Look how a DNS name is normally resolved in code: by calling gethostbyname(name). Look how the return value of that call is handled: either the struct hostent i

Look how a DNS name is normally resolved in code: by calling gethostbyname(name). Look how the return value of that call is handled: either the struct hostent it returns is NULL, in which case "host not found", or it's non-NULL, in which case the domain name is good. Where's the error channel? Don't forget the influence of Mozilla, Google, Microsoft, and Apple. While they may not own even the majority of the lines of code, the code they do own is disproportionately visible. Some of their stuff actually does its own name resolution, or even provides the implementation for a whole operating system. I believe some of them are shipping some actual DNSSEC client code today. Combine that with the work done by ISC and this thing isn't exactly alone whistling in the wind. There are DNSSEC advocates --- presumably none of whom have shipped a product in C before --- who talk as if this is a minor detail. Hmm, well Paul Vixie counts at least double in my book. Isn't it the same deal for DNS? Aren't we talking about either forklifting out or breaking huge amounts of deployed code? Sure, it will probably take 10 years before the absence of DNSSEC data can be interpreted as a name resolution failure. But technology can move a lot faster now that MS IE and Windows doesn't have 90% market share on the client side anymore.