> On Jul 28, 2026, at 14:38, Ondřej Surý <[email protected]> wrote: > >> On 27. 7. 2026, at 07:54, Bill Woodcock <[email protected]> wrote: >> >> >> >>> On Jul 20, 2026, at 17:55, Stephane Bortzmeyer >>> <[email protected]> wrote: >>> https://datatracker.ietf.org/doc/draft-bortzmeyer-dnsop-poisonlicious/ >> >> I strongly support the effort, but would prefer DoT to be mandatory, and >> DANE authentication to be preferred over TSIG, when available. > > I strongly believe the security mechanism should be a matter of local policy > (and implementation defaults) rather than something enforced by the Internet > Standard. > > So far, the DNS does not even enforce a secure transport and/or authentication > for XFRs, so enforcing DoT/DANE/whatever for something that is going to be > mostly used on internal networks feels over the top.
Sorry, I should have said DoQ/DoT; force of habit.
I hear you, but I think that as long as we make security optional, a lot of
people won’t bother, and then a lot of people writing code won’t prioritize it,
and then it won’t work when it’s needed. Whereas if everything is as secure as
our current standards facilitate, all the time, we only have a single build
target and test case and the most-sensitive traffic doesn’t have a target
painted on its back.
Why should HTTP be secure-by-default, but DNS not?
-Bill
signature.asc
Description: Message signed with OpenPGP
_______________________________________________ DNSOP mailing list -- [email protected] To unsubscribe send an email to [email protected]
