…r an <ip> value where the actual domain's record would evaluate to "fail". See [RFC3833] for a description of DNS weaknesses, and see [RFC4033] for a countermeasure. o The client IP address, <ip>, is assumed to be correct. In a modern, correctly configured system, the risk of thi…

… an <ip> value where the actual domain's record would evaluate to "fail". See [ RFC3833 ] for a description of DNS weaknesses, and see [ RFC4033 ] for a countermeasure. o The client IP address, <ip>, is assumed to be correct. In a modern, correctly configured system, the risk of …

…Security Considerations A Threat Analysis of the Domain Name System is found in RFC3833 This analysis was written before the development of DoT, DoH, and DoQ, and probably needs to be updated. The security considerations of DoQ should be comparable to those of DoT RFC7858 . DoT a…

…tacks against the DNS must be considered. While the DNS is currently insecure [ RFC3833 ], these security problems are the motivation behind DNS Security (DNSSEC) [ RFC4033 ], and all users of the DNS will reap the benefit of that work. DKIM is only intended as a "sufficient" met…