IETF Logo Mail Archive

[DNSOP] Re: A question regarding DNSSEC validation

Petr Špaček <pspacek@isc.org> Tue, 01 September 2026 14:00 UTC

Return-Path: <pspacek@isc.org>
X-Original-To: dnsop@mail2.ietf.org
Delivered-To: dnsop@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id E86B4133154C8 for <dnsop@mail2.ietf.org>; Tue, 1 Sep 2026 07:00:52 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1788271252; bh=UNmEo92+r9m4VmBcwz9NB6WfFvzxDSxq/nC40tKssIA=; h=Date:Subject:To:Cc:References:From:In-Reply-To; b=H8EaQhbFU9HvPyOo0ILD/77H1RTMXWBv5mrQQikxcDJfn56M/wSjWk6Nmt6HnA3j5 DbHgjLgyJFolvhll0as4oEmruuLB/bf2fm45sOa0od8PoFUEk7PH8RycD6HdjO4uov 7R8uuEZ1YD6mzPa6o5+GI3InaRxkkKoPiDN8Fu4I=
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -4.399
X-Spam-Level:
X-Spam-Status: No, score=-4.399 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (1024-bit key) header.d=isc.org header.b="ZS5XJ1em"; dkim=pass (1024-bit key) header.d=isc.org header.b="gUKUbjew"
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id O-otDelMQeRL for <dnsop@mail2.ietf.org>; Tue, 1 Sep 2026 07:00:51 -0700 (PDT)
Received: from mx.pao1.isc.org (mx.pao1.isc.org [149.20.2.50]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 3619B133154B8 for <dnsop@ietf.org>; Tue, 1 Sep 2026 07:00:51 -0700 (PDT)
Received: from zimbra10.isc.org (zimbra10.isc.org [149.20.2.90]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mx.pao1.isc.org (Postfix) with ESMTPS id DEE804E414E; Tue, 01 Sep 2026 14:00:43 +0000 (UTC)
ARC-Filter: OpenARC Filter v1.0.0 mx.pao1.isc.org DEE804E414E
Authentication-Results: mx.pao1.isc.org; arc=none smtp.remote-ip=149.20.2.90
ARC-Seal: i=1; a=rsa-sha256; d=isc.org; s=ostpay; t=1788271243; cv=none; b=QvV9N2z6IaNEMFeJS7hPe2R7m9G3nFc7xA8KWejYqHk6oiyUb24pyV5WZp6Z+uiVRMF2hBnCzHfGikSabF3bmEfAPEU6oX6BDag2ox3JaFoa4JqjP3ad2RlWdXrLlQtAbEQXU+sfrcV7GCOzyDw6w6YF++6JKfnng/tDH5HlfuI=
ARC-Message-Signature: i=1; a=rsa-sha256; d=isc.org; s=ostpay; t=1788271243; c=relaxed/relaxed; bh=xuvbv+23DTloPtw9Bv3B2yNhj1JC1qo3/auXL9VXA4U=; h=DKIM-Signature:DKIM-Signature:Message-ID:Date:MIME-Version: Subject:To:From; b=VSzQscbfCH2K8dJOukomJjZUbElIV8FfMX9AoKvuguXCxgii+P6t33pBBsmRMU/em3CCsTgOTcEYjV5LPNAbLSLnSuE0FKppzelTVC743LZCv3Uow2jshOQjtp31Wgtk6O1ayIkl0ogyELGvlo5J0hthWRcWhMdOgbCAmrzdD+0=
ARC-Authentication-Results: i=1; mx.pao1.isc.org
