> What's the point of validating the communication between the servers if the last mile is unprotected? It's all incremental ways of reducing the attack surfac

> What's the point of validating the communication between the servers if the last mile is unprotected? It's all incremental ways of reducing the attack surface. Get DNSSEC validation happening at large public DNS services... then at ISPs... then on network edge devices... then into operating system (in stub resolvers) ... then perhaps into applications themselves. Each step reduces the attack surface a bit more. I wrote about this at: http://www.internetsociety.org/deploy360/resources/plan-dnssec-validation/ http://www.internetsociety.org/deploy360/resources/plan-dnss... This is why some people are using libraries like the GetDNS API to build DNSSEC validation directly into apps: https://getdnsapi.net/ https://getdnsapi.net/ And solving the "last mile" problem is exactly why the DPRIVE working group was chartered within IETF: https://datatracker.ietf.org/wg/dprive/charter/ https://datatracker.ietf.org/wg/dprive/charter/ (And anyone is welcome to contribute to the group.)