3 ms·

I would also love to remind everyone that this is the same company who controls not 1 but 2 core root DNS server addresses. A.ROOT-SERVERS.NET J.ROOT-SERVERS.N

I would also love to remind everyone that this is the same company who controls not 1 but 2 core root DNS server addresses. A.ROOT-SERVERS.NET J.ROOT-SERVERS.NET That means Verisign controls 15% of the global roots while everyone else holds a meager 7%. IANA got the optics on this one all sorts of messed up.

akvadrako 5y ago
The root servers are not all equal and there is no real advantage to holding two. There are 63 Js, 14 As, but 165 Ls. https://en.wikipedia.org/wiki/Root_name_server https://en.wikipedia.org/wiki/Root_name_server
- therealEleix 5y ago
  I don't doubt that, it's also trivial for anyone to spin up their own local root mirror to resolve against, I'm just pointing out that maybe Verisign shouldn't be holding onto two. It's even pointed out on their Wikipedia page like some kind of trophy like "Oh hey look, we don't just run 1 we run *2*, that makes us a big deal". :eyeroll:
  - profmonocle 5y ago
    > it's also trivial for anyone to spin up their own local root mirror to resolve against This is a bit of a tangent, but the idea of doing this has always made me nervous. Sure, the root zone is only a couple MB and you can easily set up a cron job to sync it regularly. But if that cron job breaks, it would be very easy not to notice, since it's not like the authoritative servers + glue records for the major TLDs change every day. (Or every decade.) Imagine if that cron job has been broken for 9 months, the IT guy who set it up left 4 months ago, and suddenly a tiny TLD like ".tech" switches to a different authoritative DNS provider. Since it's not a very common TLD you'll never notice... unless some app uses "companyname.tech" for its mobile API - or one of a million other scenarios. It's probably fine if big DNS server operators like Google/Cloudflare or major ISPs mirror the root zone, since they have the resources to make it robust. But small(-ish) IT operations running their own DNS - just use the root servers.

akvadrako 5y ago

The root servers are not all equal and there is no real advantage to holding two. There are 63 Js, 14 As, but 165 Ls. https://en.wikipedia.org/wiki/Root_name_server https://en.wikipedia.org/wiki/Root_name_server

therealEleix 5y ago
I don't doubt that, it's also trivial for anyone to spin up their own local root mirror to resolve against, I'm just pointing out that maybe Verisign shouldn't be holding onto two. It's even pointed out on their Wikipedia page like some kind of trophy like "Oh hey look, we don't just run 1 we run *2*, that makes us a big deal". :eyeroll:
- profmonocle 5y ago
  > it's also trivial for anyone to spin up their own local root mirror to resolve against This is a bit of a tangent, but the idea of doing this has always made me nervous. Sure, the root zone is only a couple MB and you can easily set up a cron job to sync it regularly. But if that cron job breaks, it would be very easy not to notice, since it's not like the authoritative servers + glue records for the major TLDs change every day. (Or every decade.) Imagine if that cron job has been broken for 9 months, the IT guy who set it up left 4 months ago, and suddenly a tiny TLD like ".tech" switches to a different authoritative DNS provider. Since it's not a very common TLD you'll never notice... unless some app uses "companyname.tech" for its mobile API - or one of a million other scenarios. It's probably fine if big DNS server operators like Google/Cloudflare or major ISPs mirror the root zone, since they have the resources to make it robust. But small(-ish) IT operations running their own DNS - just use the root servers.