PageSourceSearch

https://adamstas.com/please-use-dnssec/

html adamstas.com collected 2026-10-05 19:19:41 UTC 38,383 bytes, 272 lines download raw bytes

1<!DOCTYPE html>
2<html lang="en-us">
3
4<head>
5    <meta charset="utf-8">
6    <meta name="viewport" content="width=device-width, initial-scale=1">
7    <meta name="robots" content="noodp" /><title>Please Use DNSSEC - AdamStas.com - Home of Adam Stasiniewicz</title><meta name="Description" content="Home of Adam Stasiniewicz"><meta property="og:url" content="https://www.adamstas.com/please-use-dnssec/">
8  <meta property="og:site_name" content="AdamStas.com - Home of Adam Stasiniewicz">
9  <meta property="og:title" content="Please Use DNSSEC">
10  <meta property="og:description" content="The other day I was reading about yet another DNS vulnerability. Vulnerabilities in DNS have been well known since 2008, and since 2010 we’ve had an excellent solution, DNSSEC. DNSSEC addresses many of the most common DNS vulnerabilities on the internet today (including this most recent vulnerability). For most, setup is very simple. Unfortunately, DNSSEC is an opt-in technology. So, it’s a good time to remind all my Internet friends that today’s a good day to double-check if you have DNSSEC enabled, and if you don’t, to make plans to enable it.">
11  <meta property="og:locale" content="en_us">
12  <meta property="og:type" content="article">
13    <meta property="article:section" content="posts">
14    <meta property="article:published_time" content="2025-11-11T21:20:15+00:00">
15    <meta property="article:modified_time" content="2025-11-11T21:20:15+00:00">
16    <meta property="og:image" content="https://www.adamstas.com/android-chrome-512x512.png">
17
18  <meta name="twitter:card" content="summary_large_image">
19  <meta name="twitter:image" content="https://www.adamstas.com/android-chrome-512x512.png">
20  <meta name="twitter:title" content="Please Use DNSSEC">
21  <meta name="twitter:description" content="The other day I was reading about yet another DNS vulnerability. Vulnerabilities in DNS have been well known since 2008, and since 2010 we’ve had an excellent solution, DNSSEC. DNSSEC addresses many of the most common DNS vulnerabilities on the internet today (including this most recent vulnerability). For most, setup is very simple. Unfortunately, DNSSEC is an opt-in technology. So, it’s a good time to remind all my Internet friends that today’s a good day to double-check if you have DNSSEC enabled, and if you don’t, to make plans to enable it.">
22<meta name="application-name" content="AdamStas.com">
23<meta name="apple-mobile-web-app-title" content="AdamStas.com">
24
25<meta name="theme-color" content="#f8f8f8"><meta name="msapplication-TileColor" content="#da532c"><link rel="shortcut icon" type="image/x-icon" href="/favicon.ico" />
26        <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png">
27        <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png"><link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png"><link rel="mask-icon" href="/safari-pinned-tab.svg" color="#5bbad5">
28
29<link rel="canonical" href="https://www.adamstas.com/please-use-dnssec/" /><link rel="prev" href="https://www.adamstas.com/infineon-yubikey-cloning-vulnerability/" />
30<link rel="stylesheet" href="/css/main.min.css"><link rel="stylesheet" href="/css/style.min.css">
30<script type="application/ld+json">{"@context": "https://schema.org","@type": "BlogPosting",
31        "headline": "Please Use DNSSEC",
32        "inLanguage": "en-us",
33        "mainEntityOfPage": {
34            "@type": "WebPage",
35            "@id": "https://www.adamstas.com/please-use-dnssec/"
36        },"genre": "posts","wordcount":  441 ,
37        "url": "https://www.adamstas.com/please-use-dnssec/","datePublished": "2025-11-11T21:20:15+00:00","dateModified": "2025-11-11T21:20:15+00:00","publisher": {
38            "@type": "Organization",
39            "name": ""},"author": {
40                "@type": "Person",
41                "name": "Adam Stasiniewicz",
42                "url": "https://www.adamstas.com"
43            },"description": ""
44    }</script>
44</head>
45
46
47<body data-instant-intensity="viewport" class="tw-flex tw-min-h-screen tw-flex-col">
47<script>
48    function setTheme(theme) {
49      document.body.setAttribute('theme', theme); 
50      document.documentElement.className = theme;
