Hacker News Reader

> AFAIK, dnsmasq supports DNSSEC, so the right answer is to turn on validation.

Just disabled DNSSEC in my PiHole. Too many domains which are incorrectly configured leading to non-existing domain errors.

And at least as far as I could find, PiHole has no way to selectively disable DNSSEC validation for certain domains.

View on HN

> Too many domains which are incorrectly configured leading to non-existing domain errors.

That's an interesting and somewhat surprising data point given the use of DNSSEC validation at public resolvers (e.g., 1.1.1.1, 8.8.8.8, etc.). Might be something that would be useful to track by those following DNSSEC deployment.

For selectively disabling DNSSEC validation, I gather PiHole+dnsmasq doesn't support Reverse Trust Anchors (RTA). Unfortunate.

Geoff Huston at APNIC does track this!

Reply on news.ycombinator.com