DNSSEC in a click: Cloudflare tries to crack uptake inertia

Namecheap + Cloudflare = easy DNSSEC

Just double checked my domains and Namecheap supports DNSSEC out of the box (but only for 14 TLDs at the moment). A few clicks and I had all five domains configured in about 10 minutes total.

GoDaddy Confusing

Cloudflare link to GoDaddy's page on how to setup a DS record, however, like so many GoDaddy help files, it's outdated = \

https://ph.godaddy.com/help/add-a-ds-record-23865

One thing to note Digest Type shows only as a 1 or 2 in GoDaddy but Cloudflare say it should be SHA256 (the help page helpfully doesn't say what 1 or 2 is) - the long way around I found this means it's 2, when using 1 I got an error emailed "Invalid SHA-1 digest".

Timeout you can seemingly ignore, again, help page is of no help, but not entering a figure hasn't stopped me from being able to configure.

So, if you want to setup with GoDaddy as your host, that'll help. Now, to get my employer's to migrate to a better host...

I used this cloudflare 'secure' dns for a few days til one of my favorite websites, NASA Worldviewer, kept blowing up, and I found a bunch of DNS errors in nasa.gov only on the 1.1.x.x servers not on other public servers like 8.8.x.x

I have a few domains

At both register.com & godaddy. If they had a simple and fully supported one click "make your domain DNSSEC" I'd do it. But I'm not going to mess around for hours trying to figure out some complicated process to do it for domains no one is ever going to try to hijack, and risk that maybe things will change and my domain will break because it isn't really supported. I certainly won't pay more for it.

Hopefully Cloudflare will start a trend.

Ah, key rollovers

I've watched an attempted live key rollover a couple of years back. It failed, and the expert doing it didn't know why. Good luck everyone :-)

in large part because DNS providers don't see much of an upside to offering it

Too right.

There is only one thing which DNSSEC can do, and that is to give SERVFAIL responses to clients if DNSSEC validation fails.

Of course, if someone is actively trying to poison your DNS, that's what you want to happen; but much more likely it's because of a DNSSEC cockup that things fail. In other words, DNSSEC increases the risk that your users won't be able to access your site.

Protection against spoofing is already done at the transport/application layer, specifically HTTPS (which protects both against DNS manipulation and other attacks like MITM). And there are much simpler solutions to the DNS poisioning problem too, like DNS cookies.

Kudos to Cloudflare

DNSSEC really needs to be widely adopted (this issue is even more important than getting everyone to use HTTPS, in my opinion), and I'm happy to see a big player making noises about this. I will continue to distrust Cloudflare and won't be using their DNS servers, but perhaps this effort will get other DNS providers to get on board.

Is Cloudflare a web hosting service like Network Solutions or GoDaddy?

Should we move our very small domain to Cloudflare?

We are NOT techies. All I know is that I like Cloudflare's 1-1-1-1 DNS lookup service.