51      document.documentElement.style.setProperty('color-scheme', theme === 'light' ? 'light' : 'dark');
52      if (theme === 'light') {
53        document.documentElement.classList.remove('tw-dark')
54      } else {
55        document.documentElement.classList.add('tw-dark')
56      }
57      window.theme = theme;   
58      window.isDark = window.theme !== 'light' 
59    }
60    function saveTheme(theme) {window.localStorage && localStorage.setItem('theme', theme);}
61    function getMeta(metaName) {const metas = document.getElementsByTagName('meta'); for (let i = 0; i < metas.length; i++) if (metas[i].getAttribute('name') === metaName) return metas[i]; return '';}
62    if (window.localStorage && localStorage.getItem('theme')) {
63        let theme = localStorage.getItem('theme');
64        if (theme === 'light' || theme === 'dark') {
65        setTheme(theme);
66        } else {
67            if ((window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches)) {
68                setTheme('dark');
69            } else {
70                setTheme('light');
71            }
72        }
73      } else { 
74        if ('auto' === 'light' || 'auto' === 'dark') 
75            setTheme('auto'), saveTheme('auto'); 
76        else saveTheme('auto'), window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches ? setTheme('dark') : setTheme('light');
77    }
78    let metaColors = {'light': '#f8f8f8','dark': '#161b22'}
79    getMeta('theme-color').content = metaColors[document.body.getAttribute('theme')];
80    window.switchThemeEventSet = new Set()
81</script>
81<div id="back-to-top"></div>
82    <div id="mask"></div><header class="desktop print:!tw-hidden" id="header-desktop">
83    <div class="header-wrapper">
84        <div class="header-title">
85            <a href="/" title="AdamStas.com - Home of Adam Stasiniewicz"><img class="tw-inline tw-align-text-bottom tw-mr-1"  src='/android-chrome-512x512.png'   alt="AdamStas.com" height="32" width="32">AdamStas.com</a>
86        </div>
87        <div class="menu">
88            <div class="menu-inner"><a class="menu-item"
89                    href="/contact/" > Contact </a><a class="menu-item"
90                    href="/about/" > About </a><span class="menu-item delimiter"></span><button class="menu-item theme-select" aria-label="Switch Theme">
91                    <svg class="icon"
92    xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512"><!-- Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) --><path d="M8 256c0 136.966 111.033 248 248 248s248-111.034 248-248S392.966 8 256 8 8 119.033 8 256zm248 184V72c101.705 0 184 82.311 184 184 0 101.705-82.311 184-184 184z"/></svg>
93                    <select class="color-theme-select" id="theme-select-desktop" aria-label="Switch Theme">
94                        <option value="light">Light</option>
95                        <option value="dark">Dark</option>
96                        <option value="auto">Auto</option>
97                    </select>
98                </button></div>
99        </div>
100    </div>
101</header><header class="mobile print:!tw-hidden" id="header-mobile">
102    <div class="header-container">
103        <div class="header-wrapper">
104            <div class="header-title">
105                <a href="/" title="AdamStas.com - Home of Adam Stasiniewicz"><img class="tw-inline tw-align-text-bottom tw-mr-1"  src='/android-chrome-512x512.png'   alt="AdamStas.com" height="32" width="32">
105AdamStas.com</a>
106            </div>
107            <div class="menu-toggle" id="menu-toggle-mobile">
108                <span></span><span></span><span></span>
109            </div>
110        </div>
111        <div class="menu" id="menu-mobile"><a class="menu-item" href="/contact/" title="" >Contact</a><a class="menu-item" href="/about/" title="" >About</a><button class="menu-item theme-select tw-w-full" aria-label="Switch Theme">
112                <svg class="icon"
113    xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512"><!-- Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) --><path d="M8 256c0 136.966 111.033 248 248 248s248-111.034 248-248S392.966 8 256 8 8 119.033 8 256zm248 184V72c101.705 0 184 82.311 184 184 0 101.705-82.311 184-184 184z"/></svg>
114                <select class="color-theme-select" id="theme-select-mobile" aria-label="Switch Theme">
115                    <option value="light">Light</option>
116                    <option value="dark">Dark</option>
