1<!DOCTYPE html> 2<html lang="en-us"> 3 4<head> 5 <meta charset="utf-8"> 6 <meta name="viewport" content="width=device-width, initial-scale=1"> 7 <meta name="robots" content="noodp" /><title>Please Use DNSSEC - AdamStas.com - Home of Adam Stasiniewicz</title><meta name="Description" content="Home of Adam Stasiniewicz"><meta property="og:url" content="https://www.adamstas.com/please-use-dnssec/"> 8 <meta property="og:site_name" content="AdamStas.com - Home of Adam Stasiniewicz"> 9 <meta property="og:title" content="Please Use DNSSEC"> 10 <meta property="og:description" content="The other day I was reading about yet another DNS vulnerability. Vulnerabilities in DNS have been well known since 2008, and since 2010 weâve had an excellent solution, DNSSEC. DNSSEC addresses many of the most common DNS vulnerabilities on the internet today (including this most recent vulnerability). For most, setup is very simple. Unfortunately, DNSSEC is an opt-in technology. So, itâs a good time to remind all my Internet friends that todayâs a good day to double-check if you have DNSSEC enabled, and if you donât, to make plans to enable it."> 11 <meta property="og:locale" content="en_us"> 12 <meta property="og:type" content="article"> 13 <meta property="article:section" content="posts"> 14 <meta property="article:published_time" content="2025-11-11T21:20:15+00:00"> 15 <meta property="article:modified_time" content="2025-11-11T21:20:15+00:00"> 16 <meta property="og:image" content="https://www.adamstas.com/android-chrome-512x512.png"> 17 18 <meta name="twitter:card" content="summary_large_image"> 19 <meta name="twitter:image" content="https://www.adamstas.com/android-chrome-512x512.png"> 20 <meta name="twitter:title" content="Please Use DNSSEC"> 21 <meta name="twitter:description" content="The other day I was reading about yet another DNS vulnerability. Vulnerabilities in DNS have been well known since 2008, and since 2010 weâve had an excellent solution, DNSSEC. DNSSEC addresses many of the most common DNS vulnerabilities on the internet today (including this most recent vulnerability). For most, setup is very simple. Unfortunately, DNSSEC is an opt-in technology. So, itâs a good time to remind all my Internet friends that todayâs a good day to double-check if you have DNSSEC enabled, and if you donât, to make plans to enable it."> 22<meta name="application-name" content="AdamStas.com"> 23<meta name="apple-mobile-web-app-title" content="AdamStas.com"> 24 25<meta name="theme-color" content="#f8f8f8"><meta name="msapplication-TileColor" content="#da532c"><link rel="shortcut icon" type="image/x-icon" href="/favicon.ico" /> 26 <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png"> 27 <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png"><link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png"><link rel="mask-icon" href="/safari-pinned-tab.svg" color="#5bbad5"> 28 29<link rel="canonical" href="https://www.adamstas.com/please-use-dnssec/" /><link rel="prev" href="https://www.adamstas.com/infineon-yubikey-cloning-vulnerability/" /> 30<link rel="stylesheet" href="/css/main.min.css"><link rel="stylesheet" href="/css/style.min.css">
30<script type="application/ld+json">{"@context": "https://schema.org","@type": "BlogPosting", 31 "headline": "Please Use DNSSEC", 32 "inLanguage": "en-us", 33 "mainEntityOfPage": { 34 "@type": "WebPage", 35 "@id": "https://www.adamstas.com/please-use-dnssec/" 36 },"genre": "posts","wordcount": 441 , 37 "url": "https://www.adamstas.com/please-use-dnssec/","datePublished": "2025-11-11T21:20:15+00:00","dateModified": "2025-11-11T21:20:15+00:00","publisher": { 38 "@type": "Organization", 39 "name": ""},"author": { 40 "@type": "Person", 41 "name": "Adam Stasiniewicz", 42 "url": "https://www.adamstas.com" 43 },"description": "" 44 }</script>
44</head> 45 46 47<body data-instant-intensity="viewport" class="tw-flex tw-min-h-screen tw-flex-col">
