[krunck]

I saw this start at 10:14:29 CST.

[tryauuum]

DNSSEC is such a nightmare. All this "how do we make this old protocol secure and private without changing it much"

[naniwaduni]

DNSSEC does absolutely nothing for privacy. It seeks to achieve strictly authentication and incidentally integrity.

[tryauuum]

when I said privacy I was had NSEC3 in mind. To be honest I have no idea how does it work / why is it a thing but it looks like it obfuscates (deleted?) subdomains to make it harder to enumerate them. This is why you see stuff like

    15bg9l6359f5ch23e34ddua6n1rihl9h.example.org

in zone file

[tptacek]

Right. That doesn't really work: you can crack them like a 1990s password file, which is why there's whitelies (online-signer chaff records) to defeat that attack. Either way: it's not really what people think about when they think "privacy". It's generally the position of the architects of DNSSEC that domain names simply aren't private at all. Meanwhile: actual DNS privacy, of what domains you're visiting with your browser, is provided by DoH, not DNSSEC.

[Fnoord]

IIRC the protocol is also a nightmare for potential reflection DDoS attacks.

Also, the security chain is top-down, from owner of the TLD to the domain to the resolver to the client. With DNS over TLS and DNSCurve, you have it the other way around.