> On 26. Jul 2026, at 22:42, Paul Wouters <[email protected]> wrote: > > > >> On Jul 26, 2026, at 21:50, Michael Breuer <[email protected]> wrote: >> >> Hi. >> >> I like the idea of cache synchronisation. But I have a preference for >> encrypted transport-only, out of privacy concerns. Leaking the cache to the >> networks doesn’t look good to me. >> > > I have an outstanding request for unbound to do cache replication but only > for DNSSEC entries that validate. This allows you to sync from untrusted > sources à la pool.ntp.org and we can create a huge volunteer pool. > > Cache sharing on poisonable data seems wrong and too risky. Transport > security is no substitute for data origin security. >
Cache sharing with untrusted sources is a very different use case than doing this within one area of operational control. For sharing with untrusted sources I share your concerns. Data origin security is no substitute for transport security. Michael _______________________________________________ DNSOP mailing list -- [email protected] To unsubscribe send an email to [email protected]
