Hacker News Reader

To avoid hitting the root, don't send your queries there! Problem solved!

localroot.isi.edu

Bias: I created it, and am a author of one potential set of future specifications (rewrite).

Thanks, interesting, I like making my systems as stand-alone capable as possible :)

What is the primary difference between using an Unbound auth-zone (as described in the RFC) compared to localroot?

They're both good. The localroot service offered at B-Root does authenticated transfers (TSIG protected) and gives you update notifications to ensure you're notified as soon as the root changes. Otherwise you may be an hour behind or so (at worst).

Both methods are fine. It would be best if unbound does ZONEMD checking to ensure the file you receive is properly protected from modification from any network in the middle, and I don't remember without looking what version (and if) Unbound does this. If they don't yet, it's coming soon. With the LocalRoot service at ISI, the TSIG protection gives you this (and is older than the ZONEMD record that is now available in the root zone).

Reply on news.ycombinator.com