Re: sources.list 's security line

To: debian-user@lists.debian.org
Subject: Re: sources.list 's security line
From: Ulf Volmer <u.volmer@u-v.de>
Date: Wed, 8 Sep 2021 20:28:18 +0200
Message-id: <[🔎] 6cf9314e-bce0-46f6-5f73-9452f5ef4ee1@u-v.de>
In-reply-to: <[🔎] CAD8GWstFW48LqPe3quyHoQaYBoJoVHoUuRZ5vv6c1Nrkmum0rA@mail.gmail.com>
References: <[🔎] CAD8U+g9Q+P1z8B2+07hEL7owvLNSM7DnbJhqt5ypgTrKUQ6veQ@mail.gmail.com> <[🔎] b14cc5ced10fce04921b7261cc410a42@dondley.com> <[🔎] 396504f48c2cb94c98dbee9f40b74c21b41e0574.camel@k4vqc.com> <[🔎] CAD8GWstFW48LqPe3quyHoQaYBoJoVHoUuRZ5vv6c1Nrkmum0rA@mail.gmail.com>

On 08.09.21 16:50, Lee wrote:

> Are you using a dnssec validating resolver?
> 
> It'd be nice of somebody that understands dnssec would double-check,
> but it looks like name lookups for security.debian.org has dnssec
> enabled and not enabled for deb.debian.org

deb.debian.org is a CNAME and this CNAME is correctly DNSSEC validated.
But this CNAME points to an A record outside of debian.org which is not
secured by DNSSEC.

Best regards
Ulf

Reply to:

Follow-Ups:
- Re: sources.list 's security line
  - From: Greg Wooledge <greg@wooledge.org>

References:
- sources.list 's security line
  - From: riveravaldez <riveravaldezmail@gmail.com>
- Re: sources.list 's security line
  - From: Steve Dondley <s@dondley.com>
- Re: sources.list 's security line
  - From: Jim Popovitch <jim@k4vqc.com>
- Re: sources.list 's security line
  - From: Lee <ler762@gmail.com>

Prev by Date: Re: masked service file
Next by Date: Re: sources.list 's security line
Previous by thread: Re: sources.list 's security line
Next by thread: Re: sources.list 's security line
Index(es):
- Date
- Thread