5月 192014
 

DNSSEC only attempts to provide security, without even any attempts at providing any privacy.

DNSCurve provides both security and privacy.

At the point of a recursive DNS resolver (e.g. Comcast and OpenDNS in your question), the question comes down to whether at least one of these technologies is deployed by the authoritative nameservers of the domain names for which the resolutions are made, and by the whole recursive path needed for the resolution. This point ensures that Comcast/OpenDNS servers themselves would be getting legitimate resolutions from elsewhere in the internet.

However, before their servers could get around to do any resolutions on your behalf, you have to send them your request.

If you don’t yourself use any software that is savvy in DNSSEC or DNSCurve, then all bets are off.

With DNSCurve and the DNSCrypt client from OpenDNS, all your queries are encrypted through DNSCurve, and only OpenDNS can see the actual content, and provide a valid reply.

With DNSSEC, you might also have to use something like a local_unbound in FreeBSD. I’m not entirely sure how it works yet — it has only been imported a couple of weeks ago, and documentation is somewhat lacking, but I think it supports forwarding traffic to other recursive servers like the one of Comcast (with forward-addr keyword), where it would supposedly also ensure that DNSSEC validation is taking place.

As such, your question is not specific enough to know your objective; however, it would seem like you’re using OpenDNS for a reason, and simply changing your nameserver back to Comcast would not offer any benefits in regards to security.

However, if you’re already using OpenDNS, then you should most certainly consider embracing their DNSCrypt client.

 回复

您可以使用这些 HTML 标签和属性: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>