/#rsasha256

Consequently they also stopped NX domain hijacking :)

	https://dnsthought.nlnetlabs.nl/auth_AS3320/#top_nxhj_asns

Perhaps the threat of DoH (and the TRR) alone already stimulates the
ISPs to deliver better resolvers? ;)

-- Willem


> Plus even without validation in the recursive resolver you could have
> validation
> on your end device if you want.
> 
> So long
> -Ralf
> ---
> Ralf Weber
>