From an ability to respond to the query, you're absolutely right. Sending
all your DNS queries to multicast would be a bad idea. But this is specific
to .local, where any use of .local is aware of the fact that it is sent
unprotected over multicast and plans accordingly at the application layer.
David

On Fri, Mar 22, 2024 at 10:31 AM Tomas Volf <~@wolfsden.cz> wrote:

> On 2024-03-22 10:10:29 +1000, David Schinazi wrote:
> > > PS: which are the stakeholders contacted while the relevant standards
> > > brought in such hazardous default?
> >
> >
> > These RFCs went through the IETF Standards Track process, so the entire
> > IETF community was consulted when this was finalized around 2011-2012.
> >
> > I'd like to understand why you think this is hazardous though. mDNS only
> > applies to host names under .local - those names are not covered by
> DNSSEC,
> > and therefore any queries for them are always sent completely insecure.
> > Sending those queries over the wire to the configured DNS resolver has
> very
> > similar security properties to sending them over the wire as multicast.
>
> Please ignore my comment from the peanut gallery if it is totally off, but
> is it
> not a difference between being able to do MitM (for regular non-DNSSEC
> DNS) and
> just being on the same network (multicast)?  So the former only
> router/gateway
> can do, the latter anyone able to respond to the multicast?  Assuming my
> understanding is correct, that does not seem "very similar security
> properties".
>
> Have a nice day,
> Tomas Volf
>
> --
> There are only two hard things in Computer Science:
> cache invalidation, naming things and off-by-one errors.
>