https://blogs.damiendye.uk/en/categories/dns/ Recent content in Dns on Damien Dye's Blog Hugo en-GB Sun, 27 Sep 2026 18:00:00 +0100 https://blogs.damiendye.uk/en/dns/dnssec-the-root-is-signed-you-are-not/ Sun, 27 Sep 2026 18:00:00 +0100 https://blogs.damiendye.uk/en/dns/dnssec-the-root-is-signed-you-are-not/ Counted from the live root zone: 1,351 of 1,438 TLDs are signed, every single gTLD among them. Then it stops. 39 of 2,390 live gov.uk domains, 1 of 9 certificate authorities, and windowsupdate.com has no DS at all. What DNSSEC stops, what is really blocking it, and whether the problem is that we still do not understand DNS. https://blogs.damiendye.uk/en/dns/resolved-the-resolver-you-are-already-running/ Sun, 27 Sep 2026 09:00:00 +0100 https://blogs.damiendye.uk/en/dns/resolved-the-resolver-you-are-already-running/ systemd-resolved is on most Linux desktops, caching every lookup and validating none of them. What the stub on 127.0.0.53 does, measured cache figures, turning DNSSEC on, why DNS over TLS works but DNS over HTTPS does not exist, what Fedora, Ubuntu, Debian and RHEL each ship, and why you almost certainly do not need a custom build. https://blogs.damiendye.uk/en/dns/dns-over-https-walks-past-your-controls/ Thu, 24 Sep 2026 09:00:00 +0100 https://blogs.damiendye.uk/en/dns/dns-over-https-walks-past-your-controls/ DoH sends your DNS lookup to a resolver of the client's choosing on port 443, which your own resolver never sees, so it cannot block a bad name or log it. Sold as privacy, but DoT gave you that in 2016. What DoH really adds is bypassing the network admin. The mechanism, the malware, who pushed it, the courts now suing the resolvers, and the fix. https://blogs.damiendye.uk/en/dns/who-actually-controls-dns/ Tue, 25 Aug 2026 14:00:00 +0100 https://blogs.damiendye.uk/en/dns/who-actually-controls-dns/ The root of the internet is a 1.5 MB text file. Who edits it, who signs it, and what ICANN has done with the power to decide what goes in it. https://blogs.damiendye.uk/en/dns/what-happened-at-nominet/ Tue, 25 Aug 2026 13:00:00 +0100 https://blogs.damiendye.uk/en/dns/what-happened-at-nominet/ The .uk registry is owned by its members. In March 2021 they voted half the board out. This is what the estate looked like from inside, and how a registry with no regulator ended up being disciplined by the only people who could. https://blogs.damiendye.uk/en/dns/samba4-securing-ad-records-with-dnssec/ Mon, 24 Aug 2026 09:00:00 +0100 https://blogs.damiendye.uk/en/dns/samba4-securing-ad-records-with-dnssec/ Every domain-joined machine finds its DC by asking DNS for an SRV record, so the _msdcs locators are the most security-critical records you have. Signing them from a Samba4 DC: BIND with dlz_bind9, inline signing, a hidden primary, dynamic updates kept out of the locator zone, then forcing Windows and Linux clients to validate the signatures.