DEV-TOOLSMarch 15, 20261 min read18 views

Cert Authorities Check for DNSSEC from Today

Starting today, all Certificate Authorities (CAs) are mandated to validate DNSSEC for any domain where it is enabled, enhancing security during the certificate issuance process.

About 14 years ago I set up DNSSEC. I've been running it on all of my domains ever since, without issue. First using bind9 and then later using PowerDNS.

From today, all Certificate Authorities (CAs) must validate DNSSEC when a domain has it enabled.

So from today, when a CA looks up my CAA record to see if they are allowed to issue a cert for one of my domains, they must validate that the response they received is valid. And during the ACME dance, they have to validate those DNS records too.

I assume that all CA's had implemented this requirement prior to today, if only so they could test it before the deadline was reached. But now it is mandatory, and I expect that any evidence that they are not doing it will be treated harshly.

You might not want to learn about DNSSEC. You probably don't host your own DNS zone. There's a reasonable chance you own your own domain name though if you're here reading this. Why not go find out if your registrar supports DNSSEC for your domains? It might be a one click operation to turn it on...

Source: Hacker News

More in this category

dev-tools

Linux kernel will support $ORIGIN, sort of

Farid Zakaria shares his journey of proposing a patch to the Linux kernel to support relocatable binaries in Nix, which evolved into a powerful eBPF-based solution for binfmt_misc.

dev-tools

Five US tech giants' hidden debts soar to $1.65T on opaque AI funding

A Nikkei study reveals that off-balance-sheet debts at five major US tech companies have surged eightfold to $1.65 trillion, driven by massive AI investments like data center leases and GPU contracts.

dev-tools

Running Doom on Our Custom CPU and Going Viral

Two developers successfully built a custom CPU from scratch at the logic gate level, deployed it on an FPGA, and optimized its memory architecture to run the classic game DOOM.

dev-tools

Incremental – A library for incremental computations

Incremental is a library designed for building complex computations that update efficiently when inputs change. Inspired by self-adjusting computation research, it is highly useful for large-scale calculations, GUI views, and data synchronization.

dev-tools

Flock Credibility Lost as It Repeatedly Lies to City Councils, Police, & Public

Flock Safety, a prominent provider of automatic license plate readers (ALPR), is facing a severe credibility crisis after being caught repeatedly misleading city councils, police departments, and the public about its surveillance capabilities and data practices.

dev-tools

Human mathematicians are being outcounterexampled

In just a few weeks, advanced AI models like ChatGPT Sol and Claude Fable have disproved long-standing mathematical conjectures by finding precise counterexamples and auto-formalizing them in Lean.