DNS Scaling issues

Jorge Amodio jmamodio at GMAIL.COM
Tue Oct 27 20:26:47 CET 2009


>>DNSSEC is not a magic solution and it's only one of the tools to start building
>>a more secure infrastructure, and as McTim said just signing the TLDs don't
>>do it, since the "chain of trust" starts from the root.
>
> It doesn't have to start from the root. There can be a Trust Anchor Repository instead. DNSSEC has already been implemented by several ccTLDs and .org

That's right and it's what we are using for the zones that are already
signed and we
are gaining some operational experience and headaches right now, but it's not
intended to be the final architecture.

Regards
Jorge


More information about the Ncuc-discuss mailing list