Hacker News Reader

> It’s a server-to-server protocol is true, then I'm ... pretty unsold on its usefulness.

You can run a DNSSEC-aware resolver like unbound on your laptop if you wanted to. It comes with a bunch of Linux distros.

View on HN

Can and should! Unbound is very easy to set up, if you know how to administer Linux systems at all. It also acts as a local cache and I noticed a small improvement to page loading time because of having the cache. Otherwise there is no local cache - every single call to getaddrinfo sends a network request to your configured DNS server.

People should just say what they mean here. DNSSEC is in fact a server-to-server protocol, and your response is "yes, you should just run your own servers".

Fact check: A resolver is not restricted to servers, and DNSSEC is not restricted to server-to-server traffic.

Ah, yes. What even is a "DNS server"? Clearly it's not the thing that shows up in your network configuration under "DNS server"; that, as you observe, is properly labeled "resolver".

Reply on news.ycombinator.com