Building consensus over DNSSEC enhancements to glibc.

[Paul Wouters]

On 11/18/2015 11:35 AM, Rich Felker wrote:

> The smarter approach is to just always treat all networks as
> untrusted. Even if they're intended to be trusted, trusting them in
> ways you don't need to greatly expands the impact of any compromise.
> Do you really want a compromised host somewhere on your network (which
> is able to do arp poisoning and thereby fake dns results) to be able
> to make you accept a forged certificate via forged TLSA results? You
> can still use a centralized cache on your network but do the actual
> signature verifications on the endpoint.

Yes, but the distinction between hosts and network is rather flexible these days. A container or VM with just a database in it should not need  dns resolver.
If you run 1000 VM's on a host, you want to use the host as DNS server instead of running 1000 DNS servers.

Applications that would still wish to do validation themselves can do so. And my draft is supposed to make that easier by using a single query and a throwaway
cache: https://tools.ietf.org/html/draft-ietf-dnsop-edns-chain-query-05

Paul