3 ms·
Personally I trust much more the authoritative root servers than public resolver. The root servers economic model is being the backbone of the Internet, they ar
by belorn 7y ago
Personally I trust much more the authoritative root servers than public resolver. The root servers economic model is being the backbone of the Internet, they are not advertisement companies, they have a long history of working as an infrastructure, and there is very little incentive to monetize that data. The risk of a fork in the DNS system has always been the sword that kept the authoritative root servers honest.
If authoritative root servers started to support DoT/DoH/DNSCurve then clients could do secure end-to-end communication with simple two hops in the vast majority of cases. In the case of news.ycombinator.com it would ask .com for ycombinator without informing the TLD server of the remaining parts of the domain, and then ask ycombinator.com for news. Simple end-to-end communication without giving out unnecessary information to any party.
- bluejekyll 7y agoI’ve always heard that the root servers are not capable of handling that amount of load. Is this no longer a major concern?
- belorn 7y agoI have asked that question a few times in conferences. Capacity wise they can handle it as they already need it to defend against the massive DDoS threat that they face. Relative recently they also added anycast, which further increases the capacity. DNS queries is also generally quite small and has not significant changed, and the modern resolver software is pretty efficient. DNS is also designed for redundancy so in combination with anycast is quite simply to scale up. Because of the persistent DDoS threat the question of capacity is constantly discussed. I don't remember the exact numbers but the current overhead is quite large compared to actual usage. It is also constantly being increased based on the threat rather than usage.