<html><head></head><body><div dir="auto">Deliberately false answers meant to render content unreachable would be easier to hide from a recursive than from an authority, and more practical there against non tld names, given Stephane's qname minimization efforts. But even so, such would be detected and loudly discussed. There is no legitimate concern about cloud flare as a dns poisoner, which was the genesis of this miserable thread from hell. --vixie<br><br></div>
<div dir="auto"><!-- tmjah_g_1299s -->Get <!-- tmjah_g_1299e --><a href="http://www.bluemail.me/r?b=14667"><!-- tmjah_g_1299s -->BlueMail for Android<!-- tmjah_g_1299e --></a><!-- tmjah_g_1299s --> <!-- tmjah_g_1299e --></div>
<div class="gmail_quote" >On 25 Mar 2019, at 17:48, "Ondřej Surý" <<a href="mailto:ondrej@sury.org" target="_blank">ondrej@sury.org</a>> wrote:<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<pre class="blue">For a *censorship* purposes, there’s no difference between not getting an answer or not getting an answer.<br><br>As much as I love DNSSEC, it doesn’t prevent censorship implemented as DoS.<br><br>Ondřej <br>--<br>Ondřej Surý <ondrej@sury.org><br><br>On 25 Mar 2019, at 16:18, Viktor Dukhovni <ietf-dane@dukhovni.org> wrote:<br><br><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;"><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #ad7fa8; padding-left: 1ex;"> On Mar 25, 2019, at 10:56 AM, Ondřej Surý <ondrej@sury.org> wrote:<br> <br> Matt, there’s no difference between NXDOMAIN and SERVFAIL from the client perspective.<br></blockquote> <br> Actually, there is for DANE, SPF, Kerberos domain to realm mappings, ...<br> but TLDs are not usually in scope for this type of query.<br> <br> [ The DNS is not *just* for web browsing ]<br> <br> -- <br> Viktor.<br> <br> <br><hr><br> dns-operations mailing list<br> dns-operations@lists.dns-oarc.net<br> <a href="https://lists.dns-oarc.net/mailman/listinfo/dns-operations">https://lists.dns-oarc.net/mailman/listinfo/dns-operations</a><br> dns-operations mailing list<br> <a href="https://lists.dns-oarc.net/mailman/listinfo/dns-operations">https://lists.dns-oarc.net/mailman/listinfo/dns-operations</a><br></blockquote><br><hr><br>dns-operations mailing list<br>dns-operations@lists.dns-oarc.net<br><a href="https://lists.dns-oarc.net/mailman/listinfo/dns-operations">https://lists.dns-oarc.net/mailman/listinfo/dns-operations</a><br>dns-operations mailing list<br><a href="https://lists.dns-oarc.net/mailman/listinfo/dns-operations">https://lists.dns-oarc.net/mailman/listinfo/dns-operations</a><br></pre></blockquote></div></body></html>