{
  "id": 19241438,
  "title": "The race to secure record-like information for domains",
  "url": "https://urgent.news/2026/11/09/the-race-to-secure-record-like-information-for-domains",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-09T23:25:03.000Z",
  "source": {
    "name": "Lobsters",
    "slug": "lobsters",
    "url": "https://alexsci.com/blog/the-race-to-secure-record-like-information-for-domains/"
  },
  "original_language": "en",
  "account": "Securing domain names for application access remains a challenge. One classic solution involves adding configuration as TXT records using an underscored subdomain label to distinguish it from a hostname. However, this approach is not secure as DNS-based network interference is common. The recommended practice is DNSSEC, which employs cryptographic signing for security. Despite its advantages, DNSSEC adoption is not widespread, leaving many domains insecure.\n\nWhen an application developer needs secure domain names, they often turn to HTTPS .well-known approach as their web-based application already has an HTTPS secured endpoint. Fetching records is a simple HTTP GET request. However, this solution doesn't apply to all protocols.\n\nEmail, an old protocol, faces challenges in securing hostname mis-matches. When an MTA relays an email, it must discover the destination MTA using an MX record, which typically isn't secured. This leads to insecure connections, allowing certificate validation to fail. Without trust, certificate validation cannot succeed, leaving email susceptible to both passive eavesdropping and active attacks. The mismatch between the sending MTA's hostname and the recipient's email address prevents authenticated MTA-to-MTA transit encryption, which is crucial for secure email delivery.\n\nUnlike the web, email doesn't have a direct analogy to solve this issue. Web browsers can show certificate warnings to users, but MTAs have no such mechanism. Email providers tout transit encryption, but the lack of certificate validation makes email transmission insecure. A secure solution for securing hostname mismatches in email would enhance email security significantly.",
  "summary": null,
  "key_points": [
    "DNSSEC adoption is low, leaving domains insecure.",
    "Email relies on insecure MX records for hostname matching.",
    "Secure hostname mismatches in email could enhance email security."
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}