[$] Supporting secure DNS in glibc One of the many weak links in Internet security is the domain name system
(DNS); it is subject to attacks that, among other things, can mislead
applications regarding the IP address of a system they wish to connect to.
That, in turn, can cause connections to go to the wrong place, facilitating
man-in-the-middle attacks and more. The
DNSSECprotocol extensions are meant to address this threat by setting up a
cryptographically secure chain of trust for DNS information. When DNSSEC
is set up properly, applications should be able to trust the results of
domain lookups. As the discussion over
an
attempt to better integrate DNSSEC into the GNU C Library shows,
though, ensuring that DNS lookups are safe is still not a straightforward
problem.