Re: managed DNS daydream continues

Dean Anderson wrote:

> On Fri, 12 Sep 2008, Michael Sierchio wrote:

>> A TCP-based DNS and/or TLS-based DNS will not scale, will not provide
>> the performance expected of DNS.  Period.  Most DNS responses occur in
>> the span of time in which a three-way handshake for TCP would still be
>> occurring.
> 
> If you think this is true, DNSSEC won't scale either. 

I don't think DNSSEC will scale.  The fact that DNS has been so successful
as a distributed database is IMHO somewhat of a happy accident.

What DJB has proposed with dnscurve seems to balance the need for
security with the performance features inherent in the UDP-based
design of DNS.