DNSSEC is not validated

0xERR0R / blocky

Fast and lightweight DNS proxy as ad-blocker for local network with many features

https://0xERR0R.github.io/blocky/

Apache License 2.0

4.6k stars 202 forks source link

DNSSEC is not validated #1287

Open onovy opened 9 months ago

onovy commented 9 months ago

Hi,

according to README, blocky supports DNSSEC. This is only "half-true". Blocky support RRSIG/etc records, but doesn't validate DNSSEC trust chain at all. It just trust validation done by upstream resolver, which is not secure enough.

Used dns library doesn't do validation per-se (confirmed by author), but it can be added. For inspiration how to do validation correctly, see sdns which uses same dns library.

starsoccer commented 5 months ago

Bump on this would love to see support for it