[pocksuppet]

Summary: it's not DNSSEC itself, it's DNS providers like Cloudflare returning incorrect data to make responses shorter and avoid switching to TCP. A DNSSEC signature for "this domain doesn't exist" is much longer than a DNSSEC signature for "this domain exists, but doesn't have the type of record you asked for" so these providers choose to always return the latter type of answer. Since the server is telling you the domain exists, policies about what to do when the domain doesn't exist don't apply.

tptacek incoming in 3...2...1...

[growse]

> Summary: it's not DNSSEC itself, it's DNS providers like Cloudflare returning incorrect data to make responses shorter and avoid switching to TCP.

I feel like we need the angry goose meme here.

"But why are those providers returning incorrect data?"

[jeroenhd]

> "But why are those providers returning incorrect data?"

In this case, because they decided actually implementing the protocol they were supposed to be implementing didn't work for their hacky design, so they hacked together a series of Good Enough workarounds.

These cloud companies are the Microsoft Internet Explorer of DNS service but unlike IE6 they're considered cool enough that they're tolerated.

[teddyh]

Cloudflare is well known for breaking DNS standards whenever they feel like it; they’re too big to ignore, so they get away with murder.

[pocksuppet]

How did they get this way, anyway? Let's say that I want half the world to sign up for me to MITM their traffic. How would I achieve that?

[teddyh]

Solve a DDoS problem by positioning yourself as the middleman (instead of designing new protocols without the vulnerability).

[cdmckay]

So you’re cool with letting anyone walk your DNS?

[phicoh]

The problem here is that computing three 3 NSEC3 records as you might need to return an NXDOMAIN was considered too expensive. It's just a choice to reduce their costs while increasing complexity for everyone else.

[phicoh]

At the time it was well known that messing around with NXDOMAIN would cause problems. But some companies wanted to do it anyhow.

The solution is simple, if you want to use this DMARC feature then don't host with companies that do weird stuff with NXDOMAIN.

[woodruffw]

> A DNSSEC signature for "this domain doesn't exist" is much longer than a DNSSEC signature for "this domain exists, but doesn't have the type of record you asked for" so these providers choose to always return the latter type of answer

This seems like a major design flaw in DNSSEC, if so.

(I don’t have an opinion on whether Cloudflare or whoever else is a good participant in the DNS.)

[formerly_proven]

Most of the time people are not asking for domains which don't resolve. Also, think about what DNSSEC is actually having to do when signing an NXDOMAIN. It needs to prove a negative with offline signing keys, DNSSEC does this by basically making a linked list of each zone and signing the links.

[tptacek]

It's doing that because the protocol was designed for offline signers, which in turn was a result of a folk belief in the 1990s that computers wouldn't be fast enough to do online signing.

[pocksuppet]

Was it really nothing to do with keeping keys safer offline?

[tptacek]

Go read the mailing lists of the time.

[phicoh]

A linked list of each authoritative name in the zone. Not a list of zones.

That's for offline signing. For online signing you can do different things.

But the point is, and that's what this discussion is about is that DNSSEC can evolve. It can get extra features to make online signing more efficient.

The problem is that getting all validating recursive resolvers and other validators to update takes a very long time, on the order of decades.

So we got this problem because people started using this feature without verifying that validator support had spread wide enough.

[tptacek]

At this point, with this microscopic level of adoption and this track record of instability, and given that we're now 4 major revisions (all premised on the same original service model that TIS came up with in the mid-1990s), it would make a lot more sense to go back to the drawing board.

That's basically what we did with DoH, a protocol that has drastically more deployment than DNSSEC and a more coherent threat model.

The simplest and most obvious thing you could do, if you were being parsimonious about it, would be to switch to an online-signer model. With modern (circa 2005) cryptography, you'd do a straightforward client/server authenticated denial without any of the record-chaining silliness. A big chunk of the complexity of the protocol would just vanish.