I have a suggestion

[woshidadi2026]

Concern/Question

My suggestion is to enable DNSSEC for your DNS. For example, https://ctif.hagezi.org/dns-query and so on. Enabling DNSSEC isn’t that hard, right?

Terms

• I confirm that the request does not contain any sexually explicit material or private/sensitive information.
• I confirm that the request does not contain any clickable links to malware, phishing, scams, or similar malicious content. Any potentially harmful URLs have been deliberately masked (e.g., by replacing “.” with “[.]”) to prevent accidental access. I have reviewed all included links and taken appropriate precautions to ensure user safety.

[hagezi]

The name servers provided by Name.com do not support DNSSEC. Enabling DNSSEC would therefore require migrating to external name servers. At this time, I do not see sufficient benefit to justify the additional effort and potential risks involved.

[woshidadi2026]

The name servers provided by Name.com do not support DNSSEC. Enabling DNSSEC would therefore require migrating to external name servers. At this time, I do not see sufficient benefit to justify the additional effort and potential risks involved.

You said DNSSEC isn’t supported, and I’ve checked that it indeed isn’t supported, but why is there strict DNSSEC verification in the README?

[hagezi]

@woshidadi2026

Either you're comparing apples to oranges, or we're simply talking past each other here.

My DNS servers enforce strict DNSSEC validation, meaning any domain resolved through them has passed DNSSEC validation. This only works, of course, if DNSSEC is actually supported by the domain being queried. If validation fails, resolution is refused (strict mode). That's the highest level of DNSSEC security a DNS server can offer. You can verify this strict validation yourself at dnscheck.tools.

If you run this test, use multiple resolvers, and one of them does not fully support DNSSEC, some tests will fail.

If you restricted resolution to only domains that are actually DNSSEC-signed, your internet connection would effectively be dead - because only about 6.5% of domains currently support DNSSEC.

DNSSEC is therefore enabled on all my DNS servers, and you will always receive a validated response as long as the domain you're resolving is DNSSEC-signed.

DNSSEC-validated response:

kdig -d @162.55.58.40 +dnssec +multi +tls-host=ctif.hagezi.org kuketz-blog.de

;; DEBUG: Querying for owner(kuketz-blog.de.), class(1), type(1), server(162.55.58.40), port(853), protocol(TCP)
;; DEBUG: TLS, imported 150 system certificates
;; DEBUG: TLS, received certificate hierarchy:
;; DEBUG:  #1, CN=ctif.hagezi.org
;; DEBUG:      SHA-256 PIN: rSXCd/Oka+x3LZvVg9Tf5EzCwrRRRlr8Fz3NUfykFKU=
;; DEBUG:  #2, C=US,O=Let's Encrypt,CN=YR1
;; DEBUG:      SHA-256 PIN: LoMHBotttiDko50Gi13uXW71eIy7LAttI+rYT8wXF4w=
;; DEBUG:  #3, C=US,O=ISRG,CN=Root YR
;; DEBUG:      SHA-256 PIN: fk6IOKit1ild5647BH06ujSIq5XbCgqlbYl6ANhhi88=
;; DEBUG: TLS, skipping certificate PIN check
;; DEBUG: TLS, The certificate is trusted.
;; TLS session (TLS1.3)-(ECDHE-X25519)-(RSA-PSS-RSAE-SHA256)-(AES-256-GCM)
;; ->>HEADER<<- opcode: QUERY; status: NOERROR; id: 17956
;; Flags: qr rd ra ad; QUERY: 1; ANSWER: 2; AUTHORITY: 0; ADDITIONAL: 1

;; EDNS PSEUDOSECTION:
;; Version: 0; flags: do; UDP size: 1232 B; ext-rcode: NOERROR

;; QUESTION SECTION:
;; kuketz-blog.de.       IN A

;; ANSWER SECTION:
kuketz-blog.de.         21226 IN A 46.38.242.112
kuketz-blog.de.         21226 IN RRSIG A 8 2 86400 20260726093000 (
                                20260625093000 23298 kuketz-blog.de.
                                EiwjPsWC8jGu16w+PZfZN8weF0fcLNx7sNFRhvky
                                A9kHFVkd5V2idiGYM8J3ot1U53ySPMGpLIFwa53U
                                S0a/n49AFVxflmhyhqsKLKUH/3nVJr5l+4JM1Noq
                                zD2AgpH4ntBLXyhSeAbIj0vhH9ql9VzYaVWs4g/i
                                rEanFDa6avI=
                                )

