Hacker News Reader

Comment by fragmede | Hacker News Reader

    If there is a DS record for "example.com", but no RRSIG record in the reply, something is wrong and maybe a man in the middle attack is going on, stripping the DNSSEC information and modifying the A records.

That's the second sentence in your quote which seems to say you can't hand out whatever you like for the entire zone, given that .com and .net and .edu have all been signed since 2011.

View on HN

Right.. check the rest of the thread above (what good is a signature that no one checks ;) )

I agree that signatures are of no value unless validation is done... but please do note that current measurements are showing about 13% of all DNS queries globally are in fact being validated:

http://stats.labs.apnic.net/dnssec/XA?c=XA&x=1&g=1&r=1&w=7&g...

If you scroll down that page you'll see higher statistics, such as 70% of all queries being DNSSEC-validated in Sweden, because almost all the ISPs there are now validating.

In the USA, about 23% of all DNS queries are being DNSSEC-validated:

http://stats.labs.apnic.net/dnssec/US?o=cXAw7x1g0r1

So the argument that "no one is checking" is no longer true.

That's excellent data - didn't realize those stats. Thanks for providing them.

Reply on news.ycombinator.com