DNSSEC and ISPs faking DNS responses

Mon Nov 16 11:14:42 UTC 2015

eric-list at truenet.com <eric-list at truenet.com> wrote:

> Actually, how are other places implementing these lists?  I would have
> thought to use RPZ, but as far as I know if the blocked DNS domain is
> using DNSSEC it wouldn't work.

You can configure RPZ with the "break-dnssec" option which means
validating clients will fail to resolve the blocked domains.

DNSSEC only protects you from getting bad answers. If someone wants you to
get no answers at all then DNSSEC cannot help.

Tony.
-- 
f.anthony.n.finch  <dot at dotat.at>  http://dotat.at/
Tyne, Dogger, Fisher: Southwest 6 to gale 8, occasionally severe gale 9 at
first. Rough or very rough, becoming mainly moderate in Tyne. Rain or showers.
Good, occasionally poor.