Hacker News new | past | comments | ask | show | jobs | submit
drdexebtjl | on: Quad9 to exit France
I don’t want the user to see the error, I just want the browser/the operating system’s resolver to not be a stub resolver, and actually ask the authoritative servers when something like this fails on a non-authoritative response.

Public DNS like Quad9 should be a cache (because recursing is pretty slow) and, at most, a way to find the IPs of the root name servers.

Courts asking non-authoritative resolvers not to resolve a name should have no effect on clients successfully resolving that name, such that they wouldn’t even have a reason to go after Quad9 or Alice and Bob, and would have to go after the TLD registry (likely in a different jurisdiction).

Bender | parent
The only thing I know of that operates somewhat like you are asking is Unbound itself, when it is not the server doing the root/tld lookups. One can configure Unbound with a series of Upstream DoT servers and it can retry each of them and cache which ones answered, answered fastest, so if the upstream just refused to answer that would cause it to move to another upstream resolver and eventually retry the one that refused but once it gets another refusal it would avoid that one again for some time. Clunky but it would sortof work.

Beyond that I think you are asking for behavioral and RFC changes to everyone's workstations, cell phones, tablets, TV's, and DNS resolvers.

drdexebtjl | root | parent
Yes, I use Unbound :)

It’s configured exactly like I mentioned: it tries a couple of resolvers, and if they all fail, tries authoritative servers starting from the root. That last part, missing from your suggested configuration, is the key: it’s what ensures courts have to actually go after the parties responsible for the domain, and not just random DNS resolvers.

> Beyond that I think you are asking for behavioral and RFC changes to everyone's workstations, cell phones, tablets, TV's, and DNS resolvers.

We did it once for DoH/DoT, we could do it again.