Hacker News Reader

DNS-over-HTTPS has protected more people in just a couple years than 25+ years of DNSSEC standardization attempts. DNSSEC is moribund; meanwhile, it's not a bad bet that most DNS lookups in 5 years will originate over DoH.

> defend against malicious DNSSEC

what does that mean?

Not so much a faulty DNSSEC protocol but a misuse of DoH embedded maliciously within applications.

This vector has always existed - all that changed is RFC 8484 defines a standard way of doing this.

> DNS-over-HTTPS needs to die in a fire.

Sadly not going to happen