[Cerowrt-devel] Had to disable dnssec today

Aaron Wood woody77 at gmail.com
Sat Apr 26 07:38:08 EDT 2014


Just too many sites aren't working correctly with dnsmasq and using
Google's DNS servers.

- Bank of America (sso-fi.bankofamerica.com)
- Weather Underground (cdnjs.cloudflare.com)
- Akamai (e3191.dscc.akamaiedge.net.0.1.cn.akamaiedge.net)

And I'm not getting any traction with reporting the errors to those sites,
so it's frustrating in getting it properly fixed.

While Akamai and cloudflare appear to be issues with their entries in
google dns, or with dnsmasq's validation of them being insecure domains,
the BofA issue appears to be an outright bad key.  And BofA isn't being
helpful (just a continual "we use ssl" sort of quasi-automated response).

So I'm disabling it for now, or rather, falling back to using my ISP's dns
servers, which don't support DNSSEC at this time.  I'll be periodically
turning it back on, but too much is broken (mainly due to the cdns) to be
able to rely on it at this time.

-Aaron
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.bufferbloat.net/pipermail/cerowrt-devel/attachments/20140426/7f705f09/attachment-0002.html>


More information about the Cerowrt-devel mailing list