Well it’s absolutely happening right now to every unencrypted DNS server, so what’s your point?
DNS is the most openly insecure aspect of the entire internet. It’s wide open.
DNS is the most openly insecure aspect of the entire internet. It’s wide open.
2) to implement this canary, you have to break DNSSEC on entire .net root domain. Great.
That's an intentional design feature. You're attempting to intercept traffic, and any mechanism you could use to do so "transparently" could be used by any hostile network to do so.
You can still intercept traffic from cooperating devices if you want, just not transparently. That's a feature, not a bug, and the Internet will be better for it.