On 21. 04. 26 22:41, Ben Schwartz wrote:
On Mon, Apr 20, 2026 at 3:22 PM Philip Homburg <pch-
[email protected] <mailto:[email protected]>> wrote:
...
Most domains are not DNSSEC signed. If we assume that an attacker can
insert bogus replies then for DNSSEC this is amounts to a DoS. For
unsigned zones, this means total data corruption.
What we see in practice is that these types of off-path attacks are
extremely rare.
I agree.
We can expect that a DoS on DNSSEC will be much more
rare than attacks on unsigned zones.
I disagree. "Man on the side" attacks on DNS, by injecting a forged
reply that races the true reply, are common, and are not limited to
unsigned domains.
Hi!
"Long time no see!"
Do you happen to have any papers or other data on that topic?
I have seen all sorts of claims on this over the years but no data so
I'm very curious.
I hope to meet you again - perhaps at OARC 47 in Vancouver?
--
Petr Špaček
_______________________________________________
DNSOP mailing list -- [email protected]
To unsubscribe send an email to [email protected]