DKIM-Filter: OpenDKIM Filter v2.10.3 mx.pao1.isc.org DEE804E414E
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=isc.org; s=ostpay; t=1788271243; bh=UNmEo92+r9m4VmBcwz9NB6WfFvzxDSxq/nC40tKssIA=; h=Date:Subject:To:Cc:References:From:In-Reply-To; b=ZS5XJ1emD2u2wZdy3ql4gugzEbqbiuuGNSdQBa8Z7hupEiePLpOpEh/rcVxCXYFHK 56GaoHJz/WA6bUZW7M2436jy27l3h4Bnyk6pAX/bWj38BITxWnd30hduxDhLcBKfWM DAHSrb7u06zr5f3Vi0BdoqCHhrb6p3SPqrtyEMPM=
Received: from zimbra10.isc.org (localhost [127.0.0.1]) by zimbra10.isc.org (Postfix) with ESMTPS id DAE9F2E602AF; Tue, 1 Sep 2026 14:00:43 +0000 (UTC)
Received: from zimbra10.isc.org (localhost [127.0.0.1]) by zimbra10.isc.org (Postfix) with ESMTPS id D6EC72E60307; Tue, 1 Sep 2026 14:00:43 +0000 (UTC)
DKIM-Filter: OpenDKIM Filter v2.10.3 zimbra10.isc.org D6EC72E60307
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=isc.org; s=05DFB016-56A2-11EB-AEC0-15368D323330; t=1788271243; bh=xuvbv+23DTloPtw9Bv3B2yNhj1JC1qo3/auXL9VXA4U=; h=Message-ID:Date:MIME-Version:To:From; b=gUKUbjewyXz8ZTSgmqUKslIO+HKywS+KBYyXaEL5xHk2YQBvwhgaAwQH3YeRJZ3sX 9gdZWwuYYFiHRDcEU5CkASI5n5z6V8LIZYexNq4NdTlYXitijxOxKY77NUO1dKkCMY gFEM+f38JdwANsgiUqXZE+CyPi+xuPspDm1+diJQ=
Received: from [10.42.77.112] (37-188-131-237.red.o2.cz [37.188.131.237]) by zimbra10.isc.org (Postfix) with ESMTPSA id 2BF742E602AF; Tue, 1 Sep 2026 14:00:43 +0000 (UTC)
Message-ID: <24324335-aac2-472b-bdd8-bd47f34c59c0@isc.org>
Date: Tue, 01 Sep 2026 16:00:39 +0200
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
To: Ben Schwartz <bemasc=40meta.com@dmarc.ietf.org>
References: <749d198c.101a.19d93e2675d.Coremail.scooct@163.com> <CAOdQrVMv+PhzCc1_=uAqb=qWeF53um5VwnkhPFsSgK40XSt=yw@mail.gmail.com> <907eeced-4878-4d55-b3cb-48ecd6b9a780@nic.cz> <7CA832F4-085E-4C14-B497-C6D463D822F9@gmail.com> <13d59275.1a50.19da89796a0.Coremail.scooct@163.com> <78E84261-2183-4C0C-8CC4-7709E25F9230@gmail.com> <m1wEuBX-0000NZC@stereo.hq.phicoh.net> <CAOdQrVN2RfrwDPWY-9UHPosYsnd+2Lhh6FGX+aqCSaMrdQzdjw@mail.gmail.com>
From: Petr Špaček <pspacek@isc.org>
Content-Language: en-US
