IIRC the protocol is also a nightmare for potential reflection DDoS attacks. Also, the security chain is top-down, from owner of the TLD to the domain to the r

IIRC the protocol is also a nightmare for potential reflection DDoS attacks. Also, the security chain is top-down, from owner of the TLD to the domain to the resolver to the client. With DNS over TLS and DNSCurve, you have it the other way around.