[tptacek]

Your comment suggests that the answer records in a DNS response need to be bit-for-bit identical to the original query. But the Vixie 0x20 draft says only that the question section in the response needs to be identical for this trick to work --- which is the ordinary way you'd implement an authority server (answers might come from a database or whatnot, but in both miekg/dns and the Rust NLNet library, the natural way to formulate a response simply copies the original query record).

At any rate: the possibility of breaking a 0x20-enforcing resolver scares me a lot less than depending on BIND, whose last memory corruption vulnerability was announced (checks notes) yesterday.

[saurik]

How is BIND still so bad 20 years after everyone already knew it was so bad :(.

[lawnchair_larry]

You should rewrite it in rust

[tptacek]

Bit by bit, that's what everyone is doing.