--- title: Ignore DNSSEC if you like MITM attacks | daily.dev description: A personal argument for why DNSSEC should be enabled and validated by default, drawing parallels to the historical resistance against HTTPS adoption. Without... canonical: https://daily.dev/posts/ignore-dnssec-if-you-like-mitm-attacks-rnstz9usx twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Ignore DNSSEC if you like MITM attacks | daily.dev og:description: A personal argument for why DNSSEC should be enabled and validated by default, drawing parallels to the historical resistance against HTTPS adoption. Without... og:url: https://daily.dev/posts/ignore-dnssec-if-you-like-mitm-attacks-rnstz9usx og:image: https://api.daily.dev/og/posts/rNsTZ9Usx.png og:image:alt: Ignore DNSSEC if you like MITM attacks og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Ignore DNSSEC if you like MITM attacks **[Lobsters](https://daily.dev/sources/lobsters)** · 4 min read · 1 upvotes · 0 comments ## Summary A personal argument for why DNSSEC should be enabled and validated by default, drawing parallels to the historical resistance against HTTPS adoption. Without DNSSEC validation, attackers can spoof DNS responses to redirect email clients (via SRV records), email servers (via MX records), and Matrix federation to attacker-controlled servers — all while TLS handshakes succeed normally, making the attack invisible to users. XMPP is noted as an exception due to its certificate delegation model. The author criticizes OS and distribution defaults for not enabling local DNSSEC validation, and recommends running a local validating resolver like unbound or unwind rather than relying on third-party resolvers. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why is XMPP not vulnerable to the same DNS-spoofing MITM attack that affects email and Matrix? XMPP requires that a server accepting delegated traffic for a domain present a TLS certificate for that original domain, not for the target domain it delegates to. Because of this, even if DNS responses are spoofed, an attacker without a valid certificate for the victim's domain can only cause a denial of service, not intercept traffic, unlike Matrix and email delegation via SRV/MX records. _Comparing protocol trust models like this is easier with daily.dev surfacing security deep dives on DNS and messaging protocols._ ### How can DNS spoofing be used to intercept email without DNSSEC? An attacker can poison DNS responses for SRV records used to resolve IMAP/SMTP servers, pointing an email client to a server like smtp.evilattacker.com; since that server presents a valid certificate for its own spoofed domain, the TLS handshake succeeds normally and the interception goes unnoticed. On the sending side, poisoning MX record responses can similarly redirect outgoing mail, though anti-spam behavior tends to leave more evidence of that attack. _Developers hardening mail infrastructure can track DNSSEC and email security writeups like this through daily.dev._ ## Similar posts on daily.dev - [DNSSEC Validation for SSL Certificates: CA/B Forum Ballot SC-085 Changes in March 2026](https://daily.dev/posts/dnssec-validation-for-ssl-certificates-ca-b-forum-ballot-sc-085-changes-in-march-2026-r1t6gyhzl) · Security Boulevard · 0 upvotes · 0 comments - [Cert Authorities Check for DNSSEC From Today](https://daily.dev/posts/cert-authorities-check-for-dnssec-from-today-eznwdfeb9) · Hacker News · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#dns](https://daily.dev/tags/dns) [View this post on daily.dev](https://daily.dev/posts/ignore-dnssec-if-you-like-mitm-attacks-rnstz9usx) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Ignore DNSSEC if you like MITM attacks","url":"https://daily.dev/posts/ignore-dnssec-if-you-like-mitm-attacks-rnstz9usx","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/ignore-dnssec-if-you-like-mitm-attacks-rnstz9usx"},"datePublished":"2026-06-26T02:16:15.777Z","dateModified":"2026-09-14T07:11:55.950Z","description":"A personal argument for why DNSSEC should be enabled and validated by default, drawing parallels to the historical resistance against HTTPS adoption. Without...","image":"https://media.daily.dev/image/upload/s--foaA6JGU--/f_auto/v1722860399/public/Placeholder%2004","thumbnailUrl":"https://media.daily.dev/image/upload/s--foaA6JGU--/f_auto/v1722860399/public/Placeholder%2004","isAccessibleForFree":true,"articleSection":"Lobsters","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Lobsters","logo":"https://media.daily.dev/image/upload/s--tl8v_Fku--/f_auto,t_logo/v1698841318/logos/lobste.jpg","url":"https://daily.dev/sources/lobsters"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/ignore-dnssec-if-you-like-mitm-attacks-rnstz9usx","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,dns","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Lobsters","item":"https://daily.dev/sources/lobsters"},{"@type":"ListItem","position":3,"name":"Ignore DNSSEC if you like MITM attacks"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/ignore-dnssec-if-you-like-mitm-attacks-rnstz9usx#faq","mainEntity":[{"@type":"Question","name":"Why is XMPP not vulnerable to the same DNS-spoofing MITM attack that affects email and Matrix?","acceptedAnswer":{"@type":"Answer","text":"XMPP requires that a server accepting delegated traffic for a domain present a TLS certificate for that original domain, not for the target domain it delegates to. Because of this, even if DNS responses are spoofed, an attacker without a valid certificate for the victim's domain can only cause a denial of service, not intercept traffic, unlike Matrix and email delegation via SRV/MX records. Comparing protocol trust models like this is easier with daily.dev surfacing security deep dives on DNS and messaging protocols."}},{"@type":"Question","name":"How can DNS spoofing be used to intercept email without DNSSEC?","acceptedAnswer":{"@type":"Answer","text":"An attacker can poison DNS responses for SRV records used to resolve IMAP/SMTP servers, pointing an email client to a server like smtp.evilattacker.com; since that server presents a valid certificate for its own spoofed domain, the TLS handshake succeeds normally and the interception goes unnoticed. On the sending side, poisoning MX record responses can similarly redirect outgoing mail, though anti-spam behavior tends to leave more evidence of that attack. Developers hardening mail infrastructure can track DNSSEC and email security writeups like this through daily.dev."}}]} ```