15 Feb
2012
15 Feb
'12
7:13 p.m.
Mark Andrews wrote:
Or just slave the root zone. 1 million root servers is more robust than the hundred or so we have today
Good, I was serious to have said "not thousands but millions of" servers when I proposed anycast root servers.
and given the root is signed you can verify the answers returned.
With anycast, you can reach only a single server among servers sharing an address even if you find some server compromised, though you can try others with different addresses. But, as most attacks will be DOS, DNSSEC capable servers are weaker. Masataka Ohta