<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">[Sorry for the slow response — US holidays and a resolution not to look at my computer over said holidays got in the way]<br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On Nov 28, 2019, at 12:42 AM, Petr Špaček <<a href="mailto:petr.spacek@nic.cz" class="">petr.spacek@nic.cz</a>> wrote:</div><div class=""><span style="caret-color: rgb(0, 0, 0); font-family: Menlo-Regular; font-size: 10px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">On 27. 11. 19 21:49, David Conrad wrote:</span><br style="caret-color: rgb(0, 0, 0); font-family: Menlo-Regular; font-size: 10px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><blockquote type="cite" style="font-family: Menlo-Regular; font-size: 10px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none;" class="">Petr,<br class=""><br class=""><blockquote type="cite" class="">I think there is even more fundamental problem:<br class="">Someone has to pay operational costs of "the new system”.<br class=""></blockquote><br class="">The “new system” is simply the existing network of resolvers, augmented to have the root zone. As far as I can tell, the operational cost would be in (a) ensuring the resolver is upgraded to support obtaining the root zone and (b) dealing with the fetch of the root zone with some frequency.<br class=""></blockquote><br style="caret-color: rgb(0, 0, 0); font-family: Menlo-Regular; font-size: 10px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Menlo-Regular; font-size: 10px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">I hypothetise that in the end requirements for "the new system for root zone distribution" will be fairly close to current requirements for current DNS root system... so I do not see where the cost reduction comes from.</span><br style="caret-color: rgb(0, 0, 0); font-family: Menlo-Regular; font-size: 10px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""></div></blockquote><div><br class=""></div><div>Root zone distribution is on different timescales than root query service. Even if the root zone distribution service relies only on AXFR, an effective DDoS of that service based on SOA timers would need to be maintained for far longer than a DDoS against root service based on cache TTLs. And, of course, folks have already been looking at distributing the root zone via stuff other than AXFR (e.g., HTTPS). </div><div><br class=""></div><div>Further, the root servers have to respond to pretty much every DNS query that gets thrown at them, both UDP and TCP. A root zone distribution service would only need respond to AXFR/IXFR requests over TCP (and this could even be gated by whitelisting/blacklisting).</div><br class=""></div><div><div class=""><div class="">Regards,<br class="">-drc<br class="">(Speaking for myself, not any organization I may be affiliated with)<br class=""></div><br style="caret-color: rgb(0, 0, 0); font-family: Menlo-Regular; font-size: 10px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><br class="Apple-interchange-newline"><style class="">ul[class*='mb-extra__public-links'], ul[class*='mb-note__public-links'], ul[class*='mb-task__public-links'] { display: none !important; }</style></div></div><br class=""></body></html>