hat tip to .gov hostmasters
Florian Weimer
fweimer at bfk.de
Mon Sep 22 15:13:25 UTC 2008
* Simon Vallet:
>> I'm not much up on DNSSEC, but don't you need to be using a resolver
>> that recognizes DNSSEC in order for this to be useful?
>
> You do -- and last time I checked few native resolvers actually did :
> glibc doesn't, and I'd be surprised if the Windows resolver does
Windows doesn't. To my knowledge, there aren't any deployed
valdiating, security-aware stub resolvers. Your best bet is to run
BIND or Unbound locally with appropriate trust anchors, and use that
as the system's resolver. With modern LRU-based caches which are
efficient even at smallish sizes, this isn't much of a problem.
--
Florian Weimer <fweimer at bfk.de>
BFK edv-consulting GmbH http://www.bfk.de/
Kriegsstraße 100 tel: +49-721-96201-1
D-76133 Karlsruhe fax: +49-721-96201-99
More information about the NANOG
mailing list