Their validity period is defined by both the TTL and certificate s expiration date. If either indicates an expired certificate then the certificate must be revalidated. The TTL mechanism is used to reduce the online bandwidth requirements of the DNS, however it does present a window of opportunity for a revoked certificate to be falsely considered as valid. The time it takes for the change to propagate throughout the system is at most the largest TTL of the changed entries. The DNS certificate identifies the owner of a public key by assigning the key a DNS name.
Strong authentication is provided as long as a DNS name resolution only passes through secure zones.
The more such zones a resolution passes through, the less its result can be trusted, so the secure DNS requires that if a shorter resolution path is found, then any longer ones should be discarded in its favor. This key is usually the zone key of the domain in which the resolver resides. Anonymity Anonymity was not a design goal of the secure DNS, although it does not make anonymity impossible to achieve. The secure DNS extensions are very new and time will tell whether they succeed in providing a general PKI that does more than add security to the DNS database. Already the Internet is encountering limitations in the naming system.