;; Received 233 B
;; Time 2026-07-12 07:15:34 UTC
;; From 162.55.58.40@853(TLS) in 10.3 ms

Response from a malformed DNSSEC zone:

kdig -d @162.55.58.40 +dnssec +tls-host=ctif.hagezi.org dnssec-failed.org

;; DEBUG: Querying for owner(dnssec-failed.org.), class(1), type(1), server(162.55.58.40), port(853), protocol(TCP)
;; DEBUG: TLS, imported 150 system certificates
;; DEBUG: TLS, received certificate hierarchy:
;; DEBUG:  #1, CN=ctif.hagezi.org
;; DEBUG:      SHA-256 PIN: rSXCd/Oka+x3LZvVg9Tf5EzCwrRRRlr8Fz3NUfykFKU=
;; DEBUG:  #2, C=US,O=Let's Encrypt,CN=YR1
;; DEBUG:      SHA-256 PIN: LoMHBotttiDko50Gi13uXW71eIy7LAttI+rYT8wXF4w=
;; DEBUG:  #3, C=US,O=ISRG,CN=Root YR
;; DEBUG:      SHA-256 PIN: fk6IOKit1ild5647BH06ujSIq5XbCgqlbYl6ANhhi88=
;; DEBUG: TLS, skipping certificate PIN check
;; DEBUG: TLS, The certificate is trusted.
;; TLS session (TLS1.3)-(ECDHE-X25519)-(RSA-PSS-RSAE-SHA256)-(AES-256-GCM)
;; ->>HEADER<<- opcode: QUERY; status: SERVFAIL; id: 34481
;; Flags: qr rd ra; QUERY: 1; ANSWER: 0; AUTHORITY: 0; ADDITIONAL: 1

;; EDNS PSEUDOSECTION:
;; Version: 0; flags: do; UDP size: 1232 B; ext-rcode: NOERROR
;; EDE: 9 (DNSKEY Missing): 'Attack detected! No SEP matching the DS found for dnssec-failed.org'
;; EDE: 3 (Stale Answer): 'dnssec-failed.org A IN'

;; QUESTION SECTION:
;; dnssec-failed.org.           IN      A

;; Received 147 B
;; Time 2026-07-12 07:18:29 UTC
;; From 162.55.58.40@853(TLS) in 16.8 ms

That said, this has nothing to do with whether I offer DNSSEC signing on my own domain used for DNS, such as ctif.hagezi.org. The hagezi.org domains aren't DNSSEC-signed because name.com - the registrar and nameserver provider I use - doesn't support it.

[woshidadi2026]

@woshidadi2026

Either you're comparing apples to oranges, or we're simply talking past each other here.

My DNS servers enforce strict DNSSEC validation, meaning any domain resolved through them has passed DNSSEC validation. This only works, of course, if DNSSEC is actually supported by the domain being queried. If validation fails, resolution is refused (strict mode). That's the highest level of DNSSEC security a DNS server can offer. You can verify this strict validation yourself at dnscheck.tools.

If you run this test, use multiple resolvers, and one of them does not fully support DNSSEC, some tests will fail.

If you restricted resolution to only domains that are actually DNSSEC-signed, your internet connection would effectively be dead - because only about 6.5% of domains currently support DNSSEC.

DNSSEC is therefore enabled on all my DNS servers, and you will always receive a validated response as long as the domain you're resolving is DNSSEC-signed.

DNSSEC-validated response:

