<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><br></div>Wouldn't IPSEC, OpenVPN or SSL up to the task without requiring new protocols and new software ? <div><br></div><div><br></div><div>Rubens</div><div><br><div><div>On Dec 6, 2011, at 1:17 PM, David Ulevitch wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Friends --<div><br></div><div>Today we introduced a preview of DNSCrypt (<a href="http://www.opendns.com/technology/dnscrypt">http://www.opendns.com/technology/dnscrypt</a>). The goal of DNSCrypt is to provide encryption of all DNS traffic between stubs and resolvers, a growing and often overlooked problem that has bugged us for some time. TSIG was one consideration, but ultimately, we went for a simpler route for now. Our design follows much of the design outlined here: <a href="http://dnscurve.org/out-implement.html">http://dnscurve.org/out-implement.html</a></div><div><br></div><div>It's lightweight, strives for UDP, and the code is being pushed to Github today so others can check it out.</div><div><br></div><div>It's complementary to DNSSEC, doesn't attempt to address verification or validation, but it does provide encryption which helps prevent snooping, replay, filtering and man-in-the-middle attacks. This is the first in a number of releases we have planned around security in the coming year and we're interested in feedback.</div><div><br></div><div>Check it out! </div><div><br></div><div>Thanks,</div><div>David</div><div><br></div><div><br></div></div>_______________________________________________<br>dns-operations mailing list<br><a href="mailto:dns-operations@lists.dns-oarc.net">dns-operations@lists.dns-oarc.net</a><br>https://lists.dns-oarc.net/mailman/listinfo/dns-operations<br>dns-jobs mailing list<br>https://lists.dns-oarc.net/mailman/listinfo/dns-jobs</blockquote></div><br></div></body></html>