A screenshot of a DNS-checking tool that reports a bunch of test results. For the “good signature” test, there are failing test results for ECDSA P-256, ECDSA P-384, and Ed25519.

Notices where this attachment appears

1. Embed this notice
   Waldo Jaquith (waldoj@mastodon.social)'s status on Thursday, 31-Oct-2024 12:32:22 JST Waldo Jaquith

   in reply to

   Here’s a hint as to what’s wrong with system-level networking services on macOS 15.1: Safari has inconsistent DNSSEC signature problems, while Chrome and Firefox (which use their own networking engines) do not. Every query has a different subset of signature problems.

   I think I'm too rusty on cryptography implementation to meaningfully debug this further; here's hoping Apple patches this soon.