...

: zone "com" { type delegation-only; }; : zone "net" { type delegation-only; };

My first reaction to this was: 'yuck'.

mine also.

I'm not sure of the side-effects this will introduce. Anyone?

if verisign served a subdomain of com or net on the same server they use for com or net, and if they issue "minimal responses" (no ns rrs) then this patch would be a barrier.