3 ms·

One of the options I've thought of (and I'm sure many others have as well) is to have all zones distributed in a P2P manner via ICANN. To not put too much burde

One of the options I've thought of (and I'm sure many others have as well) is to have all zones distributed in a P2P manner via ICANN. To not put too much burden on ICANN and keep things decentralized, have ICANN at the root of the DNS PKI and have all zones signed by the responsible party. This would solve a few of the big problems we have: * All sorts of MITM and evil resolver attacks would be prevented. * Since DNS queries are local, there would no longer be a privacy concern with resolving a name. * Even if the P2P network mechanism were to be blocked, since every host connected keeps a full record (though not necessarily with history) it can still be distributed via sneakernet. * DNS updates are as fast as the network is, no longer depending on turtles caching all the way down. * DNS amplification? That's gone, as resolvers no longer need to query external sources. As many will quickly notice, we would likely still need remote resolvers for battery constrained devices as this would keep the network interfaces busy. The one big political issue that would put a stop to this is that this would cause all zones to be world readable. Many people treat zones as something private and to them exposing the zone file is the same as exposing their network. My view is that if it has a publically routable IP then it is already exposed, but not everyone shares my view.

silotis 8y ago
I've also thought of this. With the plentiful availability of storage and bandwidth we have today, there is little technical reason why public resolvers and privacy minded individuals couldn't download and cache zone files in bulk. As you say though, I suspect the inertia behind the status quo is so strong that there is little chance of such a radical change being accepted.
wtmt 8y ago
> The one big political issue that would put a stop to this is that this would cause all zones to be world readable. Many people treat zones as something private and to them exposing the zone file is the same as exposing their network. My view is that if it has a publically routable IP then it is already exposed, but not everyone shares my view. I really don’t get this view either. There may be more cases supporting zone files being world readable than not (I can’t think of any cases for the latter except for censorship and control).

silotis 8y ago

I've also thought of this. With the plentiful availability of storage and bandwidth we have today, there is little technical reason why public resolvers and privacy minded individuals couldn't download and cache zone files in bulk. As you say though, I suspect the inertia behind the status quo is so strong that there is little chance of such a radical change being accepted.

wtmt 8y ago

> The one big political issue that would put a stop to this is that this would cause all zones to be world readable. Many people treat zones as something private and to them exposing the zone file is the same as exposing their network. My view is that if it has a publically routable IP then it is already exposed, but not everyone shares my view. I really don’t get this view either. There may be more cases supporting zone files being world readable than not (I can’t think of any cases for the latter except for censorship and control).