Shane Kerr wrote: > ... > > The model does prevent incorrect answers from reaching clients, but as > you point out, validation failure means the service will stop working. that's what dnssec does. that is in fact all that dnssec can do. what behaviour would you have instead? -- Paul Vixie