117                    <option value="auto">Auto</option>
118                </select>
119            </button></div>
120    </div>
121</header>
122<div class="search-dropdown desktop">
123    <div id="search-dropdown-desktop"></div>
124</div>
125<div class="search-dropdown mobile">
126    <div id="search-dropdown-mobile"></div>
127</div><main class="tw-mx-4 tw-flex-1"><dialog id="toc-dialog" class="tw-max-w-full tw-w-full tw-max-h-full tw-h-full tw-ml-16">
128        <div class="toc tw-mx-4 tw-max-w-full">
129            <h2 class="tw-mx-0 tw-my-6 tw-uppercase tw-text-2xl">Contents</h2>
130            <div class="toc-content"><nav id="TableOfContents"></nav></div>
131        </div>
132    </dialog>
132<script>document.getElementsByTagName("main")[0].setAttribute("autoTOC", "false")</script>
132<article class="page single print:!tw-w-full print:!tw-max-w-none print:!tw-m-0 print:!tw-p-0"><h1 class="single-title" data-pagefind-meta="date:2025-11-11" data-pagefind-body>Please Use DNSSEC</h1><div class="post-meta">
133            <div class="post-meta-line">
134                <span class="post-author"><img class="tw-inline-block tw-max-h-4 tw-rounded-full tw-translate-y-[-2px] tw-mr-1"  src='/android-chrome-512x512.png'   alt="Adam Stasiniewicz avatar" height="16" width="16"><a href="https://www.adamstas.com" title="Author" target="_blank" rel="noopener noreferrer author" class="author">Adam Stasiniewicz</a>
135                </span></div>
136            <div class="post-meta-line"><svg class="icon"
137    xmlns="http://www.w3.org/2000/svg" viewBox="0 0 448 512"><!-- Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) --><path d="M148 288h-40c-6.6 0-12-5.4-12-12v-40c0-6.6 5.4-12 12-12h40c6.6 0 12 5.4 12 12v40c0 6.6-5.4 12-12 12zm108-12v-40c0-6.6-5.4-12-12-12h-40c-6.6 0-12 5.4-12 12v40c0 6.6 5.4 12 12 12h40c6.6 0 12-5.4 12-12zm96 0v-40c0-6.6-5.4-12-12-12h-40c-6.6 0-12 5.4-12 12v40c0 6.6 5.4 12 12 12h40c6.6 0 12-5.4 12-12zm-96 96v-40c0-6.6-5.4-12-12-12h-40c-6.6 0-12 5.4-12 12v40c0 6.6 5.4 12 12 12h40c6.6 0 12-5.4 12-12zm-96 0v-40c0-6.6-5.4-12-12-12h-40c-6.6 0-12 5.4-12 12v40c0 6.6 5.4 12 12 12h40c6.6 0 12-5.4 12-12zm192 0v-40c0-6.6-5.4-12-12-12h-40c-6.6 0-12 5.4-12 12v40c0 6.6 5.4 12 12 12h40c6.6 0 12-5.4 12-12zm96-260v352c0 26.5-21.5 48-48 48H48c-26.5 0-48-21.5-48-48V112c0-26.5 21.5-48 48-48h48V12c0-6.6 5.4-12 12-12h40c6.6 0 12 5.4 12 12v52h128V12c0-6.6 5.4-12 12-12h40c6.6 0 12 5.4 12 12v52h48c26.5 0 48 21.5 48 48zm-48 346V160H48v298c0 3.3 2.7 6 6 6h340c3.3 0 6-2.7 6-6z"/></svg>&nbsp;<time datetime="2025-11-11">2025-11-11</time>&nbsp;</div>
138        </div><div class="content" id="content" data-pagefind-body><p>The other day I was reading about <a href="https://arstechnica.com/security/2025/10/bind-warns-of-bugs-that-could-bring-dns-cache-attack-back-from-the-dead/" target="_blank" rel="noopener noreferrer">yet another DNS vulnerability</a>.  Vulnerabilities in DNS have been well known since <a href="https://www.kb.cert.org/vuls/id/800113" target="_blank" rel="noopener noreferrer">2008</a>, and since <a href="https://en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions#Implementation" target="_blank" rel="noopener noreferrer">2010</a> we&rsquo;ve had an excellent solution, <a href="https://en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions" target="_blank" rel="noopener noreferrer">DNSSEC</a>.  DNSSEC addresses many of the most common DNS vulnerabilities on the internet today (including this most recent vulnerability).  For most, setup is very simple.  Unfortunately, DNSSEC is an opt-in technology.  So, it&rsquo;s a good time to remind all my Internet friends that today&rsquo;s a good day to double-check if you have DNSSEC enabled, and if you don&rsquo;t, to make plans to enable it.</p>
