> protecting against an authoritative name server operator from maliciously modifying the zone data in their server was not a significant consideration in any o

> protecting against an authoritative name server operator from maliciously modifying the zone data in their server was not a significant consideration in any of the IETF/implementation discussions I was in Honestly this statement is not at all surprising. I would love to hear your perspective on what problem they thought was being solved. Ensuring you have received a correct copy of a zone is the one thing we did get out of DNSSEC. > I ran ISC during the development of BIND 9.0 and participated quite heavily in DNS-related working groups Then we must have crossed paths. I'll happily buy you a beer or three next time. > you have to take the steps DNSSEC takes Ehhh. We are 30 years on and the current state is: recursive resolvers can strip DNSSEC and nothing happens but if they turn on validation things occasionally break. Transport security has solved most of the real world problems and is being rapidly adopted: https://stats.labs.apnic.net/edns https://stats.labs.apnic.net/edns