47<script> 48 function setTheme(theme) { 49 document.body.setAttribute('theme', theme); 50 document.documentElement.className = theme; 51 document.documentElement.style.setProperty('color-scheme', theme === 'light' ? 'light' : 'dark'); 52 if (theme === 'light') { 53 document.documentElement.classList.remove('tw-dark') 54 } else { 55 document.documentElement.classList.add('tw-dark') 56 } 57 window.theme = theme; 58 window.isDark = window.theme !== 'light' 59 } 60 function saveTheme(theme) {window.localStorage && localStorage.setItem('theme', theme);} 61 function getMeta(metaName) {const metas = document.getElementsByTagName('meta'); for (let i = 0; i < metas.length; i++) if (metas[i].getAttribute('name') === metaName) return metas[i]; return '';} 62 if (window.localStorage && localStorage.getItem('theme')) { 63 let theme = localStorage.getItem('theme'); 64 if (theme === 'light' || theme === 'dark') { 65 setTheme(theme); 66 } else { 67 if ((window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches)) { 68 setTheme('dark'); 69 } else { 70 setTheme('light'); 71 } 72 } 73 } else { 74 if ('auto' === 'light' || 'auto' === 'dark') 75 setTheme('auto'), saveTheme('auto'); 76 else saveTheme('auto'), window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches ? setTheme('dark') : setTheme('light'); 77 } 78 let metaColors = {'light': '#f8f8f8','dark': '#161b22'} 79 getMeta('theme-color').content = metaColors[document.body.getAttribute('theme')]; 80 window.switchThemeEventSet = new Set() 81</script>
81<div id="back-to-top"></div> 82 <div id="mask"></div><header class="desktop print:!tw-hidden" id="header-desktop"> 83 <div class="header-wrapper"> 84 <div class="header-title"> 85 <a href="/" title="AdamStas.com - Home of Adam Stasiniewicz"><img class="tw-inline tw-align-text-bottom tw-mr-1" src='/android-chrome-512x512.png' alt="AdamStas.com" height="32" width="32">AdamStas.com</a> 86 </div> 87 <div class="menu"> 88 <div class="menu-inner"><a class="menu-item" 89 href="/contact/" > Contact </a><a class="menu-item" 90 href="/about/" > About </a><span class="menu-item delimiter"></span><button class="menu-item theme-select" aria-label="Switch Theme"> 91 <svg class="icon" 92 xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512"><!-- Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) --><path d="M8 256c0 136.966 111.033 248 248 248s248-111.034 248-248S392.966 8 256 8 8 119.033 8 256zm248 184V72c101.705 0 184 82.311 184 184 0 101.705-82.311 184-184 184z"/></svg> 93 <select class="color-theme-select" id="theme-select-desktop" aria-label="Switch Theme"> 94 <option value="light">Light</option> 95 <option value="dark">Dark</option> 96 <option value="auto">Auto</option> 97 </select> 98 </button></div> 99 </div> 100 </div> 101</header><header class="mobile print:!tw-hidden" id="header-mobile"> 102 <div class="header-container"> 103 <div class="header-wrapper"> 104 <div class="header-title"> 105 <a href="/" title="AdamStas.com - Home of Adam Stasiniewicz"><img class="tw-inline tw-align-text-bottom tw-mr-1" src='/android-chrome-512x512.png' alt="AdamStas.com" height="32" width="32">
105AdamStas.com</a> 106 </div> 107 <div class="menu-toggle" id="menu-toggle-mobile"> 108 <span></span><span></span><span></span> 109 </div> 110 </div> 111 <div class="menu" id="menu-mobile"><a class="menu-item" href="/contact/" title="" >Contact</a><a class="menu-item" href="/about/" title="" >About</a><button class="menu-item theme-select tw-w-full" aria-label="Switch Theme"> 112 <svg class="icon" 113 xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512"><!-- Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) --><path d="M8 256c0 136.966 111.033 248 248 248s248-111.034 248-248S392.966 8 256 8 8 119.033 8 256zm248 184V72c101.705 0 184 82.311 184 184 0 101.705-82.311 184-184 184z"/></svg> 114 <select class="color-theme-select" id="theme-select-mobile" aria-label="Switch Theme"> 115 <option value="light">Light</option> 116 <option value="dark">Dark</option> 117 <option value="auto">Auto</option> 118 </select> 119 </button></div> 120 </div> 121</header> 122<div class="search-dropdown desktop"> 123 <div id="search-dropdown-desktop"></div> 124</div> 125<div class="search-dropdown mobile"> 126 <div id="search-dropdown-mobile"></div> 127</div><main class="tw-mx-4 tw-flex-1"><dialog id="toc-dialog" class="tw-max-w-full tw-w-full tw-max-h-full tw-h-full tw-ml-16"> 128 <div class="toc tw-mx-4 tw-max-w-full"> 129 <h2 class="tw-mx-0 tw-my-6 tw-uppercase tw-text-2xl">Contents</h2> 130 <div class="toc-content"><nav id="TableOfContents"></nav></div> 131 </div> 132 </dialog>
