2026-09-08 · 6 min read
ds-watch: a transparency log for DNSSEC's trust chain
Certificate Transparency has watched the web PKI since 2013. DNSSEC has the same structural problem and no equivalent. I built a small observatory, ds-watch, that photographs the DNS trust chain every day and publishes every change as a public, registry-signed log. It's now running in production against three gTLD zones.
#dnssec#dns#transparency#security#ietf
read post →