The race to secure record-like information for domains
Signed MX adoption is 12.3% in the Tranco top 1,000 and 1.4% of .COM, so apps cannot assume DNSSEC.
A Fox Loop Software post argues developers still lack a widely available way to bind secured key-value records to domain names. DNS TXT records can hold the data, but securing them depends on DNSSEC, which the author’s new dashboard shows is uncommon in most measured cohorts. Web apps can instead publish HTTPS .well-known files. Email cannot use that pattern: unsigned MX records leave the path from a sender domain to the receiving server’s TLS name unauthenticated, so MTA transit encryption stays opportunistic.
Unconfirmed: The author explicitly sets aside debate over whether DNSSEC’s cryptographic properties are sufficient.
- Signed MX rates: Tranco top 1,000 12.3%, top 1,000,000 7.5%, .COM 1.4%, .GOV 10.4%, .SE 62.8%.
- About 80% of domains host email on another domain, often Google or Microsoft.
- SPF, DKIM, and DMARC TXT records do not require DNSSEC.
- End-to-end encryption does not cover envelope addresses used when relaying mail.
- Organizations
- Fox Loop Software
From the original article
12 min read at alexsci.comIt’s sort of surprising, but we’re still figuring out how to secure simple, record-like information for domain names in an application-accessible way. Think about it. How would you bind the following to a domain name?
By alexsci.com by robalex · alexsci.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.