139<p>For home users, the simple fix is to switch to a DNSSEC aware DNS provider.  <a href="https://quad9.net/" target="_blank" rel="noopener noreferrer">Quad9</a>, <a href="https://blog.cloudflare.com/introducing-1-1-1-1-for-families/" target="_blank" rel="noopener noreferrer">CloudFlare</a>, and <a href="https://nextdns.io/" target="_blank" rel="noopener noreferrer">NextDNS</a> are all great choices.  In addition to supporting DNSSEC, they all also support <a href="https://en.wikipedia.org/wiki/DNS_over_TLS" target="_blank" rel="noopener noreferrer">DOT</a>/<a href="https://en.wikipedia.org/wiki/DNS_over_HTTPS" target="_blank" rel="noopener noreferrer">DOH</a> and filter out malware domains for additional privacy/security.  Setup is painless for every major OS: <a href="https://docs.quad9.net/Setup_Guides/Windows/Windows_11_%28Encrypted%29/" target="_blank" rel="noopener noreferrer">Windows</a>, <a href="https://docs.quad9.net/Setup_Guides/MacOS/Big_Sur_and_later_%28Encrypted%29/" target="_blank" rel="noopener noreferrer">MacOS</a>, <a href="https://docs.quad9.net/Setup_Guides/Android/Android_9%2B_%28Encrypted%29/" target="_blank" rel="noopener noreferrer">Android</a>, and <a href="https://docs.quad9.net/Setup_Guides/iOS/iOS_14_and_later_%28Encrypted%29/" target="_blank" rel="noopener noreferrer">iOS</a>
139.  A secure provider can also be configured on your <a href="https://docs.quad9.net/Setup_Guides/Open-Source_Routers/OpenWrt_LuCi/" target="_blank" rel="noopener noreferrer">home router</a>, to ensure every home device gains the benefits.</p>
140<p>For businesses and organizations, you&rsquo;ll need to look in two places.  First, ensure your enterprise DNS resolvers are using an upstream provider that supports DNSSEC (see above) and/or ensure your enterprise DNS resolvers have DNSSEC validation enabled.  For virtually every modern enterprise DNS resolver, it&rsquo;s a <a href="https://blog.cdemi.io/enabling-windows-dns-server-to-validate-dnssec/" target="_blank" rel="noopener noreferrer">simple switch</a> to enable DNSSEC validation.  But often, it&rsquo;s off by default.</p>
141<p>Second, ensure your public DNS zones are DNSSEC signed.  If your DNS zone is hosted with your registrar, this is often a single click to enable (again, this is often disabled by default).  Once enabled, nothing else to do, and any existing automation/APIs/etc will continue to work as expected.  If your DNS is hosted by someone other than the registrar (like <a href="https://learn.microsoft.com/en-us/azure/dns/dnssec" target="_blank" rel="noopener noreferrer">Azure DNS</a>, <a href="https://learn.microsoft.com/en-us/windows-server/networking/dns/sign-dnssec-zone?tabs=dns-manager" target="_blank" rel="noopener noreferrer">Windows Server DNS</a>, etc), it&rsquo;s a two-step process.  First, enable DNSSEC signing on your hosting provider (again, usually just a single click).  That will then give you one or tw
141o records to upload to the registrar.  Second, upload those DNSSEC records to your registrar.  Again, if your using any modern DNS cloud hosting or <a href="https://learn.microsoft.com/en-us/windows-server/networking/dns/sign-dnssec-zone?tabs=dns-manager" target="_blank" rel="noopener noreferrer">on-premises server product</a>, it&rsquo;s very easy to setup and existing automation/APIs/dynamic updates/etc don&rsquo;t break.  Unless you&rsquo;re still manually editing BIND text files, long gone are the days of managing crypto keys and hand-signing zone files.</p>
142<p>To validate you&rsquo;re setup properly, test your client <a href="https://wander.science/projects/dns/dnssec-resolver-test/" target="_blank" rel="noopener noreferrer">here</a>.  If you own a domain, test it&rsquo;s DNSSEC status <a href="https://dnssec-analyzer.verisignlabs.com/" target="_blank" rel="noopener noreferrer">here</a>.</p>
143<p>In total, it&rsquo;s a fairly small lift for an organization or tech-savvy individual to set up.  Similar to antivirus software, most days it sits there quietly, seemingly doing nothing&hellip; except that one time when it saves you from a very bad day.  So don&rsquo;t delay, deploy DNSSEC today!</p></div>
144
145        
146
147<div class="post-footer" id="post-footer">
148    <div class="post-info">
149        <div class="post-info-line">
150            <div class="post-info-mod">
151                <span>Updated on 2025-11-11</span>
152            </div>
153            <div class="post-info-license"></div>
154        </div>
155        <div class="post-info-line print:!tw-hidden">
156            <div class="post-info-md"></div>
157            <div class="post-info-share"><button title="Share on Twitter" data-sharer="twitter" data-url="https://www.adamstas.com/please-use-dnssec/" data-title="Please Use DNSSEC"><svg class="icon"
158    xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512"><!-- Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) --><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253z"/></svg></button><button title="Share on Facebook" data-sharer="facebook" data-url="https://www.adamstas.com/please-use-dnssec/"><svg class="icon"
159    xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512"><!-- Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) --><path d="M504 256C504 119 393 8 256 8S8 119 8 256c0 123.78 90.69 226.38 209.25 245V327.69h-63V256h63v-54.64c0-62.15 37-96.48 93.67-96.48 27.14 0 55.52 4.84 55.52 4.84v61h-31.28c-30.8 0-40.41 19.12-40.41 38.73V256h68.78l-11 71.69h-57.78V501C413.31 482.38 504 379.78 504 256z"/></svg></button><button title="Share on Linkedin" data-sharer="linkedin" data-url="https://www.adamstas.com/please-use-dnssec/"><svg class="icon"
160    xmlns="http://www.w3.org/2000/svg" viewBox="0 0 448 512"><!-- Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) --><path d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3zM135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5zm282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9V416z"/></svg></button><button title="Share on WhatsApp" data-sharer="whatsapp" data-url="https://www.adamstas.com/please-use-dnssec/" data-title="Please Use DNSSEC" data-web><svg class="icon"
161    xmlns="http://www.w3.org/2000/svg" viewBox="0 0 448 512"><!-- Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) --><path d="M380.9 97.1C339 55.1 283.2 32 223.9 32c-122.4 0-222 99.6-222 222 0 39.1 10.2 77.3 29.6 111L0 480l117.7-30.9c32.4 17.7 68.9 27 106.1 27h.1c122.3 0 224.1-99.6 224.1-222 0-59.3-25.2-115-67.1-157zm-157 341.6c-33.2 0-65.7-8.9-94-25.7l-6.7-4-69.8 18.3L72 359.2l-4.4-7c-18.5-29.4-28.2-63.3-28.2-98.2 0-101.7 82.8-184.5 184.6-184.5 49.3 0 95.6 19.2 130.4 54.1 34.8 34.9 56.2 81.2 56.1 130.5 0 101.8-84.9 184.6-186.6 184.6zm101.2-138.2c-5.5-2.8-32.8-16.2-37.9-18-5.1-1.9-8.8-2.8-12.5 2.8-3.7 5.6-14.3 18-17.6 21.8-3.2 3.7-6.5 4.2-12 1.4-32.6-16.3-54-29.1-75.5-66-5.7-9.8 5.7-9.1 16.3-30.3 1.8-3.7.9-6.9-.5-9.7-1.4-2.8-12.5-30.1-17.1-41.2-4.5-10.8-9.1-9.3-12.5-9.5-3.2-.2-6.9-.2-10.6-.2-3.7 0-9.7 1.4-14.8 6.9-5.1 5.6-19.4 19-19.4 46.3 0 27.3 19.9 53.7 22.6 57.4 2.8 3.7 39.1 59.7 94.8 83.8 35.2 15.2 49 16.5 66.6 13.9 10.7-1.6 32.8-13.4 37.4-26.4 4.6-13 4.6-24.1 3.2-26.4-1.3-2.5-5-3.9-10.5-6.6z"/></svg></button><button title="Share on Pinterest" data-sharer="pinterest" data-url="https://www.adamstas.com/please-use-dnssec/"><svg class="icon"
162    xmlns="http://www.w3.org/2000/svg" viewBox="0 0 496 512"><!-- Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) --><path d="M496 256c0 137-111 248-248 248-25.6 0-50.2-3.9-73.4-11.1 10.1-16.5 25.2-43.5 30.8-65 3-11.6 15.4-59 15.4-59 8.1 15.4 31.7 28.5 56.8 28.5 74.8 0 128.7-68.8 128.7-154.3 0-81.9-66.9-143.2-152.9-143.2-107 0-163.9 71.8-163.9 150.1 0 36.4 19.4 81.7 50.3 96.1 4.7 2.2 7.2 1.2 8.3-3.3.8-3.4 5-20.3 6.9-28.1.6-2.5.3-4.7-1.7-7.1-10.1-12.5-18.3-35.3-18.3-56.6 0-54.7 41.4-107.6 112-107.6 60.9 0 103.6 41.5 103.6 100.9 0 67.1-33.9 113.6-78 113.6-24.3 0-42.6-20.1-36.7-44.8 7-29.5 20.5-61.3 20.5-82.6 0-19-10.2-34.9-31.4-34.9-24.9 0-44.9 25.7-44.9 60.2 0 22 7.4 36.8 7.4 36.8s-24.5 103.8-29 123.2c-5 21.4-3 51.6-.9 71.2C65.4 450.9 0 361.1 0 256 0 119 111 8 248 8s248 111 248 248z"/></svg></button><button title="Share on Tumblr" data-sharer="tumblr" data-url="https://www.adamstas.com/please-use-dnssec/" data-title="Please Use DNSSEC"><svg class="icon"
163    xmlns="http://www.w3.org/2000/svg" viewBox="0 0 320 512"><!-- Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) --><path d="M309.8 480.3c-13.6 14.5-50 31.7-97.4 31.7-120.8 0-147-88.8-147-140.6v-144H17.9c-5.5 0-10-4.5-10-10v-68c0-7.2 4.5-13.6 11.3-16 62-21.8 81.5-76 84.3-117.1.8-11 6.5-16.3 16.1-16.3h70.9c5.5 0 10 4.5 10 10v115.2h83c5.5 0 10 4.4 10 9.9v81.7c0 5.5-4.5 10-10 10h-83.4V360c0 34.2 23.7 53.6 68 35.8 4.8-1.9 9-3.2 12.7-2.2 3.5.9 5.8 3.4 7.4 7.9l22 64.3c1.8 5 3.3 10.6-.4 14.5z"/></svg></button><button title="Share on Reddit" data-sharer="reddit" data-url="https://www.adamstas.com/please-use-dnssec/"><svg class="icon"
164    xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512"><!-- Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) --><path d="M201.5 305.5c-13.8 0-24.9-11.1-24.9-24.6 0-13.8 11.1-24.9 24.9-24.9 13.6 0 24.6 11.
1641 24.6 24.9 0 13.6-11.1 24.6-24.6 24.6zM504 256c0 137-111 248-248 248S8 393 8 256 119 8 256 8s248 111 248 248zm-132.3-41.2c-9.4 0-17.7 3.9-23.8 10-22.4-15.5-52.6-25.5-86.1-26.6l17.4-78.3 55.4 12.5c0 13.6 11.1 24.6 24.6 24.6 13.8 0 24.9-11.3 24.9-24.9s-11.1-24.9-24.9-24.9c-9.7 0-18 5.8-22.1 13.8l-61.2-13.6c-3-.8-6.1 1.4-6.9 4.4l-19.1 86.4c-33.2 1.4-63.1 11.3-85.5 26.8-6.1-6.4-14.7-10.2-24.1-10.2-34.9 0-46.3 46.9-14.4 62.8-1.1 5-1.7 10.2-1.7 15.5 0 52.6 59.2 95.2 132 95.2 73.1 0 132.3-42.6 132.3-95.2 0-5.3-.6-10.8-1.9-15.8 31.3-16 19.8-62.5-14.9-62.5zM302.8 331c-18.2 18.2-76.1 17.9-93.6 0-2.2-2.2-6.1-2.2-8.3 0-2.5 2.5-2.5 6.4 0 8.6 22.8 22.8 87.3 22.8 110.2 0 2.5-2.2 2.5-6.1 0-8.6-2.2-2.2-6.1-2.2-8.3 0zm7.7-75c-13.6 0-24.6 11.1-24.6 24.9 0 13.6 11.1 24.6 24.6 24.6 13.8 0 24.9-11.1 24.9-24.6 0-13.8-11-24.9-24.9-24.9z"/></svg></button><button title="Share on Instapaper" data-sharer="instapaper" data-url="https://www.adamstas.com/please-use-dnssec/" data-title="Please Use DNSSEC" data-description=""><svg class="icon" role="img" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><title>Instapaper</title><path d="M14.766 20.259c0 1.819.271 2.089 2.934 2.292V24H6.301v-1.449c2.666-.203 2.934-.473 2.934-2.292V3.708c0-1.784-.27-2.089-2.934-2.292V0h11.398v1.416c-2.662.203-2.934.506-2.934 2.292v16.551z"/></svg></button><button title="Share on Flipboard" data-sharer="flipboard" data-url="https://www.adamstas.com/please-use-dnssec/" data-title="Please Use DNSSEC"><svg class="icon"
165    xmlns="http://www.w3.org/2000/svg" viewBox="0 0 448 512"><!-- Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) --><path d="M0 32v448h448V32H0zm358.4 179.2h-89.6v89.6h-89.6v89.6H89.6V121.6h268.8v89.6z"/></svg></button><button title="Share on Evernote" data-sharer="evernote" data-url="https://www.adamstas.com/please-use-dnssec/" data-title="Please Use DNSSEC"><svg class="icon"
166    xmlns="http://www.w3.org/2000/svg" viewBox="0 0 384 512"><!-- Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) --><path d="M120.82 132.21c1.6 22.31-17.55 21.59-21.61 21.59-68.93 0-73.64-1-83.58 3.34-.56.22-.74 0-.37-.37L123.79 46.45c.38-.37.6-.22.38.37-4.35 9.99-3.35 15.09-3.35 85.39zm79 308c-14.68-37.08 13-76.93 52.52-76.62 17.49 0 22.6 23.21 7.95 31.42-6.19 3.3-24.95 1.74-25.14 19.2-.05 17.09 19.67 25 31.2 24.89A45.64 45.64 0 0 0 312 393.45v-.08c0-11.63-7.79-47.22-47.54-55.34-7.72-1.54-65-6.35-68.35-50.52-3.74 16.93-17.4 63.49-43.11 69.09-8.74 1.94-69.68 7.64-112.92-36.77 0 0-18.57-15.23-28.23-57.95-3.38-15.75-9.28-39.7-11.14-62 0-18 11.14-30.45 25.07-32.2 81 0 90 2.32 101-7.8 9.82-9.24 7.8-15.5 7.8-102.78 1-8.3 7.79-30.81 53.41-24.14 6 .86 31.91 4.18 37.48 30.64l64.26 11.15c20.43 3.71 70.94 7 80.6 57.94 22.66 121.09 8.91 238.46 7.8 238.46C362.15 485.53 267.06 480 267.06 480c-18.95-.23-54.25-9.4-67.27-39.83zm80.94-204.84c-1 1.92-2.2 6 .85 7 14.09 4.93 39.75 6.84 45.88 5.53 3.11-.25 3.05-4.43 2.48-6.65-3.53-21.85-40.83-26.5-49.24-5.92z"/></svg></button><button title="Share on Trello" data-sharer="trello" data-url="https://www.adamstas.com/please-use-dnssec/" data-title="Please Use DNSSEC" data-description=""><svg class="icon"
167    xmlns="http://www.w3.org/2000/svg" viewBox="0 0 448 512"><!-- Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) --><path d="M392.3 32H56.1C25.1 32 0 57.1 0 88c-.1 0 0-4 0 336 0 30.9 25.1 56 56 56h336.2c30.8-.2 55.7-25.2 55.7-56V88c.1-30.8-24.8-55.8-55.6-56zM197 371.3c-.2 14.7-12.1 26.6-26.9 26.6H87.4c-14.8.1-26.9-11.8-27-26.6V117.1c0-14.8 12-26.9 26.9-26.9h82.9c14.8 0 26.9 12 26.9 26.9v254.2zm193.1-112c0 14.8-12 26.9-26.9 26.9h-81c-14.8 0-26.9-12-26.9-26.9V117.2c0-14.8 12-26.9 26.8-26.9h81.1c14.8 0 26.9 12 26.9 26.9v142.1z"/></svg></button>
167<script>
168        function shareOnMastodon(title, link) {
169            const SHARE_MASTODON_DOMAIN = "share_mastodon_domain"
170            const savedDomain = localStorage.getItem(SHARE_MASTODON_DOMAIN) ?? "mastodon.social";
171            const domain = prompt("Enter your Mastodon domain", savedDomain);
172            if (domain === null) {
173                return;
174            }
175            localStorage.setItem(SHARE_MASTODON_DOMAIN, domain)
176            const text = title + "\n\n" + link;
177            const url = new URL("https://" + domain)
178            url.pathname = "share"
179            url.searchParams.append('text', text)
180            window.open(url, '_blank', "width=500,height=500,left=500,toolbar=0,status=0");
181        }
182    </script>
182
183    <button title="Share on Mastodon"onclick="javascript:shareOnMastodon(&#34;Please Use DNSSEC&#34;, &#34;https://www.adamstas.com/please-use-dnssec/&#34;)"><svg class="icon"
184    xmlns="http://www.w3.org/2000/svg" viewBox="0 0 448 512"><!-- Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) --><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.54 102.54 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5zm-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg></button></div>
185        </div>
186    </div>
187
188    <div class="post-info-more">
189        <section class="post-tags"></section>
190        <section class="print:!tw-hidden">
191            <span><button class="tw-text-fgColor-link-muted hover:tw-text-fgColor-link-muted-hover" onclick="window.history.back();">Back</button></span>&nbsp;|&nbsp;<span><a href="/">Home</a></span>
192        </section>
193    </div>
194
195    <div class="post-nav print:tw-hidden"><a href="/infineon-yubikey-cloning-vulnerability/" class="prev" rel="prev" title="Infineon / YubiKey Cloning Vulnerability"><svg class="icon"
196    xmlns="http://www.w3.org/2000/svg" viewBox="0 0 256 512"><!-- Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) --><path d="M31.7 239l136-136c9.4-9.4 24.6-9.4 33.9 0l22.6 22.6c9.4 9.4 9.4 24.6 0 33.9L127.9 256l96.4 96.4c9.4 9.4 9.4 24.6 0 33.9L201.7 409c-9.4 9.4-24.6 9.4-33.9 0l-136-136c-9.5-9.4-9.5-24.6-.1-34z"/></svg>Infineon / YubiKey Cloning Vulnerability</a></div>
197</div>
198<div id="comments" class="print:!tw-hidden tw-pt-32 tw-pb-8"></div></article></main><footer class="footer">
199        <div class="footer-container"><div class="footer-line">
200                    Powered by <a href="https://gohugo.io/" target="_blank" rel="noopener noreferrer" title="Hugo 0.147.7">Hugo</a>&nbsp;|&nbsp;Theme - <a href="https://github.com/HEIGE-PCloud/DoIt" target="_blank" rel="noopener noreferrer" title="DoIt 0.4.2"><svg class="icon"
201    xmlns="http://www.w3.org/2000/svg" viewBox="0 0 576 512"><!-- Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) --><path d="M402.3 344.9l32-32c5-5 13.7-1.5 13.7 5.7V464c0 26.5-21.5 48-48 48H48c-26.5 0-48-21.5-48-48V112c0-26.5 21.5-48 48-48h273.5c7.1 0 10.7 8.6 5.7 13.7l-32 32c-1.5 1.5-3.5 2.3-5.7 2.3H48v352h352V350.5c0-2.1.8-4.1 2.3-5.6zm156.6-201.8L296.3 405.7l-90.4 10c-26.2 2.9-48.5-19.2-45.6-45.6l10-90.4L432.9 17.1c22.9-22.9 59.9-22.9 82.7 0l43.2 43.2c22.9 22.9 22.9 60 .1 82.8zM460.1 174L402 115.9 216.2 301.8l-7.3 65.3 65.3-7.3L460.1 174zm64.8-79.7l-43.2-43.2c-4.1-4.1-10.8-4.1-14.8 0L436 82l58.1 58.1 30.9-30.9c4-4.2 4-10.8-.1-14.9z"/></svg> DoIt</a>
202                </div><div class="footer-line"><svg class="icon"
203    xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512"><!-- Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) --><path d="M256 8C119.033 8 8 119.033 8 256s111.033 248 248 248 248-111.033 248-248S392.967 8 256 8zm0 448c-110.532 0-200-89.451-200-200 0-110.531 89.451-200 200-200 110.532 0 200 89.451 200 200 0 110.532-89.451 200-200 200zm107.351-101.064c-9.614 9.712-45.53 41.396-104.065 41.396-82.43 0-140.484-61.425-140.484-141.567 0-79.152 60.275-139.401 139.762-139.401 55.531 0 88.738 26.62 97.593 34.779a11.965 11.965 0 0 1 1.936 15.322l-18.155 28.113c-3.841 5.95-11.966 7.282-17.499 2.921-8.595-6.776-31.814-22.538-61.708-22.538-48.303 0-77.916 35.33-77.916 80.082 0 41.589 26.888 83.692 78.277 83.692 32.657 0 56.843-19.039 65.726-27.225 5.27-4.857 13.596-4.039 17.82 1.738l19.865 27.17a11.947 11.947 0 0 1-1.152 15.518z"/></svg>2019 - 2025<span class="author">&nbsp;<a href="https://www.adamstas.com" target="_blank" rel="noopener noreferrer">Adam Stasiniewicz</a></span>&nbsp;|&nbsp;<span class="license"><a rel="license external nofollow noopener noreffer" href="https://creativecommons.org/licenses/by-nc/4.0/" target="_blank">CC BY-NC 4.0</a></span></div>
204            <div class="footer-line"></div>
205            <div class="footer-line">
206            </div>
207        </div></footer><div class="print:!tw-hidden tw-flex tw-flex-col tw-fixed tw-right-4 tw-bottom-4 tw-gap-2"><a href="#back-to-top" id="back-to-top-button" class="tw-transition-opacity tw-opacity-0 tw-block tw-bg-bgColor-secondary tw-rounded-full" style="padding: 0.6rem; line-height: 1.3rem; font-size: 1rem;" title="Back to Top">
208      <svg class="icon"
209    xmlns="http://www.w3.org/2000/svg" viewBox="0 0 448 512"><!-- Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) --><path d="M34.9 289.5l-22.2-22.2c-9.4-9.4-9.4-24.6 0-33.9L207 39c9.4-9.4 24.6-9.4 33.9 0l194.3 194.3c9.4 9.4 9.4 24.6 0 33.9L413 289.4c-9.5 9.5-25 9.3-34.3-.4L264 168.6V456c0 13.3-10.7 24-24 24h-32c-13.3 0-24-10.7-24-24V168.6L69.2 289.1c-9.3 9.8-24.8 10-34.3.4z"/></svg>
210  </a>
211
212  <button id="toc-drawer-button" class="tw-block tw-bg-bgColor-secondary tw-rounded-full md:tw-hidden" style="padding: 0.6rem; line-height: 1.3rem; font-size: 1rem;">
213      <svg class="icon"
214    xmlns="http://www.w3.org/2000/svg" viewBox="0 0 448 512"><!-- Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) --><path d="M16 132h416c8.837 0 16-7.163 16-16V76c0-8.837-7.163-16-16-16H16C7.163 60 0 67.163 0 76v40c0 8.837 7.163 16 16 16zm0 160h416c8.837 0 16-7.163 16-16v-40c0-8.837-7.163-16-16-16H16c-8.837 0-16 7.163-16 16v40c0 8.837 7.163 16 16 16zm0 160h416c8.837 0 16-7.163 16-16v-40c0-8.837-7.163-16-16-16H16c-8.837 0-16 7.163-16 16v40c0 8.837 7.163 16 16 16z"/></svg>
215  </button><a href="#comments" id="view-comments" class="tw-block tw-bg-bgColor-secondary tw-rounded-full" style="padding: 0.6rem; line-height: 1.3rem; font-size: 1rem;" title="View Comments">
216      <svg class="icon"
217    xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512"><!-- Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) --><path d="M256 32C114.6 32 0 125.1 0 240c0 49.6 21.4 95 57 130.7C44.5 421.1 2.7 466 2.2 466.5c-2.2 2.3-2.8 5.7-1.5 8.7S4.8 480 8 480c66.3 0 116-31.8 140.6-51.4 32.7 12.3 69 19.4 107.4 19.4 141.4 0 256-93.1 256-208S397.4 32 256 32z"/></svg>
218  </a></div>
219<link rel="stylesheet" href="/lib/katex/katex.min.css"><link rel="preload" as="style" onload="this.onload=null;this.rel='stylesheet'" href="/lib/katex/copy-tex.min.css">
220        <noscript><link rel="stylesheet" href="/lib/katex/copy-tex.min.css"></noscript>
221<script>window.config={"comment":{},"math":{"delimiters":[{"display":true,"left":"$$","right":"$$"},{"display":true,"left":"\\[","right":"\\]"},{"display":false,"left":"$","right":"$"},{"display":false,"left":"\\(","right":"\\)"}],"strict":false},"sharerjs":true,"table":{"sort":true}};</script>
221<script
222    src="/lib/tablesort/tablesort.min.js"
223    
224  ></script>
224<script
225    src="/lib/sharer/sharer.min.js"
226    
227  ></script>
227<script
228    src="/lib/katex/katex.min.js"
229    
230      defer
231    
232  ></script>
232<script
233    src="/lib/katex/auto-render.min.js"
234    
235      defer
236    
237  ></script>
237<script
238    src="/lib/katex/copy-tex.min.js"
239    
240      defer
241    
242  ></script>
242<script
243    src="/lib/katex/mhchem.min.js"
244    
245      defer
246    
247  ></script>
247<script
248    src="/js/katex.min.js"
249    
250      defer
251    
252  ></script>
252<script
253    src="/js/theme.min.js"
254    
255      defer
256    
257  ></script>
257
258
259<script type="speculationrules">
260  {
261    "prerender": [
262      {
263        "where": { "href_matches": "/*" },
264        "eagerness": "moderate"
265      }
266    ]
267  }
268</script>
268
269<!-- Cloudflare Pages Analytics -->
vendor: 99 bytes, line 269
269<script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token": "
26928596e46c0b147c8b796bb7d04c1a329
vendor: 13 bytes, line 269
269"}'></script>
269<!-- Cloudflare Pages Analytics -->
269<script>(function(){function c(){var b=a.contentDocument||(a.contentWindow&&a.contentWindow.document);if(b){var d=b.createElement('script');d.innerHTML="window.__CF$cv$params={r:'a45ec780897d6e57',t:'MTc5MTIyNzk4MA=='};var a=document.createElement('script');a.src='/cdn-cgi/challenge-platform/scripts/jsd/main.js';document.getElementsByTagName('head')[0].appendChild(a);";b.getElementsByTagName('head')[0].appendChild(d)}}if(document.body){var a=document.createElement('iframe');a.height=1;a.width=1;a.style.position='absolute';a.style.top=0;a.style.left=0;a.style.border='none';a.style.visibility='hidden';document.body.appendChild(a);if('loading'!==document.readyState)c();else if(window.addEventListener)document.addEventListener('DOMContentLoaded',c);else{var e=document.onreadystatechange||function(){};document.onreadystatechange=function(b){e(b);'loading'!==document.readyState&&(document.onreadystatechange=e,c())}}}})();</script>
269<script type="module" src="https://static.cloudflareinsights.com/beacon.min.js/v31edd6df95cf4e85bb4c19e7a9bdbcba1788362987495" integrity="sha512-iIg7k2xntmwu6/uSb5tpc/hySgZc4eoL31yB29W6tJFo2akwjPWcEqnCEdJvGexCL0KEQwVYv5BlowfhVz26hg==" data-cf-beacon='{"version":"2024.11.0","token":"9671db6ecd7a4afc9395dfc9836821ef","r":1,"spa":2}' crossorigin="anonymous"></script>
269
270</body>
271
272</html>

Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.