132<script>document.getElementsByTagName("main")[0].setAttribute("autoTOC", "false")</script>
132<article class="page single print:!tw-w-full print:!tw-max-w-none print:!tw-m-0 print:!tw-p-0"><h1 class="single-title" data-pagefind-meta="date:2025-11-11" data-pagefind-body>Please Use DNSSEC</h1><div class="post-meta"> 133 <div class="post-meta-line"> 134 <span class="post-author"><img class="tw-inline-block tw-max-h-4 tw-rounded-full tw-translate-y-[-2px] tw-mr-1" src='/android-chrome-512x512.png' alt="Adam Stasiniewicz avatar" height="16" width="16"><a href="https://www.adamstas.com" title="Author" target="_blank" rel="noopener noreferrer author" class="author">Adam Stasiniewicz</a> 135 </span></div> 136 <div class="post-meta-line"><svg class="icon" 137 xmlns="http://www.w3.org/2000/svg" viewBox="0 0 448 512"><!-- Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) --><path d="M148 288h-40c-6.6 0-12-5.4-12-12v-40c0-6.6 5.4-12 12-12h40c6.6 0 12 5.4 12 12v40c0 6.6-5.4 12-12 12zm108-12v-40c0-6.6-5.4-12-12-12h-40c-6.6 0-12 5.4-12 12v40c0 6.6 5.4 12 12 12h40c6.6 0 12-5.4 12-12zm96 0v-40c0-6.6-5.4-12-12-12h-40c-6.6 0-12 5.4-12 12v40c0 6.6 5.4 12 12 12h40c6.6 0 12-5.4 12-12zm-96 96v-40c0-6.6-5.4-12-12-12h-40c-6.6 0-12 5.4-12 12v40c0 6.6 5.4 12 12 12h40c6.6 0 12-5.4 12-12zm-96 0v-40c0-6.6-5.4-12-12-12h-40c-6.6 0-12 5.4-12 12v40c0 6.6 5.4 12 12 12h40c6.6 0 12-5.4 12-12zm192 0v-40c0-6.6-5.4-12-12-12h-40c-6.6 0-12 5.4-12 12v40c0 6.6 5.4 12 12 12h40c6.6 0 12-5.4 12-12zm96-260v352c0 26.5-21.5 48-48 48H48c-26.5 0-48-21.5-48-48V112c0-26.5 21.5-48 48-48h48V12c0-6.6 5.4-12 12-12h40c6.6 0 12 5.4 12 12v52h128V12c0-6.6 5.4-12 12-12h40c6.6 0 12 5.4 12 12v52h48c26.5 0 48 21.5 48 48zm-48 346V160H48v298c0 3.3 2.7 6 6 6h340c3.3 0 6-2.7 6-6z"/></svg> <time datetime="2025-11-11">2025-11-11</time> </div> 138 </div><div class="content" id="content" data-pagefind-body><p>The other day I was reading about <a href="https://arstechnica.com/security/2025/10/bind-warns-of-bugs-that-could-bring-dns-cache-attack-back-from-the-dead/" target="_blank" rel="noopener noreferrer">yet another DNS vulnerability</a>. Vulnerabilities in DNS have been well known since <a href="https://www.kb.cert.org/vuls/id/800113" target="_blank" rel="noopener noreferrer">2008</a>, and since <a href="https://en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions#Implementation" target="_blank" rel="noopener noreferrer">2010</a> we’ve had an excellent solution, <a href="https://en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions" target="_blank" rel="noopener noreferrer">DNSSEC</a>. DNSSEC addresses many of the most common DNS vulnerabilities on the internet today (including this most recent vulnerability). For most, setup is very simple. Unfortunately, DNSSEC is an opt-in technology. So, it’s a good time to remind all my Internet friends that today’s a good day to double-check if you have DNSSEC enabled, and if you don’t, to make plans to enable it.</p> 139<p>For home users, the simple fix is to switch to a DNSSEC aware DNS provider. <a href="https://quad9.net/" target="_blank" rel="noopener noreferrer">Quad9</a>, <a href="https://blog.cloudflare.com/introducing-1-1-1-1-for-families/" target="_blank" rel="noopener noreferrer">CloudFlare</a>, and <a href="https://nextdns.io/" target="_blank" rel="noopener noreferrer">NextDNS</a> are all great choices. In addition to supporting DNSSEC, they all also support <a href="https://en.wikipedia.org/wiki/DNS_over_TLS" target="_blank" rel="noopener noreferrer">DOT</a>/<a href="https://en.wikipedia.org/wiki/DNS_over_HTTPS" target="_blank" rel="noopener noreferrer">DOH</a> and filter out malware domains for additional privacy/security. Setup is painless for every major OS: <a href="https://docs.quad9.net/Setup_Guides/Windows/Windows_11_%28Encrypted%29/" target="_blank" rel="noopener noreferrer">Windows</a>, <a href="https://docs.quad9.net/Setup_Guides/MacOS/Big_Sur_and_later_%28Encrypted%29/" target="_blank" rel="noopener noreferrer">MacOS</a>, <a href="https://docs.quad9.net/Setup_Guides/Android/Android_9%2B_%28Encrypted%29/" target="_blank" rel="noopener noreferrer">Android</a>, and <a href="https://docs.quad9.net/Setup_Guides/iOS/iOS_14_and_later_%28Encrypted%29/" target="_blank" rel="noopener noreferrer">iOS</a>
