<html><head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head><body bgcolor="#FFFFFF" text="#000000"><br>
<br>
<blockquote style="border: 0px none;"
cite="mid:CAMm+LwhSYmgOY5vSKJ9TqZ65J5BLvSt5tsORBpbjGVTSXZFApA@mail.gmail.com"
type="cite">
<div style="margin:30px 25px 10px 25px;" class="__pbConvHr"><div
style="display:table;width:100%;border-top:1px solid
#EDEEF0;padding-top:5px"> <div
style="display:table-cell;vertical-align:middle;padding-right:6px;"><img
photoaddress="phill@hallambaker.com" photoname="Phillip Hallam-Baker"
src="cid:part1.07060107.02020103@redbarn.org"
name="compose-unknown-contact.jpg" height="25px" width="25px"></div> <div
style="display:table-cell;white-space:nowrap;vertical-align:middle;width:100%">
<a moz-do-not-send="true" href="mailto:phill@hallambaker.com"
style="color:#737F92
!important;padding-right:6px;font-weight:bold;text-decoration:none
!important;">Phillip Hallam-Baker</a></div> <div
style="display:table-cell;white-space:nowrap;vertical-align:middle;">
<font color="#9FA2A5"><span style="padding-left:6px">Thursday, October
23, 2014 11:25 AM</span></font></div></div></div>
<div style="color:#888888;margin-left:24px;margin-right:24px;"
__pbrmquotes="true" class="__pbConvBody"><div dir="ltr"><br><div
class="gmail_extra"><br>...<div class="gmail_quote"><span dir="ltr"></span><div>Bottom
line is that if you try to use port 53 for client-recursive you will
find yourself under MITM attack much of the time. And its not even all
malicious. A lot of ISPs are MITM the DNS traffic so they don't get one
of the big TLDs onto their case for allowing their customers to do DDoS.
<br>
</div></div></div></div></div>
</blockquote>
<br>
my bottom line is related and similar: rdns is hard, and can't scale to
the actual internet access edge, currently two billion or more devices,
and growing; we need a well guarded path (like HTTPS without any X.509
CA intermediaries telling us what key to trust -- SSL keying material
has to be exchanged in some more-trustful way), to get from large
numbers of stubs to moderate numbers of recursives.<br>
<br>
otherwise the DNS data path leading to the edge will continue to look
like, and be treated like, raw meat by the thin margin internet access
providers looking to plump up their revenue by selling ads one way and
telemetry the other way.<br>
<br>
<div class="moz-signature">-- <br>Paul Vixie<br>
</div>
</body></html>