DNSSEC: Complexities and Considerations

What this post added

This post details the complexities of DNSSEC, specifically the zone content exposure problem caused by NSEC and NSEC3 records. It explains how NSEC records can be used to enumerate all subdomains in a zone, and how NSEC3, while intended to mitigate this, can still be vulnerable to dictionary attacks on hashed domain names. The post also discusses the concept of 'DNSSEC white lies' as a potential mitigation, which requires real-time signing capabilities on authoritative DNS servers, a departure from traditional offline signing methods.