When checking on a few domains, DNSSEC is not mandatory. I wonder is there is plan to introduce it, use multivantage, or how it would work with a broken chain.
My mental model is that the registry mapping from did to domain handles is maintained by bluesky right now - so it’s whether their server does validation
DNSSEC would prevent tampering on the DNS answer, and some account impersonation.
With the key stored in bluesky db at the moment, that's fine as long as their resolver is trusted, which we don't have a view into. DNSSEC would allow more transparency.
Comments
Not clear what DNSSEC would add other than guarantee that 90% of users would have trouble with it!
With the key stored in bluesky db at the moment, that's fine as long as their resolver is trusted, which we don't have a view into. DNSSEC would allow more transparency.