Fortunately, you can investigate this stuff for yourself and develop your own opinion. IMHO, DNSSEC doesn't actually "secure" much of anything. It can be disabled trivially by anyone operating a resolver. As I mentioned elsewhere, none of the major sites (FAANG) use it. What does that tell you?
replyThen propose a censorship resistant protocol.
replyYes I'm not saying DNSSEC is or isn't good. I think a multi-layered approach would be best for redundancy.
replyWait. Hold on. It is either good or it isn't. If it's good, we should be using it (maybe in a layer cake, maybe a la carte). If it's bad, it should not be used anywhere.
reply