You may be right - I was basing that information off statements that it was only some users seeing the attack. I wasn't aware of a historic data source that cou

You may be right - I was basing that information off statements that it was only some users seeing the attack. I wasn't aware of a historic data source that could show otherwise. Your analysis looks pretty good but I disagree that DNSSEC would have stopped the attack, because many users don't use validating resolvers.