21–22 of 22 posts
Earlier quoted context omitted.
I noticed PowerDNS in the mix, can you say what backend you are using with PowerDNS and how that has been?
We use the mysql backend and http API, a few small nits but for our purposes it has worked very well thus far. Note that our authorities never see production traffic outside of AXFRs from our "edge" hosts so I can't say how well it works for other use cases.
I'm curious if they're using DNSSec at all. I notice they're using Dynect for this, and in my experience DNSSec and Dyn do not get along (unless you're not using any of their special features like geotargeting), so it I'm interested in hearing how they've managed to get all that working.
I'm curious why people ask about DNSSEC support. None of the major browsers support validating it. Even to validate the DNSSEC records by yourself, there is only a single website available[1] (which doesn't even have TLS). I want DNSSEC to catch up, but adoption level is a joke. [1]: http://dnsviz.net
Adoption is slow, nobody argues there, but when you've set it up and have routines for rolling keys it's more or less self-maintained.
Google public DNS will return servfail if validation fails, which is a step in the right direction.
There are plenty of tools to validate dnssec, even with TLS [0]. But I'm not sure why you would need a webpage to do it. You can easily grab the root keys and validate the whole chain using dig on your own computer.