Post #2563466
2026-05-10 23:11 UTC
@jima@mspsocial.net @ryanc@infosec.exchange @owen@mastodon.transneptune.net I just consider DNS-01 a giant weakness/violation of access controls. Automated processes should never have access to modify DNS, especially when that often (for non experts) means credentials to registrar.
Replies (2)
-
@jima@mspsocial.net 2026-05-10 23:14
@dalias@hachyderm.io @ryanc@infosec.exchange @owen@mastodon.transneptune.net I completely agree, which is why I CNAME the _acme-challenge records off to a distinct zone, which the automated process DOES have access to modify. 😀
-
@lanodan@queer.hacktivis.me 2026-05-10 23:15
@dalias@hachyderm.io @jima@mspsocial.net @ryanc@infosec.exchange @owen@mastodon.transneptune.net Well the challenge allows to delegate to another zone/nameserver (what I do here), but it's probably not the most typical setup.