Bitcoin Stack Exchange is a question and answer site for Bitcoin crypto-currency enthusiasts. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm interested in the most secure and reliable Namecoin DNS resolution as possible, although I admit I don't fully understand how these concepts relate to each other (Namecoin and DNS)

Is DNSSec needed or possible with Namecoin based DNS services? Would that come at a higher "cost" (more namecoins are needed?)

share|improve this question
Do you mean TLS/SSL? – kermit Mar 24 '13 at 14:18
@phelix No. A hacked DNS makes TLS/SSL insecure. DNSSec prevents a hacked DNS and makes TLS/SSL (HTTPS) more secure – LamonteCristo Mar 24 '13 at 15:47
I meant TLS/SSL via namecoin. How could namecoin dns NOT be secure? It is blockchain-secured. – kermit Mar 24 '13 at 22:09
@phelix The link between the host and the recursive resolver is the weak link and can be hacked. Not the resolver and the namecoin lookup proxy (not Bind <--> namecoind) – LamonteCristo Mar 24 '13 at 22:46
@phelix So when is Namecoin going to get a reboot? I think you're one of the devs there no? Reboot = different design. – LamonteCristo Mar 24 '13 at 22:46

No DNSSec is not needed with Namecoin. The mapping from name to IP cannot be forged.

However, DNSSec requires changes to resolver libraries so the domains are actually cryptographically verified.

Namecoin, to be secure, requires similar changes to resolver libraries because nothing in the current resolver libraries actually checks the integrity of the results.

Anyone can run software to verify that a traditional (insecure, no cryptography) nameserver that resolves .bit addresses actually return addresses corresponding to the blockchain.

Thus namecoin name servers can be ensured to not "fool all the people all the time" by having some servers that continuously check the integrity of the results produced by the insecure but backwards compatible nameserver.

share|improve this answer
This answer is incomplete. Yes, Name/IP mappings in Namecoin are protected, but if you use the 'ns' type instead of 'ip', this is like an insecure delegation in DNSSEC - making the original question valid. – Habbie Oct 7 '13 at 9:24

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.