If you don't absolutely have to, then don't.
That is to say, if you misconfigure it, or try to turn it off, you will have an invalid domain until the TTL runs out, and it's really just not worth the headache unless you have a real use case.
That is to say, if you misconfigure it, or try to turn it off, you will have an invalid domain until the TTL runs out, and it's really just not worth the headache unless you have a real use case.
Did DNSSEC for company website, worked with zero maintenance for several years. On a cloud-provided DNS. Would want the same on self-hosted DNS too.
Yes, but with nowadays https/tls usage it's almost irrelevant for normal websites.
If bad actors can create valid tls certs they can solve the dnssec problem.
I think you have it backwards: by not running DNSSEC it can mean bad actors (at least a certain level) can MITM the DNS queries that are used to validate ACME certs.
It is now mandated that public CAs have to verify DNSSEC before issuing a cert:
* https://news.ycombinator.com/item?id=47392510
So if you want to reduce the risk of someone creating a fake cert for one of your properties, you want to protect your DNS responses.
I think the risk didn't change much (except for big corp/bank).
* https://thehackernews.com/2013/11/snowden-reveals-gchq-plant...
* https://www.aclu.org/documents/quantum-insert-diagrams
* https://en.wikipedia.org/wiki/Man-on-the-side_attack
Still state-level, but probably less noticeable than BGP hijacking.
Unless you're entering IP addresses in all your applications and code, non-SEC DNS is an unsecured link in the chain of communications.