Re: [Resolverless-dns] Paper on Resolver-less DNS

[Erik Sy <[e-mail]>]

On 8/20/19 23:12, Paul Vixie wrote:
>> I assume that by
>> referring to DNSSEC and DANE, you do not want to claim that some popular
>> client software is strictly enforcing a validation of DNS records using
>> DNSSEC and DANE, right?
> caching resolvers everywhere, do this.
This study shows that only about 12% of the resolvers use DNSSEC to
validate the records [1].
>  the economy depends on them doing so.
I find that only 0.9% of the .com domains are signed [2] and having a
signature does not mean that they can be successfully validated.
> if RDNS isn't client software from your point of view, you'll dismiss these 
> assertions.

RDNS requires the client to trust the used recursive resolver. In my
view, the client should be able to validate the DNS records
independently of the recursive resolver. I think there is a security
benefit for clients in using TLS server authentication to validate DNS
records at least in the context of web browsing.

Erik

1:
https://www.usenix.org/system/files/conference/usenixsecurity17/sec17-chung.pdf

2: https://www.statdns.com/