Barbara Jantzen of deSEC has published a review of common arguments about DNSSEC, covering its complexity, purpose and broader value. The article also draws on the IANIX list, a maintained record of DNSSEC-related outages across the namespace.
One argument against DNSSEC is that TLS already secures website connections. Jantzen’s review counters that browsers must first use DNS to find a destination. If that lookup is redirected, a user may reach a different site; without strong certificate pinning, an attacker could still obtain a TLS connection backed by a certificate authority. Homograph attacks can further make a destination appear trustworthy.
DNSSEC adds a layer that TLS alone does not provide: signed, verifiable evidence of origin for information published by a domain holder. According to Jantzen, that can underpin applications such as DANE and CAA/TLS.
The review addresses two wider concerns: the potential for state control over access to information and the fact that DNSSEC deployment remains incomplete. Jantzen acknowledges that state controls are a real concern, but argues that they arise from broader legal and social frameworks rather than from DNSSEC itself. On adoption, she notes that incomplete deployment is not resolved by avoiding deployment, pointing to IPv6 and RPKI as technologies that took time to reach useful levels of uptake.
Jantzen’s article concludes with more than 60 endorsements from people across the DNS ecosystem, including providers, registries, registrars, oversight bodies, researchers and standards participants.
Sources: APNIC Blog.