Integration of DNSSEC

[rugk]

A DNSSEC verification by default would be a nice thing to have.

Also some DNSCrypt servers (see #2341) offer DNSSEC. Of course, however, if you trust the DNSCrypt server enough, you do not have to verify DNSSEC, but yeah I know... Qubes OS trust's nobody. 😄

[andrewdavidwong]

Which Qubes component(s) are you proposing that DNSSEC be implemented in?

[andrewdavidwong]

Which Qubes component(s) are you proposing that DNSSEC be implemented in?

[rugk]

The local DNS resolver if there is already one...

Basically the aim is that all applications use a local DNS server (You know, never trust something outside of the device) and that this DNS resolver uses DNSSEC to verify the DNS responses.

As said this is best combined with #2341.

[rugk]

The local DNS resolver if there is already one...

Basically the aim is that all applications use a local DNS server (You know, never trust something outside of the device) and that this DNS resolver uses DNSSEC to verify the DNS responses.

As said this is best combined with #2341.

[adrelanos]

https://wiki.debian.org/DNSSEC

On Debian DNSSEC can be made to work by installing dnssec-trigger. But I don't know what it actually does. If it uses the user's ISP DNS server and just enables DNSSEC or uses some alternative DNS server.

[adrelanos]

https://wiki.debian.org/DNSSEC

On Debian DNSSEC can be made to work by installing dnssec-trigger. But I don't know what it actually does. If it uses the user's ISP DNS server and just enables DNSSEC or uses some alternative DNS server.

[rugk]

I think the dns server should/is not be changed automatically.

[rugk]

I think the dns server should/is not be changed automatically.