That&#x27;s not really my argument.<p>DNSSEC will kill any meaningful future work in <i>DNS security</i>, but like I keep saying, I&#x27;m not anti-DNSSEC because I&#x27;m pro-DNSCurve; I just think DNS security is a stupid problem. Draw a layer diagram of TCP&#x2F;IP up through HTTPS. <i>Somewhere</i> on that diagram you have to draw a line and say &quot;below this line we&#x27;re not going to attempt cryptographic security&quot;. That&#x27;s not a new insight; it&#x27;s basically the core argument of Saltzer-Reed-Clark, the foundational design paper for the Internet.<p>I tried to keep my issues with DNSSEC terse and clean here:<p><a href="http:&#x2F;&#x2F;sockpuppet.org&#x2F;blog&#x2F;2015&#x2F;01&#x2F;15&#x2F;against-dnssec&#x2F;" rel="nofollow">http:&#x2F;&#x2F;sockpuppet.org&#x2F;blog&#x2F;2015&#x2F;01&#x2F;15&#x2F;against-dnssec&#x2F;</a><p>They are:<p>* It doesn&#x27;t solve an important problem.<p>* It does create a new government-controlled PKI, which some people will depend on, to the detriment of safety and privacy.<p>* It&#x27;s a cryptographically weak protocol designed by 90s-non-cryptographers.<p>* It breaks applications, as &#x27;peterwwillis has been pointing out here for days.<p>* It&#x27;s so expensive to deploy that Cloudflare is the biggest news to happen to it in 21 years.<p>* It doesn&#x27;t protect browser lookups.<p>* It doesn&#x27;t encrypt DNS requests and, in fact, actually forces sites to reveal <i>more</i> about their hosts than normal DNS does.<p>* Like I said up top, it&#x27;s architecturally incoherent in a way that the End to End paper actually used as its motivating example all the way back in 1981.<p>I have spent a lot of time over the past 10 years arguing with people about DNSSEC. I&#x27;m not just making random stuff up in HN threads about this. You&#x27;re probably not going to &quot;gotcha&quot; me on any of this.