DNSSEC validation in Go: I wrote my own validator and didn't go completely insane

▤ Summary

This article introduces a DNSSEC validator built in Go for VantageDNS, a privacy-focused recursive DNS service. It explains how DNSSEC validation works, including trust chains, DNSKEY, DS, RRSIG, and NSEC/NSEC3 handling. It also covers implementation details such as validation logic, performance considerations, caching, and edge cases like time skew and broken signatures. The piece closes by highlighting deployment tradeoffs and showing how the service exposes DNSSEC validation as an opt-in feature.

▦ Linked Companies