[Doh] Clarification re: "Opportunistic DNS"

[Dave Lawrence <[e-mail]>]

Adam Roach writes:
> If the DNS experts on this list could expand on the concerns about 
> poisoning in the context of DNSSEC, it would be greatly appreciated. 
> Feel free to reply directly to me, or on-list.

Honestly, I'm curious what the rationale *in the context of DNSSEC* is
as well, since from my point of view, what DNSSEC is giving you is an
indication that the records from the authority are authentic no matter
which way you got them, whether through your own iteration or on a
sheet of paper that that the RFC 2549 pigeon brought you.  

The Chain Query extension works under the very same principle: you
configure a trust anchor as the starting point, and are provided all
of the necessary chain-of-trust records necessary to validate the
final answer -- records which almost certainly all came from different
administrative authorities.