Conversation
disclose@infosec.exchange

disclose.io verified

Five years ago we proposed publishing your security contact in DNS, so a researcher can find the right reporting channel before they even load your site.

The 2026 update: records now live at _security.yourdomain, a security_expires freshness field is required, a Standards Track Internet-Draft is in the works, and a sweep found 181 domains publishing records in the wild.

https://blog.disclose.io/dns-security-txt-five-years-on/

1
0
0
jtk@infosec.exchange

John Kristoff

Reply to @disclose@infosec.exchange

@disclose What about putting this into whois/rdap? imo, that might be a far better place for this sort of thing than yet more overloading of TXT RRs.

1
0
0
johntimaeus@infosec.exchange

John Timaeus

Reply to @jtk@infosec.exchange

@jtk @disclose

Given the length of time it takes for ICANN to implement anything, this is probably better.

1
0
0
jtk@infosec.exchange

John Kristoff

Reply to @johntimaeus@infosec.exchange

@johntimaeus @disclose Not sure why ICANN needs to even be involved, maybe just something like this: https://www.rfc-editor.org/info/rfc7483/#section-4.2

@andy is an expert in this area and maybe could weigh in?

1
0
0
andy

Andy Newton

Reply to @jtk@infosec.exchange
@johntimaeus @disclose @jtk there have been recent discussions in the REGEXT working group and the RIPE DB list about pointing to info directly under the control of resource holders. Maybe that will work for this. Generally getting data into the “authoritative” server requires policy.

Putting contact data in DNS is not a new idea. The biggest issue is that very few people care to do it, and they don’t tend to be the people we really need to do it.
0
0
1
About NoVaLUG

The Northern Virginia Linux Users Group (NoVaLUG)

We are a curious, informal, and friendly mix of IT professionals, hobbyists, students, and others with an interest in Linux, Free and Open Source software, and open knowledge. The Northern Virginia Linux Users Group (NoVaLUG) is the oldest LUG in the Northern VA area and likely in the whole of US, established in 1993.

Obtaining an Account

Accounts on this server are limited to members of NoVaLUG. To get an invite link, you must do one of the following:

  1. Ask for a link at one of our meetings.
  2. Send a message on our mailing list asking for a link.
  3. Request an invite link in our Signal chat group.

Service Information

Users on this server may be referred to with the novalug.org domain name (e.g. "foo@novalug.org" or "@foo@novalug.org"). However, when using URLs, the full hostname of akk.novalug.org must be used (e.g. "https://akk.novalug.org/foo").

To use this server with other clients, such as mobile apps, use the full host name of akk.novalug.org.

If you prefer the "classic" Mastodon UI, go here.

Code of Conduct

Our rules are simple.

  1. Be kind, be courteous.
  2. No porn.
  3. No spam.
  4. No harassment.
  5. No illegal behavior.
  6. Users must be 13 years of age or older.
We reserve the right to reject, delete, moderate and take any other action necessary. Simply put, don't be a jerk!