[efesak]

> DNSSEC is Expensive To Adopt/Deploy

I live in .cz domain and almost every registrar there have DNSSEC in one click (without changing price) - adoption here is 40%! - see https://stats.nic.cz/stats/domains_by_dnssec/ and I am not experiencing any mentioned problems at all

Maybe DNSSEC is not best DNS proto in the world, but these arguments are not entirely based on facts.

[tptacek]

This is like saying "TLS is easy if you just let GoDaddy manage your keys for you".

[eltrai]

So ?

It might be worse than securing it yourself, but it's still way better than no security at all.

[xorcist]

Incorrect. You don't have to let CZ.NIC manage your keys for you.

[xenophonf]

That's not what he's saying. DNSSEC is a pain in the ass to operate on your own, and that's with guides like http://users.isc.org/~jreed/dnssec-guide/dnssec-guide.html (which is itself relatively new). BIND, at least, has a lot of bad defaults (e.g., NSEC), and the docs make poor recommendations about algorithms and key sizes (SHA-1? 1024-bit RSA keys? and what's this about RSA being depreciated after September 2015?)---even NIST's guidelines make stronger recommendations than that (http://csrc.nist.gov/publications/nistpubs/800-131A/sp800-13..., and that still has Dual EC DRBG on the books). Furthermore, ISC's guide downplays the importance of DNSSEC on private networks, which is probably the most important (in terms of opsec) and most difficult (in terms of complexity) place to implement it.

DNSSEC doesn't offer any privacy guarantees, either, so at this point DNSSEC doesn't really do much for me.

[xorcist]

That's not what I am saying at all.

I am saying "almost every registrar [in .cz] have DNSSEC in one click (without changing price)" is nothing like "letting GoDaddy manage your keys for you".

The first is a matter of cost. The second a matter of convenience.

It's not at all like letting a third party manage your keys in any reasonable way to interpret it.