Announcing Universal DNSSEC: Secure DNS for Every Domain

This post announces the general availability of Universal DNSSEC for all Cloudflare users, aiming to secure DNS for every domain. It highlights the vulnerability of traditional DNS to on-path attacks and introduces DNSSEC as a solution. The post details the delegation of trust in DNSSEC and the manual process of activation, which involves copying keys between Cloudflare and registrar dashboards. To address this friction and promote wider adoption, Cloudflare has published an Internet Draft proposing a protocol for direct communication between DNS providers and registries/registrars. This protocol aims to automate DNSSEC activation, with initial support from registries like .ca, .cl, and .ee. The post also mentions early adoption by registrars like OVH and Hover, and the use of ECDSA as Cloudflare's chosen cipher for DNSSEC.