<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">On Mar 22, 2019, at 7:09 PM, <a href="mailto:solvepuzzle@secmail.pro" class="">solvepuzzle@secmail.pro</a> wrote:<div><blockquote type="cite" class=""><div class=""><div class="">Now the E root and F root are Cloudflare's server, should I<br class="">change my DNS software to lookup other alphabet root server?<br class=""></div></div></blockquote><div><br class=""></div><div>Based on your question, I’m unsure how well you understand how the DNS works.</div><div><br class=""></div><div>Just to be sure: all the root servers are anycast. NASA and ISC are using Cloudflare for (some of) their instances. When your resolver starts up, it issues a priming query to the addresses in your root hints configuration to obtain the root server addresses. If you modify your resolver configuration to remove E and F, you would also need to modify your resolver’s code to drop E and F from the priming query (and any subsequent root NS queries) response. Seems like a lot of work. Alternatively, you could null route the IP addresses for E and F. Presumably your resolver would then treat them as down and choose other root servers to query (when necessary).</div><div><br class=""></div><div>However, I believe all the root server operators have committed to abide by RSSAC01 (<a href="https://www.icann.org/en/system/files/files/rssac-001-root-service-expectations-04dec15-en.pdf" class="">https://www.icann.org/en/system/files/files/rssac-001-root-service-expectations-04dec15-en.pdf</a>), which includes expectation E.3.2-B which states "Individual Root Servers will serve accurate and current revisions of the root zone.” I’m sure both NASA and ISC require the folks who operate their instances to abide by RSSAC01. </div><div><br class=""></div><div>If you are concerned about root zone data integrity, turn on DNSSEC validation (if you haven’t already). You might also want to look at RFC 7706.</div><div><br class=""></div><blockquote type="cite" class=""><div class=""><div class="">Cloudflare's DNS service is censoring so using it as a root DNS<br class="">is really bad news.<br class=""></div></div></blockquote></div><br class=""><div class="">Why do you think Cloudflare is censoring their DNS service? Perhaps you’re thinking of resolution service and confusing them with Quad9 that provides a resolution service that is scrubbed for names that appear to be security threats?</div><div class=""><br class=""></div><div class="">Since the root is signed, modifying root zone responses to censor the DNS would be fairly pointless.</div><div class=""><br class=""></div><div class="">Or perhaps I misunderstand your question.</div><div class=""><br class=""></div><div class="">Regards,</div><div class="">-drc</div><div class=""><br class=""></div></body></html>