Paul, and other rootserveroperators (good scrabble word :), what would
your answer/problem/arguments/... be if an ISP would decide to inject
routes to the root-servers into their local network and point these
request to a local dns cache(s), which would have the correct routes to
the the global rootservers of course.
if someone injects 192.5.5.241 (or any route which covers it) anywhere
that a dns client will see it whose owner has not explicitly agreed to
have their f-root service modified in this way, and then modifies the
service (which means does something with the queries other than forward
them to an ISC-owned server) then we would of course file a lawsuit of
some kind, even if it meant opening an ISC office in some new place in
order to have "standing."
Or another thought that have been raised recently on the 6bone list:
Would it be an idea to have 2+ independent globaly routable prefixes,
thus in IPv4 2x at least /24 and in IPv6 2x /32 which are allowed to be
anycasted by anyone, just like the 6to4 stuff currently. So that ISP's
could point these prefixes to their local dns caches, similar to the
above but: documented which prefixes those are and no evil hijacking.
This could also allow for DNS-client to have hardcoded addresses of
these caching DNS prefixes lightening the load on the root servers as
with anycast you will always get an answer from the closest one, if all
is well and murphy is on his day off of course ;)
as far as i know, this would have to be done by iana rather than by ietf,
and the risk/reward tradeoff is such that it's not likely to see daylight.
last time i heard it discussed, the final determination was "better the
evil that we already know."
AS112 uses unowned anycast and it works well, but then, if wrong answers
were sent back by an AS112 server, it wouldn't exactly hurt anybody.
root name service seems more sensitive, to my eye.
_______________________________________________
Ietf mailing list
Ietf(_at_)ietf(_dot_)org
https://www1.ietf.org/mailman/listinfo/ietf