<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p><br>
</p>
<div class="moz-cite-prefix">On 26/02/2025 19:00, Phillip
Hallam-Baker wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAMm+LwiqBycdxOEGg9DQU4f0wVN6-5FDS0bF0_W-Ftxp-6mndA@mail.gmail.com">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<div dir="ltr">
<div class="gmail_default" style="font-size:small"><br>
</div>
<div class="gmail_default" style="font-size:small"><br>
</div>
<div class="gmail_default" style="font-size:small">As part of
that, I wanted to know if there was any *existing* use of the
SSHFP record for publishing SSH credentials and if so whether
it was limited to the server. And yes, I can read the specs,
what I am asking about is actual practice.</div>
<div class="gmail_default" style="font-size:small"><br>
</div>
</div>
</blockquote>
<p><br>
</p>
<p>My personal opinion (that quite a few people disagree with) is
that SSHFP records can be trusted only if the application does
DNSSEC validation. However, implementations tend to rely on the AD
bit. For a while I had a fork of openssh that did do DNSSEC
validation but it was too much work to maintain.<br>
</p>
</body>
</html>