-
Notifications
You must be signed in to change notification settings - Fork 2.1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
dnsmasq: enable DNSSEC build option by default #50904
Comments
Dnsmasq is already being compiled with DNSSEC support. It just isn't enabled by default. See #41786. I am not entirely sure if it's worth it to enable DNSSEC by default and potentially breaking somebodys workflow |
I am going to disagree with you there. I get this error when setting the dnssec option in dnsmasq.conf
My dnsmasq.conf file:
I took a look at the template file. I see the build option to build with DNSSEC support, but apparently that is not happening. From the template:
What calls that build option to be set? |
I see no reason dnsmasq should not be built with DNSSEC support.
https://www.icann.org/resources/pages/dnssec-what-is-it-why-important-2019-03-05-en
At present even when forwarding DNS requests to, for example, 9.9.9.9 or 1.1.1.1 caching nameservers with DNSSEC support, the result on the local network is no DNSSEC protection.
For example, if you try to get an IP using dig or any other method of dnssec-failed.org, it should not return a ping because the DNSSEC is signed with an invalid key. If your system returns an IP address for this domain name, you are at risk of DNS poisoning.
The text was updated successfully, but these errors were encountered: