| ▲ | Arainach 2 hours ago | |
Not if Quad9 is using DNSSEC, no. What's the specific threat you're envisioning? If it involves Quad9 themselves being malicious, what would DNSSEC on the forwarding prevent? This page explains how all of this works in detail: https://quad9.net/news/blog/quad9-enables-dnssec-on-all-serv... | ||
| ▲ | zamadatix 2 hours ago | parent [-] | |
DNSSEC validation on your forwarder would prevent a maliciously modified record from Quad9 (or others) from being accepted locally - i.e. "Quad9 can poison my DNS". I've always been of two minds on this. On one hand, that concern is beyond any reasonable level of security/performance/reliability tradeoff for most any user. At the same time, it is a bit of a shame DNS doesn't have a more scalable & performant approach to security which can just always be done without having to consider it a tradeoff, however minor in practice. | ||