DNSSec (Comcast) vs DNSCurve (OpenDNS)

DNSSEC and DNSCurve address completely different aspects of DNS security.

First of all, DNSSEC does NOT sign your queries. Rather DNSSEC allows a zone (such as a domain) to be signed by its owner, and allows a resolver (for instance Comcast's DNS servers) to verify the signature, and therefore be sure that the zone data it gets is authentic. It protects the resolver from receiving bad data, but does nothing to prevent MITM or snooping between you and the resolver.

DNSCurve, on the other hand, encrypts communications between recursive resolvers and authoritative servers and allows authoritative servers to sign their data against forgery, but does nothing to protect an end-user client from a bad recursive resolver. OpenDNS's DNSCrypt solution is based on the same technology as DNSCurve, but protects the last-mile between a trusted 3rd party recursive resolver like OpenDNS and the end-client.

As for which is more secure, neither is. They are both secure, however the security is applied in different areas. In either case you are picking which aspect of DNS security is more important, rather than which security tool is stronger.

As for what you should do, that is something only you can decide, but do please consider the following:

  1. You could use Comcast's DNSSEC resolvers and hope no one snoops and MITMs the connection between your machine's and Comcast's resolvers.

  2. You could use OpenDNS's resolvers, connect to them using DNSCurve, and hope that no one feeds bad data to those resolvers, as they do not use DNSSEC. (To be fair, OpenDNS has a very good track record of preventing such attacks.)

  3. You could run your own resolver using freely available open source software such as BIND, PowerDNS, or Unbound; enable DNSSEC on said resolver; and keep the queries on your local network—or better yet, run a resolver on each machine. (This is the best option IMHO, as it addresses the weaknesses of both of the other two options)