Against DNSSEC

This post also has an FAQ . DNSSEC is Unnecessary All secure crypto on the Internet assumes that the DNS lookup from names to IP addresses are insecure. Securing those DNS lookups therefore enables no meaningful security. DNSSEC does make some attacks against insecure sites harder. But it doesn’t make those attacks infeasible , so sites still need to adopt secure transports like TLS. With TLS properly configured, DNSSEC adds nothing. Take “domain-validated TLS certificates” . Some TLS CAs will sign certific