Re: [Resolverless-dns] Paper on Resolver-less DNS

[Viktor Dukhovni <[e-mail]>]

> On Aug 22, 2019, at 5:50 PM, Paul Vixie <[e-mail]> wrote:
> 
> > >  the economy depends on them doing so.
> > 
> > I find that only 0.9% of the .com domains are signed [2] and having a
> > signature does not mean that they can be successfully validated.
>  
> I suggest you broaden your search for knowledge. for example, this web site may be of interest, along with the monthly reports posted to dns-operations@ by the same authors.
>  
> https://stats.dnssec-tools.org/ 

While the .COM zone has 0.95% DNSSEC adoption (1,349,030 domains out
of 141,522,129 in yesterday's zone file), other TLDs, especially in
Europe, have a much higher adoption rate.  For example, the .CZ, .NL,
.NO and .SE TLDs have >50% DNSSEC adoption.  Below is a recent (end of
May) snapshot of the top 10 TLDs by signed domain count:

TLD	#Domains	#signed		#Source
----    --------	-------		-------
.NL	  5864458	3184849		https://stats.nic.cz/stats/domains_by_dnssec/
.COM	140169031	1273294		.COM zone file
.BR	  4056813	1079522		https://registro.br/estatisticas.html
.SE	  1453459	 769879		.SE zone file
.CZ	  1328201	 746689		https://stats.nic.cz/stats/domains_by_dnssec/
.EU	  3661899 	 513324 	Eurid reports
.PL	  2615437 	 499529 	dns.pl website
.NO	   772052 	 448640 	norid.no website
.FR	  3388943 	 402472 	afnic.fr website
.BE	  1287130 	 288876		DANE survey

Overall, in the DNSSEC survey, there are ~10 million signed domains
(delegated from "public-suffix" parent domains) out of ~260 million
sampled, so the "adoption bump" in Europe brings the overall rate
closer to 4%.

[ FWIW, with the website updated daily, I've stopped sending monthly
  summaries to the dns-operations list, but could do it again if
  there's popular demand. ]

> > > if RDNS isn't client software from your point of view, you'll dismiss
> > > these assertions.
> > 
> > RDNS requires the client to trust the used recursive resolver.
>  
> not for DANE work flows. stub validation is not widely implemented or well supported by DNSSEC, but it works, and existing DANE TLSA clients do this.

The DANE implementation in Postfix and Exim leaves DNSSEC validation
to the loopback (local) resolver, rather than duplicate (poorly) the
code already present in BIND, unbound, etc.  A local resolver is also
useful for caching MX RRsets, RBL results, ... so is already best-
practice on an MTA.

While applications might use libunbound or similar to directly validate
DNSSEC records, there still needs to some sort of OS service for keeping
the root (and any other) trust-anchors fresh.  This could of course be
much more light-weight than a local caching resolver...

-- 
	Viktor.