Suppose someone is trying to secure a transaction with
"www.example.com". In practice, they will use some form of end-to-end
security, TLS or SSL, as in "https://www.example.com". The end to end
security should provide a proof that they are communicating with the
real "www.example.com".

In these conditions, what is the point of securing the DNS look-up? The
end-to-end verification of the certificate will validate it.
Certificates allow for third party signature, and thus are somewhat
easier to deploy than a strict hierarchical scheme. The verification
will not implicitly validate the mapping of name to address. It will
also protect against routing attacks that might divert the traffic to a
bogus site, an attack not addressed by securing the DNS look-up.

End-to-end security mitigates a spoofing attack and reduces it to a
denial of service attack. If the name to address mapping was wrong, or
unavailable, or if the routing was bogus, the secure transaction will
simply not happen. The focus of DNS security should thus be a protection
against DOS attacks, i.e. ensure that if a record exists, it will be
found.

-- Christian Huitema

--
to unsubscribe send a message to namedroppers-requ...@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>