Dot-Com Domains Still Lack DNSSEC Security

13.04.2011

In a statement, Google told me that they "think that DNSSEC is important," and that they're actively looking into it, but declined to give details of when, how, or even if it will happen.

Ultimately, upgrading to DNSSEC is a series of chicken-and-egg situations. Nobody in the chain, from end-user to Website operators, is compelled to make any changes right now.

For example, I run a but the hosting service I use doesn't yet offer DNSSEC, so I can't upgrade even if I wanted to. The hosting service probably won't offer DNSSEC until people like me start demanding it.

Even once it's available, I'll have to think hard about implementing DNSSEC because it'll add a small but significant cost to running a Website, not to mention complexity. However, the cost could be folded into domain registration fees, removing this cost for all but the bottom-dollar registrars.

Upgrading my domains to DNSSEC at the moment is an academic exercise, because very few DNS resolvers offered by ISPs around the world support DNSSEC. In other words, I can make the switch but it would make no difference to visitors. So, why should I?