Lightning Talk: You Don't Need The DNS Root Server System#

Wes Hardaker — Google (with Geoff Huston, Warren Kumari, Jim Reed)

• Why: A DNS root server operator standing up at NANOG to ask you to stop sending him traffic is the most memorable pitch on the program, and it's technically sound: your resolver can hold the entire signed root zone locally (RFC 7706/8806). Root query load grew ~40% in two years to 130B queries/day — for data resolvers could already have.
• What: The case for LocalRoot: fetch the ~1.5MB signed root zone 2-3x/day from IANA/CDN sources, serve it locally. Security improves (DNSSEC validation of unmodified data, ZONEMD integrity), robustness improves (multiple sources and protocols; survives a 24h+ DDoS of the root system), privacy improves (no queries to root at all), and performance improves (root RTT = 0, ~1.5-2.4MB/day of bandwidth).
• How: Trivial deployment paths shown for the three major resolvers: Knot Resolver's prefill module, BIND type mirror, Unbound auth-zone with the IANA root-zone URL and prefetch. AXFR adoption to B-Root already visible and growing. Active IETF drafts (draft-wkumari-dnsop-localroot-bcp, publication-point and transfer-scheme drafts) aim to standardize and default this in 2026.
• Where applicable: Any recursive-resolver operator, from enterprise to ISP; no client-side changes. The one cultural hurdle is accepting that the root system becomes an emergency backup rather than the bootstrap queried every time — exactly the inversion the talk argues for.