Communicator at deSEC's ICANN-supported project “Closing the DNSSEC Maturity Gap through Automation”
Joined May 2025
- Tweets43
- Following33
- Followers4
- Likes3
As it happens, DNSSEC needs a little help to finally get the deployment it deserves. And that’s exactly what our project means to do: both on the technical side (through automation) and on the communication side (through community outreach). So off we go! #DNSSEC
However, should you want to engage in discussing the facts stated in this article about DNSSEC today, this would be very welcome - preferably in the comment section of the article itself.
Which is indeed a statement about the blog's presence and influence, but not exactly about "attribution", as you framed it. Hence, there is no need to be embarrassed for the authors of this piece.
However, we find that people won't take that look if they cling on a set of beliefs inherited from a decade-old reality - beliefs that mostly match the claims that "Against DNSSEC" materialized (and helped harden, despite of ongoing work on the protocol).
How about a bit of grey instead of black and white? We at deSEC (and from the number of endorsers of the article, you will find that we are not alone) think DNSSEC today is worth a second look.
Common beliefs on DNSSEC are rooted in its turbulent past, and have persisted for over a decade.
But how well do they reflect DNSSEC’s reality today?
Fact-checking time!
> This is the second article in our series on DNSSEC.
Enjoy - and keep tuned for article #3 and #4! <
COMMON BELIEFS ABOUT DNSSEC PUT TO THE TEST: AN INVITATION TO FACT-CHECK YOUR ASSUMPTIONS
—
More trouble than it’s worth? Fact is: DNSSEC in 2026 bears little resemblance to its turbulent early years.
by Barbara Jantzen
circleid.com/posts/common-be…
If we want a more secure Internet by default, DNSSEC needs automation at scale.
Get a grasp of best current practice: blog.apnic.net/2026/02/25/to…
Standards like CDS/CDNSKEY already exist. Some ccTLDs have proven automated models work. What’s missing is broad, coordinated implementation — with support from bodies like ICANN.
The opportunity? Treat DNSSEC like TLS. Automation — similar to what Let's Encrypt did for HTTPS — can dramatically reduce friction, prevent errors, and accelerate adoption.
DNSSEC has been around for 20+ years — so why isn’t it everywhere yet?
Our new piece at APNIC highlights the real blocker: complex, manual processes that make deployment harder than it should be.
Deployment of technical standards is surprisingly emotional and narrative-driven. Can’t believe it? Here you go!
#DNS #DNSSEC #CircleID
THE EXCRUCIATING SLOW RISE OF DNSSEC: A DIALOGUE WITH ROY ARENDS ABOUT MYTHS, REALITIES AND HARD LESSONS
—
DNSSEC was meant to fix DNS, but hype, outages, and online narratives turned it into a punchline. Can fresh perspectives and automation revive trust?
A dialogue between Roy Arends, a long-time DNSSEC advocate and Barbara Jantzen:
circleid.com/posts/the-excru…
In the near future, I will create a funny (but factually accurate) Fakebook on DNSSEC history. Think of it as a fictitious Facebook wall, on which any person, institution or entity imaginable (God, the DNS, the Objective Truth) can enter the stage as a contributor or commentator.
Still looking for good and/or silly ideas to nourish my Fakebook project (see below)! So, in case you should get all meditative and inventive under the Christmas tree (or whatever you do at this time of year), send me your thoughts (via comment or PM)!
In the near future, I will create a funny (but factually accurate) Fakebook on DNSSEC history. Think of it as a fictitious Facebook wall, on which any person, institution or entity imaginable (God, the DNS, the Objective Truth) can enter the stage as a contributor or commentator.
And here's the draft in question: datatracker.ietf.org/doc/dra…
At DNS-#OARC45, my colleague Peter Thomassen presented his updated draft on DNSSEC automation guidelines – that will maximize interoperability and minimize surprise. If that doesn’t sound like DNSSEC to your ears, go check it out!
youtube.com/watch?v=zQyrcVOf…
#DNS #DNSSEC #automation
After making people laugh about DNSSEC at IETF 123’s pecha kucha night, I was given the opportunity, at DNS-OARC 45, to talk about why it’s not a good idea to neglect the impact of image and emotions, even when dealing with technical DNS matters: youtube.com/watch?v=3HoHF45I…