Hacker News

points by alwillis 2 days ago | 0 comments

> It’s a server-to-server protocol is true, then I'm ... pretty unsold on its usefulness.

You can run a DNSSEC-aware resolver like unbound on your laptop if you wanted to. It comes with a bunch of Linux distros.

[–] cowlevel 2 days ago

Can and should! Unbound is very easy to set up, if you know how to administer Linux systems at all. It also acts as a local cache and I noticed a small improvement to page loading time because of having the cache. Otherwise there is no local cache - every single call to getaddrinfo sends a network request to your configured DNS server.

[–] tptacek 1 day ago

People should just say what they mean here. DNSSEC is in fact a server-to-server protocol, and your response is "yes, you should just run your own servers".

[–] teddyh 1 day ago

Fact check: A resolver is not restricted to servers, and DNSSEC is not restricted to server-to-server traffic.

[–] tptacek 1 day ago

Ah, yes. What even is a "DNS server"? Clearly it's not the thing that shows up in your network configuration under "DNS server"; that, as you observe, is properly labeled "resolver".