DNSSEC is very cool. It secures DNS preventing cache poisoning attacks and it allows you to generate trustworthy SSL certificates bound to your domain name at zero cost. We all hate the snake oil SSL certificate sellers don't we?

I look around and nobody using DNSSEC yet. Why? Use it people, it's great!


For an easy introduction I recommend this book:
https://www.michaelwlucas.com/nonfiction/dnssec-mastery


Or... Does nobody run their own DNS servers anymore?

+1

_________________

/* TODO: need to add signature to posts */

I run my own DNS servers, and I have signed all the domains that my registrar(s) allow me to upload a DS/KSK for.

BIND's inline-signing feature <3.

Sadly I'm having to change registrar just to upload my DS records. Most registrars are really dragging their feet on DNSSEC.

BIND managed keys are very nice.

Considering moving my domains to a new registrar for this exact reason. Which domain registrar did you go with in the end? I'm thinking of moving to Gandi.net.