dear Rick,

On Sun, 01 Jan 2017, Rick Moen wrote:

> In skimming through the dnscrypt source code, I see that it's a DNS
> tool to proxy queries over DNSCrypt protocol (that invokes ldns in
> the process of doing its work) -- but it is not a recursive
> nameserver

yes you are right here, dnscrypt being just one more piece for our
puzzles. on the dnscrypt server proxy at dyne.org we have bind9
providing answers. now back to your suggestion I guess we should look
into ways to get dnssec in dowse...


> My modest suggestion is that it's in Linux users' interest to not
> outsource recursive service to anyone at all.

its a well concerned suggestion.

what a pity Debian has switched to Google's DNS by default.

I recall this switch was made in conjunction with systemd adoption.

> I do admire NL LABs's ldns
> (https://www.nlnetlabs.nl/projects/ldns/): It's a very modern,
> well-done DNS client library, basis for the 'drill' utility (a
> better replacement for both dig and nslookup).

yes, its a work of love. the code for marshalling linked lists of
information into binary wire packets is well reusable for other kind
of projects too.

ciao