You seem to be assuming that registrars are exempted from this imaginary problem of "tampering". Why should I trust the registrar's data? (Your data.) Why sh

You seem to be assuming that registrars are exempted from this imaginary problem of "tampering". Why should I trust the registrar's data? (Your data.) Why should you trust the registry's data? Why should we trust ftp.internic.net? But I guess we can't be sure if ICANN's servers have been compromised, right? The truth is I am not too worried about the zone files I download. Thousands of people download com.zone every day. Millions download root.zone. And I do not care to play the "chain of trust" game that DNSSEC requires. Every DNS admin nowadays disables AXFR. They have their reasons. But to me the principle of downloading zones still makes perfect sense. I would not use axfr when ssh and rsync are available, but the point is the same. Why get IP addresses piecemeal when I can get them in bulk? Far more efficient. Not to mention reducing the number of opportunities for tampering.