Philip, [replying with no hat at all]
that was exactly my thought when I skimmed through the draft. The draft claims that LocalRoot provided Significant or Complete protection in the case of "a region may become disconnected". I think this is simply not true. Root Zone is only a small but significant part of the DNS and saying that everything will be peachy because ccTLD might be available doesn't match my experience when I worked for ccTLD. Additionally, I think this document misses only class of "mitigations" and that would be "RSS improvements". I find it wrong that this document is being done without a cooperation from Root Server Operators. There's RSSAC - what does RSSAC think about the document and LocalRoot? Just recently I've seen a complaint that IETF is not talking to the operators and this is causing IETF to become irrelevant, and this is operational change so I think operators should be involved. Ondrej -- Ondřej Surý (He/Him) [email protected] A gentle nudge is always appreciated if I take a little longer to reply. > On 2. 6. 2026, at 16:25, Philip Homburg <[email protected]> wrote: > >> Having analysed root-server >> traffic via DITL data, I am acutely aware about the need for >> *complete* privacy protection. Since the best way to keep things >> secret is not to tell anyone, I see that LocalRoot fulfills that >> promise. The other methods go a long way, but do not stop your >> queries from ending up in, say, DITL data. > > What I find problematic is that only a small part of query traffic is > considered. > > Most DNS queries do not just go to the root and stop there. Queries continue > TLDs, SLDs, etc. > > For an on path attacker, does a local root provide much protection? Not > really, the attacker will see the query go to the TLD. > > With local root, root operators will not see the query but operators of > TLDs will. Are root operators less trustworthy than TLDs operators. It seems > that the answer is yes because root operators participate in DITL. So > may be a local root is a good idea. > > When considering all upstream traffic of a resolver to answer a query, > is the improvement provided by a local root significant? > > _______________________________________________ > DNSOP mailing list -- [email protected] > To unsubscribe send an email to [email protected] _______________________________________________ DNSOP mailing list -- [email protected] To unsubscribe send an email to [email protected]
