The Register® — Biting the hand that feeds IT

Feeds
Bronze badge
Boffin

@Chris C

If you don't like the idea of the US managing the top of your chain of trust in domain names there is little to prevent you and a few others with like minds operating another root server which contains a certificate you do trust signing the TLD DNS servers you consider to represent the names in question. Then configure your DNS clients and servers to trust your root server instead of the one operated by the US. You'll need pretty good bandwidth and resilience though, but the budget to do this isn't beyond what a well organised activist group could raise, and could grow with demand for an alternate DNS root.

Also if you don't want to go that far then decide which TLDs you do trust and configure your DNSSEC trust anchors there which override any changes made in the US government root server, and trust the US root server for other TLDs.

Setting up an alternate DNS infrastructure isn't impossible, given that the schools have done this to filter adult content based on domain name, see:

http://www.opendns.com/ .

OpenDNS do this based upon their customers' and users' agenda, so there is nothing to prevent those who don't trust the US to sign the root zone to setup and configure a root zone they do trust. But learning and paying for and operating the technology will give you a lot more traction here than idly arguing the politics if you are not willing to put your money and time where your mouth is.