No, 50 of the <i>root domains</i> now support DNSSEC. Nothing resembling 50%, 5%, or .5% of the Internet uses DNSSEC. Nor will it ever.<p>DNSSEC is a bad idea. It provides very little value. It drastically complicates the Internet. It bakes the worst part of TLS --- the static tree PKI --- into the core design of the Internet... and then gives the root of the tree to the US government. It's clunky, it uses antiquated crypto (its proponents have been trying to standardize it since 1995), and it leaks your private hostnames to the Internet.<p>I can go on and on and on. Instead, here's some older posts I've written about it:<p><a href="https://news.ycombinator.com/item?id=5571937" rel="nofollow">https://news.ycombinator.com/item?id=5571937</a><p><a href="https://news.ycombinator.com/item?id=4071178" rel="nofollow">https://news.ycombinator.com/item?id=4071178</a><p><a href="https://news.ycombinator.com/item?id=2932378" rel="nofollow">https://news.ycombinator.com/item?id=2932378</a>
DNSSEC basically has all the problems of SSL registrars with almost no user-facing of the benefits - it's still a centralized system that could be overridden by a registrar hack or state level strong-arming, and very few end user systems support actually doing anything when DNSSEC signed records don't verify.<p>If you think users are confused by SSL warnings now, how the heck would they understand similar errors at the DNS resolver level?<p>Also, there's no-in flight encryption, so it offers no privacy benefit. It also aggravates DNS amplification attacks.<p>The better technology to look into if you're concerned about individual user rights and privacy is DNSCurve: <a href="http://dnscurve.org" rel="nofollow">http://dnscurve.org</a><p>It's not comparable to DNSSEC other than "It uses crypto with DNS" - they have entirely different goals, but the goals it solves are much more relevant to end users (privacy, forgery, etc.).<p>Personally, I'd recommend people run both techs, as there's no technical reason that makes them incompatible.<p>I have no idea how to solve the UI problems. We've had 15+ years of SSL and there's been almost no progress on that.
Can one of you knowledgable HNers tell me how I, as a dude who owns some domains and occasionally uses DNS to point them somewhere can get on board with this? Or is something that can only be implemented if you're hosting your own DNS?
It used to be possible to get HTTPS on Chrome, without warning, without getting certificates from CA, by using DNSSEC. Nobody used it so it was removed.<p><a href="https://www.imperialviolet.org/2011/06/16/dnssecchrome.html" rel="nofollow">https://www.imperialviolet.org/2011/06/16/dnssecchrome.html</a>