At CircleID, Barbara Jantzen from deSEC has written a detailed review of the issues surrounding DNSSEC deployment. We’ve heard from deSEC before at APNIC, with Peter Thomassen presenting twice on PING, once on key drift between parent and child, and again on post-quantum cryptography in DNSSEC.
Barbara’s post reviews common myths and misconceptions about DNSSEC. She examines its complexity, role, and broader social utility. A significant part of the discussion centres on the IANIX list, an actively maintained record of DNSSEC-related outages across the namespace.
A persistent line of reasoning argues that because website security is delivered through the TLS certificate used in an HTTP connection, DNSSEC adds little or no value. This could not be further from the truth. Before a browser can validate a TLS certificate, it must first resolve the destination name through DNS. DNS is part of the path to the endpoint that presents the certificate.
If an intermediary can redirect that DNS query, the user may be sent somewhere else entirely. Unless certificate pinning is strongly enforced, an adversary could still establish a certificate authority-backed TLS connection. Homograph attacks can also be used to undermine trust in the intended destination.
As Barbara writes:
DNSSEC provides a much needed capability that TLS/HTTPS alone does not: It delivers signed, verifiable proof of origin for anything a registrant publishes, independently of any single application or delivery method. As such, it is a key enabling technology that lays a highly effective trust foundation on which applications such as DANE or CAA/TLS can rely to protect Internet users.
Common Beliefs About DNSSEC Put to the Test
Much of the opposition to DNSSEC appears to come from two concerns. The first is the possibility of top-down state control over access to information. The second is that DNSSEC deployment remains incomplete. Neither concern can be dismissed entirely. State control of Internet access is a real part of many people’s lived experience.
However, jurisdictional controls on content, websites, and Internet services are not rooted in DNSSEC. These controls exist within broader legal and social frameworks, regardless of whether DNSSEC is deployed. The argument against DNSSEC often overlooks that wider context.
Partial deployment is a different problem. No deployment challenge is solved by choosing not to deploy. The history of IPv6 and Resource Public Key Infrastructure (RPKI) shows how long it can take for technologies to reach useful levels of adoption and critical mass.
Barbara concludes with more than 60 endorsements from practitioners across the DNS ecosystem, including providers, registries, registrars, oversight bodies, researchers, and standards participants.
Barbara’s article is a useful challenge to some of the assumptions that continue to shape the DNSSEC debate. Whether you agree with every argument or not, it is worth reading the original article and considering the evidence behind those assumptions.
The views expressed by the authors of this blog are their own and do not necessarily reflect the views of APNIC. Please note a Code of Conduct applies to this blog.