Re: [Resolverless-dns] Paper on Resolver-less DNS

["John Levine" <[e-mail]>]

In article <[e-mail]> you write:
>-=-=-=-=-=-
>-=-=-=-=-=-
>
>Thanks for conducting this investigation, Erik!
>
>In my view, the two main concerns with resolverless architectures have been
>(1) simplifying stolen key attacks and (2) potential interference with
>DNS-based load balancing.

I also like the paper but it misses the largest concern with
resolverless DNS: it circumvents DNS based access controls.  I realize
this is not a popular position in the IETF, but there are lots of
perfectly good reasons that networks provide filtered DNS.  Even
though it has usually been technically easy to circumvent, most people
don't and it's been good enough.  If it's widely circumvented, we can
expect much more intrusive filtering with a lot more collateral damage.

R's,
John