139. A secure provider can also be configured on your <a href="https://docs.quad9.net/Setup_Guides/Open-Source_Routers/OpenWrt_LuCi/" target="_blank" rel="noopener noreferrer">home router</a>, to ensure every home device gains the benefits.</p> 140<p>For businesses and organizations, you’ll need to look in two places. First, ensure your enterprise DNS resolvers are using an upstream provider that supports DNSSEC (see above) and/or ensure your enterprise DNS resolvers have DNSSEC validation enabled. For virtually every modern enterprise DNS resolver, it’s a <a href="https://blog.cdemi.io/enabling-windows-dns-server-to-validate-dnssec/" target="_blank" rel="noopener noreferrer">simple switch</a> to enable DNSSEC validation. But often, it’s off by default.</p> 141<p>Second, ensure your public DNS zones are DNSSEC signed. If your DNS zone is hosted with your registrar, this is often a single click to enable (again, this is often disabled by default). Once enabled, nothing else to do, and any existing automation/APIs/etc will continue to work as expected. If your DNS is hosted by someone other than the registrar (like <a href="https://learn.microsoft.com/en-us/azure/dns/dnssec" target="_blank" rel="noopener noreferrer">Azure DNS</a>, <a href="https://learn.microsoft.com/en-us/windows-server/networking/dns/sign-dnssec-zone?tabs=dns-manager" target="_blank" rel="noopener noreferrer">Windows Server DNS</a>, etc), it’s a two-step process. First, enable DNSSEC signing on your hosting provider (again, usually just a single click). That will then give you one or tw
141o records to upload to the registrar. Second, upload those DNSSEC records to your registrar. Again, if your using any modern DNS cloud hosting or <a href="https://learn.microsoft.com/en-us/windows-server/networking/dns/sign-dnssec-zone?tabs=dns-manager" target="_blank" rel="noopener noreferrer">on-premises server product</a>, it’s very easy to setup and existing automation/APIs/dynamic updates/etc don’t break. Unless you’re still manually editing BIND text files, long gone are the days of managing crypto keys and hand-signing zone files.</p> 142<p>To validate you’re setup properly, test your client <a href="https://wander.science/projects/dns/dnssec-resolver-test/" target="_blank" rel="noopener noreferrer">here</a>. If you own a domain, test it’s DNSSEC status <a href="https://dnssec-analyzer.verisignlabs.com/" target="_blank" rel="noopener noreferrer">here</a>.</p> 143<p>In total, it’s a fairly small lift for an organization or tech-savvy individual to set up. Similar to antivirus software, most days it sits there quietly, seemingly doing nothing… except that one time when it saves you from a very bad day. So don’t delay, deploy DNSSEC today!</p></div> 144 145 146 147<div class="post-footer" id="post-footer"> 148 <div class="post-info"> 149 <div class="post-info-line"> 150 <div class="post-info-mod"> 151 <span>Updated on 2025-11-11</span> 152 </div> 153 <div class="post-info-license"></div> 154 </div> 155 <div class="post-info-line print:!tw-hidden"> 156 <div class="post-info-md"></div> 157 <div class="post-info-share"><button title="Share on Twitter" data-sharer="twitter" data-url="https://www.adamstas.com/please-use-dnssec/" data-title="Please Use DNSSEC"><svg class="icon" 158 xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512"><!-- Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) --><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253z"/></svg></button><button title="Share on Facebook" data-sharer="facebook" data-url="https://www.adamstas.com/please-use-dnssec/"><svg class="icon" 159 xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512"><!-- Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) --><path d="M504 256C504 119 393 8 256 8S8 119 8 256c0 123.78 90.69 226.38 209.25 245V327.69h-63V256h63v-54.64c0-62.15 37-96.48 93.67-96.48 27.14 0 55.52 4.84 55.52 4.84v61h-31.28c-30.8 0-40.41 19.12-40.41 38.73V256h68.78l-11 71.69h-57.78V501C413.31 482.38 504 379.78 504 256z"/></svg></button><button title="Share on Linkedin" data-sharer="linkedin" data-url="https://www.adamstas.com/please-use-dnssec/"><svg class="icon" 160 xmlns="http://www.w3.org/2000/svg" viewBox="0 0 448 512"><!-- Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) --><path d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3zM135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5zm282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9V416z"/></svg></button><button title="Share on WhatsApp" data-sharer="whatsapp" data-url="https://www.adamstas.com/please-use-dnssec/" data-title="Please Use DNSSEC" data-web><svg class="icon" 161 xmlns="http://www.w3.org/2000/svg" viewBox="0 0 448 512"><!-- Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) --><path d="M380.9 97.1C339 55.1 283.2 32 223.9 32c-122.4 0-222 99.6-222 222 0 39.1 10.2 77.3 29.6 111L0 480l117.7-30.9c32.4 17.7 68.9 27 106.1 27h.1c122.3 0 224.1-99.6 224.1-222 0-59.3-25.2-115-67.1-157zm-157 341.6c-33.2 0-65.7-8.9-94-25.7l-6.7-4-69.8 18.3L72 359.2l-4.4-7c-18.5-29.4-28.2-63.3-28.2-98.2 0-101.7 82.8-184.5 184.6-184.5 49.3 0 95.6 19.2 130.4 54.1 34.8 34.9 56.2 81.2 56.1 130.5 0 101.8-84.9 184.6-186.6 184.6zm101.2-138.2c-5.5-2.8-32.8-16.2-37.9-18-5.1-1.9-8.8-2.8-12.5 2.8-3.7 5.6-14.3 18-17.6 21.8-3.2 3.7-6.5 4.2-12 1.4-32.6-16.3-54-29.1-75.5-66-5.7-9.8 5.7-9.1 16.3-30.3 1.8-3.7.9-6.9-.5-9.7-1.4-2.8-12.5-30.1-17.1-41.2-4.5-10.8-9.1-9.3-12.5-9.5-3.2-.2-6.9-.2-10.6-.2-3.7 0-9.7 1.4-14.8 6.9-5.1 5.6-19.4 19-19.4 46.3 0 27.3 19.9 53.7 22.6 57.4 2.8 3.7 39.1 59.7 94.8 83.8 35.2 15.2 49 16.5 66.6 13.9 10.7-1.6 32.8-13.4 37.4-26.4 4.6-13 4.6-24.1 3.2-26.4-1.3-2.5-5-3.9-10.5-6.6z"/></svg></button><button title="Share on Pinterest" data-sharer="pinterest" data-url="https://www.adamstas.com/please-use-dnssec/"><svg class="icon" 162 xmlns="http://www.w3.org/2000/svg" viewBox="0 0 496 512"><!-- Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) --><path d="M496 256c0 137-111 248-248 248-25.6 0-50.2-3.9-73.4-11.1 10.1-16.5 25.2-43.5 30.8-65 3-11.6 15.4-59 15.4-59 8.1 15.4 31.7 28.5 56.8 28.5 74.8 0 128.7-68.8 128.7-154.3 0-81.9-66.9-143.2-152.9-143.2-107 0-163.9 71.8-163.9 150.1 0 36.4 19.4 81.7 50.3 96.1 4.7 2.2 7.2 1.2 8.3-3.3.8-3.4 5-20.3 6.9-28.1.6-2.5.3-4.7-1.7-7.1-10.1-12.5-18.3-35.3-18.3-56.6 0-54.7 41.4-107.6 112-107.6 60.9 0 103.6 41.5 103.6 100.9 0 67.1-33.9 113.6-78 113.6-24.3 0-42.6-20.1-36.7-44.8 7-29.5 20.5-61.3 20.5-82.6 0-19-10.2-34.9-31.4-34.9-24.9 0-44.9 25.7-44.9 60.2 0 22 7.4 36.8 7.4 36.8s-24.5 103.8-29 123.2c-5 21.4-3 51.6-.9 71.2C65.4 450.9 0 361.1 0 256 0 119 111 8 248 8s248 111 248 248z"/></svg></button><button title="Share on Tumblr" data-sharer="tumblr" data-url="https://www.adamstas.com/please-use-dnssec/" data-title="Please Use DNSSEC"><svg class="icon" 163 xmlns="http://www.w3.org/2000/svg" viewBox="0 0 320 512"><!-- Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) --><path d="M309.8 480.3c-13.6 14.5-50 31.7-97.4 31.7-120.8 0-147-88.8-147-140.6v-144H17.9c-5.5 0-10-4.5-10-10v-68c0-7.2 4.5-13.6 11.3-16 62-21.8 81.5-76 84.3-117.1.8-11 6.5-16.3 16.1-16.3h70.9c5.5 0 10 4.5 10 10v115.2h83c5.5 0 10 4.4 10 9.9v81.7c0 5.5-4.5 10-10 10h-83.4V360c0 34.2 23.7 53.6 68 35.8 4.8-1.9 9-3.2 12.7-2.2 3.5.9 5.8 3.4 7.4 7.9l22 64.3c1.8 5 3.3 10.6-.4 14.5z"/></svg></button><button title="Share on Reddit" data-sharer="reddit" data-url="https://www.adamstas.com/please-use-dnssec/"><svg class="icon" 164 xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512"><!-- Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) --><path d="M201.5 305.5c-13.8 0-24.9-11.1-24.9-24.6 0-13.8 11.1-24.9 24.9-24.9 13.6 0 24.6 11.
