> DNSCurve is something different from DNSSEC. Yes, I know. I was contrasting their use of crypto and the degree to which they fit traditional name server arch

> DNSCurve is something different from DNSSEC. Yes, I know. I was contrasting their use of crypto and the degree to which they fit traditional name server architectures. > The "wrapping" and "unwrapping" in DNSCurve is done by a forwarder, a separate server Whether the wrapping is done on a [reverse] forwarder or integrated into the authoritative name server is entirely irrelevant. (Perhaps you were thinking of the querier, which would be even more irrelevant from the perspective of root and TLD servers.) I like DNSCurve. But I was contesting the point that DNSCurve was effectively zero cost. It definitely is not zero cost, neither in terms of CPU nor operationally. The cost may be de minimis in most contexts, but root and TLD zones are certainly the exception.