Post #2447689
2026-05-09 13:14 UTC
@dalias@hachyderm.io @i@toot.pouyan.net @freci@piaille.fr @SRAZKVT@tech.lgbt Yeah, exactly. And requesting signatures is only a matter of setting an extra flag in a DNS query (the DO bit, if I understand correctly). The requirement for larger message sizes is difficult if you're stuck with plain UDP, but since implementing DoH/DoT was no problem at all for browsers, the "extra roundtrip" argument is bogus on all fronts.
Replies (1)
-
@dalias@hachyderm.io 2026-05-09 13:18
@stiiin@infosec.space @i@toot.pouyan.net @freci@piaille.fr @SRAZKVT@tech.lgbt The client doesn't need the DNSSEC signatures (altho it may want them too if the nameservers aren't trusted to validate them); it needs the DANE keys. That's an extra query for TLSA RR type, and could be large if the site does dumb stuff like putting full key/cert rather than hash in there. But it can still be concurrent.