1641 24.6 24.9 0 13.6-11.1 24.6-24.6 24.6zM504 256c0 137-111 248-248 248S8 393 8 256 119 8 256 8s248 111 248 248zm-132.3-41.2c-9.4 0-17.7 3.9-23.8 10-22.4-15.5-52.6-25.5-86.1-26.6l17.4-78.3 55.4 12.5c0 13.6 11.1 24.6 24.6 24.6 13.8 0 24.9-11.3 24.9-24.9s-11.1-24.9-24.9-24.9c-9.7 0-18 5.8-22.1 13.8l-61.2-13.6c-3-.8-6.1 1.4-6.9 4.4l-19.1 86.4c-33.2 1.4-63.1 11.3-85.5 26.8-6.1-6.4-14.7-10.2-24.1-10.2-34.9 0-46.3 46.9-14.4 62.8-1.1 5-1.7 10.2-1.7 15.5 0 52.6 59.2 95.2 132 95.2 73.1 0 132.3-42.6 132.3-95.2 0-5.3-.6-10.8-1.9-15.8 31.3-16 19.8-62.5-14.9-62.5zM302.8 331c-18.2 18.2-76.1 17.9-93.6 0-2.2-2.2-6.1-2.2-8.3 0-2.5 2.5-2.5 6.4 0 8.6 22.8 22.8 87.3 22.8 110.2 0 2.5-2.2 2.5-6.1 0-8.6-2.2-2.2-6.1-2.2-8.3 0zm7.7-75c-13.6 0-24.6 11.1-24.6 24.9 0 13.6 11.1 24.6 24.6 24.6 13.8 0 24.9-11.1 24.9-24.6 0-13.8-11-24.9-24.9-24.9z"/></svg></button><button title="Share on Instapaper" data-sharer="instapaper" data-url="https://www.adamstas.com/please-use-dnssec/" data-title="Please Use DNSSEC" data-description=""><svg class="icon" role="img" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><title>Instapaper</title><path d="M14.766 20.259c0 1.819.271 2.089 2.934 2.292V24H6.301v-1.449c2.666-.203 2.934-.473 2.934-2.292V3.708c0-1.784-.27-2.089-2.934-2.292V0h11.398v1.416c-2.662.203-2.934.506-2.934 2.292v16.551z"/></svg></button><button title="Share on Flipboard" data-sharer="flipboard" data-url="https://www.adamstas.com/please-use-dnssec/" data-title="Please Use DNSSEC"><svg class="icon" 165 xmlns="http://www.w3.org/2000/svg" viewBox="0 0 448 512"><!-- Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) --><path d="M0 32v448h448V32H0zm358.4 179.2h-89.6v89.6h-89.6v89.6H89.6V121.6h268.8v89.6z"/></svg></button><button title="Share on Evernote" data-sharer="evernote" data-url="https://www.adamstas.com/please-use-dnssec/" data-title="Please Use DNSSEC"><svg class="icon" 166 xmlns="http://www.w3.org/2000/svg" viewBox="0 0 384 512"><!-- Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) --><path d="M120.82 132.21c1.6 22.31-17.55 21.59-21.61 21.59-68.93 0-73.64-1-83.58 3.34-.56.22-.74 0-.37-.37L123.79 46.45c.38-.37.6-.22.38.37-4.35 9.99-3.35 15.09-3.35 85.39zm79 308c-14.68-37.08 13-76.93 52.52-76.62 17.49 0 22.6 23.21 7.95 31.42-6.19 3.3-24.95 1.74-25.14 19.2-.05 17.09 19.67 25 31.2 24.89A45.64 45.64 0 0 0 312 393.45v-.08c0-11.63-7.79-47.22-47.54-55.34-7.72-1.54-65-6.35-68.35-50.52-3.74 16.93-17.4 63.49-43.11 69.09-8.74 1.94-69.68 7.64-112.92-36.77 0 0-18.57-15.23-28.23-57.95-3.38-15.75-9.28-39.7-11.14-62 0-18 11.14-30.45 25.07-32.2 81 0 90 2.32 101-7.8 9.82-9.24 7.8-15.5 7.8-102.78 1-8.3 7.79-30.81 53.41-24.14 6 .86 31.91 4.18 37.48 30.64l64.26 11.15c20.43 3.71 70.94 7 80.6 57.94 22.66 121.09 8.91 238.46 7.8 238.46C362.15 485.53 267.06 480 267.06 480c-18.95-.23-54.25-9.4-67.27-39.83zm80.94-204.84c-1 1.92-2.2 6 .85 7 14.09 4.93 39.75 6.84 45.88 5.53 3.11-.25 3.05-4.43 2.48-6.65-3.53-21.85-40.83-26.5-49.24-5.92z"/></svg></button><button title="Share on Trello" data-sharer="trello" data-url="https://www.adamstas.com/please-use-dnssec/" data-title="Please Use DNSSEC" data-description=""><svg class="icon" 167 xmlns="http://www.w3.org/2000/svg" viewBox="0 0 448 512"><!-- Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) --><path d="M392.3 32H56.1C25.1 32 0 57.1 0 88c-.1 0 0-4 0 336 0 30.9 25.1 56 56 56h336.2c30.8-.2 55.7-25.2 55.7-56V88c.1-30.8-24.8-55.8-55.6-56zM197 371.3c-.2 14.7-12.1 26.6-26.9 26.6H87.4c-14.8.1-26.9-11.8-27-26.6V117.1c0-14.8 12-26.9 26.9-26.9h82.9c14.8 0 26.9 12 26.9 26.9v254.2zm193.1-112c0 14.8-12 26.9-26.9 26.9h-81c-14.8 0-26.9-12-26.9-26.9V117.2c0-14.8 12-26.9 26.8-26.9h81.1c14.8 0 26.9 12 26.9 26.9v142.1z"/></svg></button>
167<script> 168 function shareOnMastodon(title, link) { 169 const SHARE_MASTODON_DOMAIN = "share_mastodon_domain" 170 const savedDomain = localStorage.getItem(SHARE_MASTODON_DOMAIN) ?? "mastodon.social"; 171 const domain = prompt("Enter your Mastodon domain", savedDomain); 172 if (domain === null) { 173 return; 174 } 175 localStorage.setItem(SHARE_MASTODON_DOMAIN, domain) 176 const text = title + "\n\n" + link; 177 const url = new URL("https://" + domain) 178 url.pathname = "share" 179 url.searchParams.append('text', text) 180 window.open(url, '_blank', "width=500,height=500,left=500,toolbar=0,status=0"); 181 } 182 </script>
