<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>I found this RFC <a class="moz-txt-link-freetext" href="https://www.rfc-editor.org/info/rfc9076">https://www.rfc-editor.org/info/rfc9076</a> pretty
interesting as it covers all topics related to DNS privacy,
including the need to prepare for quantum-resistant algorithms and
encrypting DNS traffic ... I guess the author is not only
referring to resolver traffic that should use DoT instead of
plaintext UDP/53 , but also zone transfers over the Internet
encrypted with TLS (thus the reference to certificates).<br>
</p>
<p>
</p>
<p class="p1">-Carlos<br>
</p>
<p>
<style type="text/css">p.p1 {margin: 0.0px 0.0px 0.0px 0.0px; font: 14.0px '.AppleSystemUIFont'; color: #0e0e0e}</style></p>
<p>
<style type="text/css">p.p1 {margin: 0.0px 0.0px 0.0px 0.0px; font: 14.0px '.AppleSystemUIFont'; color: #0e0e0e}</style></p>
<div class="moz-cite-prefix">On 27/01/2025 14:02, Carlos Horowicz
via bind-users wrote:<br>
</div>
<blockquote type="cite"
cite="mid:73ac9264-088c-4b0f-b397-77434b758666@planisys.com">IMHO
this has nothing to do with DNSSEC, it sounds more like the urge
to encrypt resolver traffic (I guess they're referring to DoT)
<br>
<br>
On 27/01/2025 13:55, Marc wrote:
<br>
<blockquote type="cite">
<blockquote type="cite">FYI - EO 14144 has the following
provision related to encrypting DNS:
<br>
<br>
(c) Encrypting Domain Name System (DNS) traffic in transit is
a critical
<br>
step to protecting both the confidentiality of the information
being
<br>
transmitted to, and the integrity of the communication with,
the DNS
<br>
resolver.
<br>
(i) Within 90 days of the date of this order, the Secretary
of
<br>
Homeland Security, acting through the Director of CISA, shall
publish
<br>
template contract language requiring that any product that
acts as a DNS
<br>
resolver (whether client or server) for the Federal Government
support
<br>
encrypted DNS and shall recommend that language to the FAR
Council.
<br>
Within 120 days of receiving the recommended language, the FAR
Council
<br>
shall review it, and, as appropriate and consistent with
applicable law,
<br>
the agency members of the FAR Council shall jointly take steps
to amend
<br>
the FAR. (ii) Within 180 days of the date of this order, FCEB
agencies
<br>
shall enable encrypted DNS protocols wherever their existing
clients and
<br>
servers support those protocols. FCEB agencies shall also
enable such
<br>
protocols within 180 days of any additional clients and
servers
<br>
supporting such protocols.
<br>
....
<br>
</blockquote>
Disclaimer, not really an dns expert
<br>
<br>
What is this referring to DNSSEC? Afaik is just signing traffic
not? What is the point of encrypting data with the current
implementation of certificates. Even google does not trust CA's
with it's certificate pinning.
<br>
<br>
<br>
</blockquote>
</blockquote>
</body>
</html>