Autocrypt: addr=pspacek@isc.org; keydata= xsFNBF/OJ/4BEAC0jP/EShRZtcI9KmzVK4IoD/GEDtcaNEEQzPt05G8xtC0P4uteXUwW8jaB CdcKIKR4eUJw3wdXXScLNlyh0i+gm5mIvKPrBYNAMOGGnkbAmMQOt9Q+TyGeTSSGiAjfvd/N nYg7L/KjVbG0sp6pAWVORMpR0oChHflzKSjvJITCGdpwagxSffU2HeWrLN7ePES6gPbtZ8HY KHUqjWZQsXLkMFw4yj8ZXuGarLwdBMB7V/9YHVkatJPjTsP8ZE723rV18iLiMvBqh4XtReEP 0vGQgiHnLnKs+reDiFy0cSOG0lpUWVGI50znu/gBuZRtTAE0LfMa0oAYaq997Y4k+na6JvHK hhaZMy82cD4YUa/xNnUPMXJjkJOBV4ghz/58GiT32lj4rdccjQO4zlvtjltjp9MTOFbRNI+I FCf9bykANotR+2BzttYKuCcred+Q7+wSDp9FQDdpUOiGnzT8oQukOuqiEh3J8hinHPGhtovH V22D0cU6T/u9mzvYoULhExPvXZglCLEuM0dACtjVsoyDkFVnTTupaPVuORgoW7nyNl0wDrII ILBqUBwzCdhQpYnyARSjx0gWSG1AQBKkk5SHQBqi1RAYC38M59SkpH0IKj+SaZbUJnuqshXh UIbY1GMHbW/GDhz7pNQFFYm2S4OPUBcmh/0O0Osma151/HjF7wARAQABzR9QZXRyIMWgcGHE jWVrIDxwc3BhY2VrQGlzYy5vcmc+wsGXBBMBCABBAhsDBQsJCAcCBhUKCQgLAgQWAgMBAh4B AheAAhkBFiEEEVO2++xeDVoSYmDzq9WHzfBlga4FAmkt8P0FCQtoiX8ACgkQq9WHzfBlga4m OxAAhBZyC7vnxl3kjFPFRT39ocbZy1jJX4fiaJmiIgKma06c9Eled/w2IN9pzRc0+iI6jSQa 40NfHFV8g2KZfZUNEVE3BOliWdEFi61OcwxB/UeryGDJUFYfK4un7ibYv4Rzvrfpz13aQ0/z MVm2HA3OVwkTqnK+dJL//d3AmED66oJKUFXU9tG5kUGNqbVrZNSiegZXC/TloO0+eYYN63Fm EHvWE20NcgdciG4y/pdtBXcWSwt21tSeqiZqN5L8LvfAGmJ1gdi6p4eHvPEH1WSOqUEZmy5l +5BE6xA2z4bfNpCYSir6GwFTOQwxHeekLKJktgsLjYY8oHbmPjIIdEzkcV8dD8czJEPo0sqe VB4qTun8cCE4AkVofpo5MMwni/3DLlm9bgV8tKJ3sAqwo6bEWk8dU9QqlcwiYb5S1KPbWrwO 89cIJNLIu9rO3nemWFDwNq6mFuNdNWSDciLV434P5xZ0y5Xy09n5dGhCgYZTRv1JTLmXEO+H aw6iRgLNZmImYB0VpoPPHBjIavsY211qyLIwDRaUykELhGaBk7P1zKhC91ZD866CbR3x6ptv EuFuJ2myZT1dIalWiFf0HaVhrMHm8y8ih1sn9Ezdxnle7Hxyjgp//CtM92GCjU8iuqYQOzNq B9LWBU6NTtGx5Tktf2/Vin2ADqiiVN1EDOQd9tvOwU0EX84n/gEQANARNXihDNc1fLNFZK5s O14Yg2TouK9eo9gGh4yLSrmZ3pjtnuJSpTWmGD4g0EYzhwWA/T+CqjUnrhsvzLQ1ECYVqLpM VqK2OJ9PhLRbx1ITd4SKO/0xvXFkUqDTIF6a5mUCXH5DzTQGSmJwcjoRv3ye+Z1lDzOKJ+Qr gDHM2WLGlSZAVGcUeD1S2Mp/FroNOjGzrFXsUhOBNMo8PSC4ap0ZgYeVBq5aiMaQex0r+uM4 45S1z5N2nkNRYlUARkfKirqQxJ4mtj5XPC/jtdaUiMzvnwcMmLAwPlDNYiU0kO5IqJFBdzmJ yjzomVk1zK9AYS/woeIxETs+s6o7qXtMGGIoMWr6pirpHk4Wgp4TS02BSTSmNzParrFxLpEU dFKq3M0IsBCVGvfNgWL2pKKQVq34fwuBhJFQAigR9B3O9mfaeejrqt73Crp0ng0+Q74+Llzj EIJLOHYTMISTJyxYzhMCQlgPkKoj+TSVkRzBZoYFkUt4OXvlFj73wkeqeF8Z1YWoOCIjwXH9 0u2lPEq0cRHHyK+KSeH1zQJ4xgj0QDGPmkvi81D13sRaaNu3uSfXEDrdYYc+TSZd2bVh2VCr xrcfzQ1uz9fsdC9NPdNd7/mHvcAaNc5e9IhNh67L54aMBkzlJi18d0sWXOOHkyLSvbHnC/OP wv7qCf69PUJmtoeHABEBAAHCwXwEGAEIACYCGwwWIQQRU7b77F4NWhJiYPOr1YfN8GWBrgUC aS3xCAUJC2iJigAKCRCr1YfN8GWBrgJJD/4oabL/T67M7GNPB1Q+1ghSpi3LJEwDqeaULNZv 2exo7N59cChW5DXD5e/rkvQM7yOsaKJBwkpjY2+vk4+Tw9iU1iqzS0iavr9A3i9mHJjlp4it u6oDBHCGMqBGZHHGP4O9xPuIoW6s50yP31NLbIGP4KGD03S1JtOBrETlTyr6a0mN4HrRnAkz nOa2l7npRvgkRpdr/vDmbAkyZYXcUCQSWsOKzRrcCrqRxzF7Ob39Xw+SrPv7hMBShzOVJCj6 XwOsu+F/hmRK5TML8+yZ+wGbrcTyxJ8qkKtwtDJXPMVY993f1k50/bquRdjX5wHTthvf6o9A 2cmZtbL0fVm2KEWNV3xDk52cJj7MqBk1M/mj1q8+6UzN9hTxN0N77u1sosgguW/8PWu/v2yy kUs2huxaqDkdrPc6kKuKbCGpkT5/89S6gvQSNx5IlVl0uWzJRat1h9HkdkO0CBYRX51Rv33W BF4qJ73o2dfrUchs70rher6734c21z8DUhDkvnPGIgLh4tYrYHNcM4akBTUt9k38xMGrj6yo kRjP6Pq9jhLwJBxxBRDEXn3vse8uy1s1sp9rhBxSS7bEHfmyz71h6ccALCFBlBzqfMediCAE 0PEMOPrXM0NU+o25vNC8BuWWpPf+fzvkLf+sEyYcIdwbHZ/V2qv97JvYX0FpMwmeyw4O2g==
In-Reply-To: <CAOdQrVN2RfrwDPWY-9UHPosYsnd+2Lhh6FGX+aqCSaMrdQzdjw@mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"; format="flowed"
Content-Transfer-Encoding: 8bit
Message-ID-Hash: 456SOF3EKHQDP65AS6ZAGCWHMCXYC4OF
X-Message-ID-Hash: 456SOF3EKHQDP65AS6ZAGCWHMCXYC4OF
X-MailFrom: pspacek@isc.org
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-dnsop.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: dnsop@ietf.org
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [DNSOP] Re: A question regarding DNSSEC validation
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/yGNipBYpCljQVVzBSpREiS-bG1M>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Owner: <mailto:dnsop-owner@ietf.org>
List-Post: <mailto:dnsop@ietf.org>
List-Subscribe: <mailto:dnsop-join@ietf.org>
List-Unsubscribe: <mailto:dnsop-leave@ietf.org>

On 21. 04. 26 22:41, Ben Schwartz wrote:
> 
> 
> On Mon, Apr 20, 2026 at 3:22 PM Philip Homburg <pch- 
> dnsop-7@u-1.phicoh.com <mailto:pch-dnsop-7@u-1.phicoh.com>> wrote:
> ...
> 
>     Most domains are not DNSSEC signed. If we assume that an attacker can
>     insert bogus replies then for DNSSEC this is amounts to a DoS. For
>     unsigned zones, this means total data corruption.
> 
>     What we see in practice is that these types of off-path attacks are
>     extremely rare.
> 
> 
> I agree.
> 
>     We can expect that a DoS on DNSSEC will be much more
>     rare than attacks on unsigned zones.
> 
> 
> I disagree.  "Man on the side" attacks on DNS, by injecting a forged 
> reply that races the true reply, are common, and are not limited to 
> unsigned domains.

Hi!

"Long time no see!"

Do you happen to have any papers or other data on that topic?

I have seen all sorts of claims on this over the years but no data so 
I'm very curious.

I hope to meet you again - perhaps at OARC 47 in Vancouver?

-- 
Petr Špaček

v2.46.0 | Report a Bug | By Email | System Status