[DNSOP] Re: A question regarding DNSSEC validation

[Ben Schwartz <[e-mail]>]

On Mon, Apr 20, 2026 at 3:22 PM Philip Homburg <[e-mail]>
wrote:
...

> Most domains are not DNSSEC signed. If we assume that an attacker can
> insert bogus replies then for DNSSEC this is amounts to a DoS. For
> unsigned zones, this means total data corruption.
>
> What we see in practice is that these types of off-path attacks are
> extremely rare.


I agree.


> We can expect that a DoS on DNSSEC will be much more
> rare than attacks on unsigned zones.
>

I disagree.  "Man on the side" attacks on DNS, by injecting a forged reply
that races the true reply, are common, and are not limited to unsigned
domains.

So not worth it, unless for some reason the UDP context already remains
> available after the reply has been received.
>

I don't know what this means.

Personally, I would love to see resolvers leave the DNS listener open for a
few seconds after receiving a Bogus response, in case it is followed
shortly by a Secure response.  This can happen in parallel with retries to
other nameservers, so it doesn't slow down resolution.  In other words, I
agree with Cathy: "Ignoring such invalid responses and continuing to wait
for valid ones until timeout appears to be a better design.".
Unfortunately, I'm not aware of any resolvers that do this today.

I would call this feature "DNSSEC Hold On".

--Ben