Ask HN: Secure DNS resolution in a system
Run your own resolver locally, with DNSSEC enabled.<p>Assuming the RRs for the domains you are querying are signed, that&#x27;s (IMO) probably all you need to do. While OCSP happens over plain-text HTTP, the responses are also signed so that you can verify them.<p>If the CA isn&#x27;t using DNSSEC for their zones (or, specifically, the RRs for the hosts listed in the URIs in the signed certificates), I don&#x27;t think there&#x27;s much more you can really do (as the DNS queries&#x2F;responses will travel over the Internet &quot;in the clear&quot; -- and, thus, subject to tampering&#x2F;modification).<p>Or am I missing some part of your process that could potentially be compromised that you&#x27;re trying to protect against?<p>Also, an attacker could block your HTTP requests (for CRL downloads&#x2F;OCSP queries). How does your application react when it doesn&#x27;t get a response? &quot;Fail open&quot; or &quot;fail closed&quot;?