Domains Should verify with DNS.

Question

Domains Should verify with DNS.

CitizenPrayer opened this issue 4 years ago · comments

Unfortunately the only way to sign a key for a domain with keys.pub currently is via uploading a file to a server. This does not verify a domain, this simply verifies that a domain is linked to a server, in which case the server can be changed, swapped, etc. This is a security vulnerability, and ought to be corrected. Keys need to be signed in coordination with the DNS records themselves, so that servers are not involved.

Gabriel Handford · Answer 1 · Sun May 10 2020 02:24:35 GMT+0800 (China Standard Time)

Should I change the "Link to Domain (https)" option to "Link to Website (https)", and then add the DNS option: "Link to Domain (dns)"?

I am sort of following what Keybase had as options for proofs.

Pavol Rusnak · Answer 2 · Mon May 11 2020 01:57:27 GMT+0800 (China Standard Time)

Should I change the "Link to Domain (https)" option to "Link to Website (https)", and then add the DNS option: "Link to Domain (dns)"?

This sounds awesome! Maybe the tool should only accept DNSSEC domains?

Jordan Ellis Coppard · Answer 3 · Mon Aug 24 2020 12:57:54 GMT+0800 (China Standard Time)

@prusnak IIRC only some TLDs -- beit gTLD or ccTLD -- support DNSSEC so enforcing DNSSEC only would render certain verifications impossible.