> I would argue that the re-direct DNSSEC argument is nearly vanishingly small. But it can't be claimed to be zero.
Fair enough.. but if you're talking to a MITM anyway, would you agree that it's game over?
Fair enough.. but if you're talking to a MITM anyway, would you agree that it's game over?
There are several exceptions to the above example.
First, if "example.com" does not support DNSSEC, there will be no RRSIG record
in the answer and there will not be a DS record for "example.com" in the "com"
zone. If there is a DS record for "example.com", but no RRSIG record in the
reply, something is wrong and maybe a man in the middle attack is going on,
stripping the DNSSEC information and modifying the A records. Or, it could be a
broken security-oblivious name server along the way that stripped the DO flag
bit from the query or the RRSIG record from the answer. Or, it could be a
configuration error.
If there is a DS record for "example.com", but no RRSIG record in the reply, something is wrong and maybe a man in the middle attack is going on, stripping the DNSSEC information and modifying the A records.
http://stats.labs.apnic.net/dnssec/XA?c=XA&x=1&g=1&r=1&w=7&g...
If you scroll down that page you'll see higher statistics, such as 70% of all queries being DNSSEC-validated in Sweden, because almost all the ISPs there are now validating.
In the USA, about 23% of all DNS queries are being DNSSEC-validated:
http://stats.labs.apnic.net/dnssec/US?o=cXAw7x1g0r1
So the argument that "no one is checking" is no longer true.