Re: [Resolverless-dns] Paper on Resolver-less DNS

[Anne Bennett <[e-mail]>]

Paul Vixie <[e-mail]> writes:

> i'll want to see how the network operator's policies for
> dns monitoring and filtering will be reliably detected,
> and respected.

I would think this to be an impossible task; if I as a network
operator am redirecting all port 53 traffic to my resolvers,
which use various filtering policies to, for example, redirect
queries for known phishing and malware sites to my local
"don't be phished" web page, what on earth mechanism could
possibly exist that could mirror my policies in this context?

While I believe in the bona fide of the people advocating for
resolverless DNS, and I don't doubt that there are performance
bottlenecks that could be alleviated with such a scheme, as a
sysadmin I feel almost as if these designs were specifically
created to prevent me from protecting my users.  :-(


Anne.
-- 
Ms. Anne Bennett, Senior Sysadmin, ENCS, Concordia University, Montreal H3G 1M8
[e-mail]                                    [phone] x2285