BIND 9 and DNSSEC
The DNS of RFCs 1034 and 1035 is secure in the same way IPv4 is—not very. You must be able to trust people, which you could on the Internet of 10 years ago, but now this has turned out to be a bit of a liability. On the other hand, if the root servers sign their query answers with known keys so you could check that the answers were unaltered and from a legitimate root server, it's a different situation. Additionally, if they also provide the public key of the nameserver to which they refer you, so that when, in turn, the answer comes back from that server you can verify that the answer is legitimate and unaltered, you have a new situation. You can trust DNS in a new way. Of course, this will still not stop people from entering ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access