Demi Marie Obenouralwayscurious@infosec.exchange
Jun 23, 2026, 2:06 AMReplies
- Demi Marie Obenouralwayscurious@infosec.exchangeJun 23, 2026, 2:13 AM
@filippo @cks As an aside, I think encrypted client hello might be the long term solution. If a firewall cannot inspect anything at all, ossification can’t happen.
Then it’s “just” a matter of making DNSSEC mandatory everywhere and refusing exceptions for anything that isn’t a private domain (
.internal,.corp.arpa,.home.arpa, etc). 
Jun 23, 2026, 2:26 AM@alwayscurious @filippo I don't believe DNSSEC and thus ECH is happening in general, at least not any time soon. Among other issues, it's too operationally fragile.
(.de blew its own feet off recently, for example. If a major country domain screws it up, what small organization wants to touch it?)
Jun 23, 2026, 7:45 AM@cks @alwayscurious DNSSEC is definitely not happening, but ECH doesn’t need DNSSEC, DoH works for most threat models and has better privacy against the network.