1. Recommend *every* recursive server holds a copy of the root zone.
The problem is more general than that. It is not only the root (well,
the sniffers along the path to the root name servers), it is a
recursive-to-authoritative problem. Your solution does not work for
.com or even .fr.
It seems to me there are two separate problems here. One is channel
security, preventing parties other than the two endpoints of the
transaction from knowing its contents, which we know how to address by
encryption, e.g. with TLS.
The other is query security, preventing the server from knowing who's
asking the question, and ideally from knowing what question is being
asked. Applying Mark's suggestion recursively we end up back at
HOSTS.TXT, a ship that sailed so long ago that its rotted timbers are now
the subject of learned archaeological investigations.
Tor is one approach to query security that seems to work pretty well give
or take side channel leakage. Dunno if there are any others, but it is
clearly a very hard problem, and not one we're going to solve any time
soon.
Regards,
John Levine, jo...@taugh.com, Taughannock Networks, Trumansburg NY
Please consider the environment before reading this e-mail.
_______________________________________________
DNSOP mailing list
DNSOP@ietf.org
https://www.ietf.org/mailman/listinfo/dnsop
