[patrickmcmanus]

corollary question - if DNS data is not authenticated then how does the client distinguish between police and attackers?

much better to authenticate the policer.

[bluejekyll]

Though, the data remains unauthenticated.

At least we get a private connection to a known entity though.