kdig -d @162.55.58.40 +dnssec +multi +tls-host=ctif.hagezi.org kuketz-blog.de

;; DEBUG: Querying for owner(kuketz-blog.de.), class(1), type(1), server(162.55.58.40), port(853), protocol(TCP)
;; DEBUG: TLS, imported 150 system certificates
;; DEBUG: TLS, received certificate hierarchy:
;; DEBUG:  #1, CN=ctif.hagezi.org
;; DEBUG:      SHA-256 PIN: rSXCd/Oka+x3LZvVg9Tf5EzCwrRRRlr8Fz3NUfykFKU=
;; DEBUG:  #2, C=US,O=Let's Encrypt,CN=YR1
;; DEBUG:      SHA-256 PIN: LoMHBotttiDko50Gi13uXW71eIy7LAttI+rYT8wXF4w=
;; DEBUG:  #3, C=US,O=ISRG,CN=Root YR
;; DEBUG:      SHA-256 PIN: fk6IOKit1ild5647BH06ujSIq5XbCgqlbYl6ANhhi88=
;; DEBUG: TLS, skipping certificate PIN check
;; DEBUG: TLS, The certificate is trusted.
;; TLS session (TLS1.3)-(ECDHE-X25519)-(RSA-PSS-RSAE-SHA256)-(AES-256-GCM)
;; ->>HEADER<<- opcode: QUERY; status: NOERROR; id: 17956
;; Flags: qr rd ra ad; QUERY: 1; ANSWER: 2; AUTHORITY: 0; ADDITIONAL: 1

;; EDNS PSEUDOSECTION:
;; Version: 0; flags: do; UDP size: 1232 B; ext-rcode: NOERROR

;; QUESTION SECTION:
;; kuketz-blog.de.       IN A

;; ANSWER SECTION:
kuketz-blog.de.         21226 IN A 46.38.242.112
kuketz-blog.de.         21226 IN RRSIG A 8 2 86400 20260726093000 (
                                20260625093000 23298 kuketz-blog.de.
                                EiwjPsWC8jGu16w+PZfZN8weF0fcLNx7sNFRhvky
                                A9kHFVkd5V2idiGYM8J3ot1U53ySPMGpLIFwa53U
                                S0a/n49AFVxflmhyhqsKLKUH/3nVJr5l+4JM1Noq
                                zD2AgpH4ntBLXyhSeAbIj0vhH9ql9VzYaVWs4g/i
                                rEanFDa6avI=
                                )

;; Received 233 B
;; Time 2026-07-12 07:15:34 UTC
;; From 162.55.58.40@853(TLS) in 10.3 ms

Response from a malformed DNSSEC zone:

kdig -d @162.55.58.40 +dnssec +tls-host=ctif.hagezi.org dnssec-failed.org

;; DEBUG: Querying for owner(dnssec-failed.org.), class(1), type(1), server(162.55.58.40), port(853), protocol(TCP)
;; DEBUG: TLS, imported 150 system certificates
;; DEBUG: TLS, received certificate hierarchy:
;; DEBUG:  #1, CN=ctif.hagezi.org
;; DEBUG:      SHA-256 PIN: rSXCd/Oka+x3LZvVg9Tf5EzCwrRRRlr8Fz3NUfykFKU=
;; DEBUG:  #2, C=US,O=Let's Encrypt,CN=YR1
;; DEBUG:      SHA-256 PIN: LoMHBotttiDko50Gi13uXW71eIy7LAttI+rYT8wXF4w=
;; DEBUG:  #3, C=US,O=ISRG,CN=Root YR
;; DEBUG:      SHA-256 PIN: fk6IOKit1ild5647BH06ujSIq5XbCgqlbYl6ANhhi88=
;; DEBUG: TLS, skipping certificate PIN check
;; DEBUG: TLS, The certificate is trusted.
;; TLS session (TLS1.3)-(ECDHE-X25519)-(RSA-PSS-RSAE-SHA256)-(AES-256-GCM)
;; ->>HEADER<<- opcode: QUERY; status: SERVFAIL; id: 34481
;; Flags: qr rd ra; QUERY: 1; ANSWER: 0; AUTHORITY: 0; ADDITIONAL: 1

;; EDNS PSEUDOSECTION:
;; Version: 0; flags: do; UDP size: 1232 B; ext-rcode: NOERROR
;; EDE: 9 (DNSKEY Missing): 'Attack detected! No SEP matching the DS found for dnssec-failed.org'
;; EDE: 3 (Stale Answer): 'dnssec-failed.org A IN'

;; QUESTION SECTION:
;; dnssec-failed.org.           IN      A

;; Received 147 B
;; Time 2026-07-12 07:18:29 UTC
;; From 162.55.58.40@853(TLS) in 16.8 ms

That said, this has nothing to do with whether I offer DNSSEC signing on my own domain used for DNS, such as . The domains aren't DNSSEC-signed because - the registrar and nameserver provider I use - doesn't support it.ctif.hagezi.org``hagezi.org``name.com

OK