182 183 <button title="Share on Mastodon"onclick="javascript:shareOnMastodon("Please Use DNSSEC", "https://www.adamstas.com/please-use-dnssec/")"><svg class="icon" 184 xmlns="http://www.w3.org/2000/svg" viewBox="0 0 448 512"><!-- Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) --><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.54 102.54 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5zm-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg></button></div> 185 </div> 186 </div> 187 188 <div class="post-info-more"> 189 <section class="post-tags"></section> 190 <section class="print:!tw-hidden"> 191 <span><button class="tw-text-fgColor-link-muted hover:tw-text-fgColor-link-muted-hover" onclick="window.history.back();">Back</button></span> | <span><a href="/">Home</a></span> 192 </section> 193 </div> 194 195 <div class="post-nav print:tw-hidden"><a href="/infineon-yubikey-cloning-vulnerability/" class="prev" rel="prev" title="Infineon / YubiKey Cloning Vulnerability"><svg class="icon" 196 xmlns="http://www.w3.org/2000/svg" viewBox="0 0 256 512"><!-- Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) --><path d="M31.7 239l136-136c9.4-9.4 24.6-9.4 33.9 0l22.6 22.6c9.4 9.4 9.4 24.6 0 33.9L127.9 256l96.4 96.4c9.4 9.4 9.4 24.6 0 33.9L201.7 409c-9.4 9.4-24.6 9.4-33.9 0l-136-136c-9.5-9.4-9.5-24.6-.1-34z"/></svg>Infineon / YubiKey Cloning Vulnerability</a></div> 197</div> 198<div id="comments" class="print:!tw-hidden tw-pt-32 tw-pb-8"></div></article></main><footer class="footer"> 199 <div class="footer-container"><div class="footer-line"> 200 Powered by <a href="https://gohugo.io/" target="_blank" rel="noopener noreferrer" title="Hugo 0.147.7">Hugo</a> | Theme - <a href="https://github.com/HEIGE-PCloud/DoIt" target="_blank" rel="noopener noreferrer" title="DoIt 0.4.2"><svg class="icon" 201 xmlns="http://www.w3.org/2000/svg" viewBox="0 0 576 512"><!-- Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) --><path d="M402.3 344.9l32-32c5-5 13.7-1.5 13.7 5.7V464c0 26.5-21.5 48-48 48H48c-26.5 0-48-21.5-48-48V112c0-26.5 21.5-48 48-48h273.5c7.1 0 10.7 8.6 5.7 13.7l-32 32c-1.5 1.5-3.5 2.3-5.7 2.3H48v352h352V350.5c0-2.1.8-4.1 2.3-5.6zm156.6-201.8L296.3 405.7l-90.4 10c-26.2 2.9-48.5-19.2-45.6-45.6l10-90.4L432.9 17.1c22.9-22.9 59.9-22.9 82.7 0l43.2 43.2c22.9 22.9 22.9 60 .1 82.8zM460.1 174L402 115.9 216.2 301.8l-7.3 65.3 65.3-7.3L460.1 174zm64.8-79.7l-43.2-43.2c-4.1-4.1-10.8-4.1-14.8 0L436 82l58.1 58.1 30.9-30.9c4-4.2 4-10.8-.1-14.9z"/></svg> DoIt</a> 202 </div><div class="footer-line"><svg class="icon" 203 xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512"><!-- Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) --><path d="M256 8C119.033 8 8 119.033 8 256s111.033 248 248 248 248-111.033 248-248S392.967 8 256 8zm0 448c-110.532 0-200-89.451-200-200 0-110.531 89.451-200 200-200 110.532 0 200 89.451 200 200 0 110.532-89.451 200-200 200zm107.351-101.064c-9.614 9.712-45.53 41.396-104.065 41.396-82.43 0-140.484-61.425-140.484-141.567 0-79.152 60.275-139.401 139.762-139.401 55.531 0 88.738 26.62 97.593 34.779a11.965 11.965 0 0 1 1.936 15.322l-18.155 28.113c-3.841 5.95-11.966 7.282-17.499 2.921-8.595-6.776-31.814-22.538-61.708-22.538-48.303 0-77.916 35.33-77.916 80.082 0 41.589 26.888 83.692 78.277 83.692 32.657 0 56.843-19.039 65.726-27.225 5.27-4.857 13.596-4.039 17.82 1.738l19.865 27.17a11.947 11.947 0 0 1-1.152 15.518z"/></svg>2019 - 2025<span class="author"> <a href="https://www.adamstas.com" target="_blank" rel="noopener noreferrer">Adam Stasiniewicz</a></span> | <span class="license"><a rel="license external nofollow noopener noreffer" href="https://creativecommons.org/licenses/by-nc/4.0/" target="_blank">CC BY-NC 4.0</a></span></div> 204 <div class="footer-line"></div> 205 <div class="footer-line"> 206 </div> 207 </div></footer><div class="print:!tw-hidden tw-flex tw-flex-col tw-fixed tw-right-4 tw-bottom-4 tw-gap-2"><a href="#back-to-top" id="back-to-top-button" class="tw-transition-opacity tw-opacity-0 tw-block tw-bg-bgColor-secondary tw-rounded-full" style="padding: 0.6rem; line-height: 1.3rem; font-size: 1rem;" title="Back to Top"> 208 <svg class="icon" 209 xmlns="http://www.w3.org/2000/svg" viewBox="0 0 448 512"><!-- Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) --><path d="M34.9 289.5l-22.2-22.2c-9.4-9.4-9.4-24.6 0-33.9L207 39c9.4-9.4 24.6-9.4 33.9 0l194.3 194.3c9.4 9.4 9.4 24.6 0 33.9L413 289.4c-9.5 9.5-25 9.3-34.3-.4L264 168.6V456c0 13.3-10.7 24-24 24h-32c-13.3 0-24-10.7-24-24V168.6L69.2 289.1c-9.3 9.8-24.8 10-34.3.4z"/></svg> 210 </a> 211 212 <button id="toc-drawer-button" class="tw-block tw-bg-bgColor-secondary tw-rounded-full md:tw-hidden" style="padding: 0.6rem; line-height: 1.3rem; font-size: 1rem;"> 213 <svg class="icon" 214 xmlns="http://www.w3.org/2000/svg" viewBox="0 0 448 512"><!-- Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) --><path d="M16 132h416c8.837 0 16-7.163 16-16V76c0-8.837-7.163-16-16-16H16C7.163 60 0 67.163 0 76v40c0 8.837 7.163 16 16 16zm0 160h416c8.837 0 16-7.163 16-16v-40c0-8.837-7.163-16-16-16H16c-8.837 0-16 7.163-16 16v40c0 8.837 7.163 16 16 16zm0 160h416c8.837 0 16-7.163 16-16v-40c0-8.837-7.163-16-16-16H16c-8.837 0-16 7.163-16 16v40c0 8.837 7.163 16 16 16z"/></svg> 215 </button><a href="#comments" id="view-comments" class="tw-block tw-bg-bgColor-secondary tw-rounded-full" style="padding: 0.6rem; line-height: 1.3rem; font-size: 1rem;" title="View Comments"> 216 <svg class="icon" 217 xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512"><!-- Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) --><path d="M256 32C114.6 32 0 125.1 0 240c0 49.6 21.4 95 57 130.7C44.5 421.1 2.7 466 2.2 466.5c-2.2 2.3-2.8 5.7-1.5 8.7S4.8 480 8 480c66.3 0 116-31.8 140.6-51.4 32.7 12.3 69 19.4 107.4 19.4 141.4 0 256-93.1 256-208S397.4 32 256 32z"/></svg> 218 </a></div> 219<link rel="stylesheet" href="/lib/katex/katex.min.css"><link rel="preload" as="style" onload="this.onload=null;this.rel='stylesheet'" href="/lib/katex/copy-tex.min.css"> 220 <noscript><link rel="stylesheet" href="/lib/katex/copy-tex.min.css"></noscript>
221<script>window.config={"comment":{},"math":{"delimiters":[{"display":true,"left":"$$","right":"$$"},{"display":true,"left":"\\[","right":"\\]"},{"display":false,"left":"$","right":"$"},{"display":false,"left":"\\(","right":"\\)"}],"strict":false},"sharerjs":true,"table":{"sort":true}};</script>
221<script 222 src="/lib/tablesort/tablesort.min.js" 223 224 ></script>
224<script 225 src="/lib/sharer/sharer.min.js" 226 227 ></script>
227<script 228 src="/lib/katex/katex.min.js" 229 230 defer 231 232 ></script>
232<script 233 src="/lib/katex/auto-render.min.js" 234 235 defer 236 237 ></script>
237<script 238 src="/lib/katex/copy-tex.min.js" 239 240 defer 241 242 ></script>
242<script 243 src="/lib/katex/mhchem.min.js" 244 245 defer 246 247 ></script>
247<script 248 src="/js/katex.min.js" 249 250 defer 251 252 ></script>
252<script 253 src="/js/theme.min.js" 254 255 defer 256 257 ></script>
257 258
259<script type="speculationrules"> 260 { 261 "prerender": [ 262 { 263 "where": { "href_matches": "/*" }, 264 "eagerness": "moderate" 265 } 266 ] 267 } 268</script>
268 269<!-- Cloudflare Pages Analytics -->
vendor: 99 bytes, line 269
269<script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token": "
26928596e46c0b147c8b796bb7d04c1a329
vendor: 13 bytes, line 269
269"}'></script>
269<!-- Cloudflare Pages Analytics -->
269<script>(function(){function c(){var b=a.contentDocument||(a.contentWindow&&a.contentWindow.document);if(b){var d=b.createElement('script');d.innerHTML="window.__CF$cv$params={r:'a45ec780897d6e57',t:'MTc5MTIyNzk4MA=='};var a=document.createElement('script');a.src='/cdn-cgi/challenge-platform/scripts/jsd/main.js';document.getElementsByTagName('head')[0].appendChild(a);";b.getElementsByTagName('head')[0].appendChild(d)}}if(document.body){var a=document.createElement('iframe');a.height=1;a.width=1;a.style.position='absolute';a.style.top=0;a.style.left=0;a.style.border='none';a.style.visibility='hidden';document.body.appendChild(a);if('loading'!==document.readyState)c();else if(window.addEventListener)document.addEventListener('DOMContentLoaded',c);else{var e=document.onreadystatechange||function(){};document.onreadystatechange=function(b){e(b);'loading'!==document.readyState&&(document.onreadystatechange=e,c())}}}})();</script>
269<script type="module" src="https://static.cloudflareinsights.com/beacon.min.js/v31edd6df95cf4e85bb4c19e7a9bdbcba1788362987495" integrity="sha512-iIg7k2xntmwu6/uSb5tpc/hySgZc4eoL31yB29W6tJFo2akwjPWcEqnCEdJvGexCL0KEQwVYv5BlowfhVz26hg==" data-cf-beacon='{"version":"2024.11.0","token":"9671db6ecd7a4afc9395dfc9836821ef","r":1,"spa":2}' crossorigin="anonymous"></script>
269 270</body> 271 272</html>
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.