Protocols, security incidents, and how the internet actually works. 147 posts.
DNSSEC's proof that a name doesn't exist accidentally leaks the names that do. NSEC3 hashed them to stop zone walking — and offline cracking walked right through it. Here's why RFC 9276 tells you to set iterations to zero, and what actually works.
ICANN finally reserved .internal for private networks in July 2024. It kills the name-collision risk that haunted .corp and .home — but it's a reservation, not a special-use domain, so the query leaks are still your problem.
Nothing in DNS tells a browser where a registry stops and someone's website begins. So the entire web leans on a single hand-maintained text file to draw that line — for cookies, for certificates, for who can impersonate whom.
In 2023 Google's resolver quietly started asking for wIKiPEDiA.oRG instead of wikipedia.org. It's not a bug — it's a 15-year-old anti-spoofing hack that never became a standard, works anyway, and shipped because it needs permission from absolutely no one.
A decade ago DNS got a cheap defense against spoofed answers and reflection attacks. Your resolver almost certainly supports it. It almost certainly doesn't require it — and that gap between 'supports' and 'requires' is the whole story.
One crafted DNS packet could freeze a validating resolver for hours. KeyTrap wasn't a coding mistake — it was a requirement in the DNSSEC spec whose roots go back to 1999.
Every CDN wants you to point your root domain at a hostname. DNS has forbidden exactly that since 1987 — so the industry built a pile of non-standard hacks, and the one real fix still doesn't work in your browser.
Every DNS server between you and a site used to see the full name you typed — even the ones that only needed the TLD. One resolver-side change fixed most of that, and unlike DNSSEC, it shipped without asking anyone's permission.
ECH finally encrypts the one field HTTPS always leaked — the site name. But your IP, your DNS lookup, and the size of the crowd you hide in decide whether it means anything.
Turning on Secure DNS in Chrome encrypts the pipe to your resolver. It does nothing to prove the answer coming back is true. Encryption and authentication are different problems, and browsers quietly picked one.
The HTTPS DNS record hands your browser connection parameters — which protocol, which IPs, even the key that encrypts your ClientHello — before the handshake starts. For most domains, it arrives over a layer nobody signed.
DNSSEC's real problem isn't cryptography. It's a two-party handshake between your DNS host and your registrar that almost nobody completes — and automation already fixes it.