[OneWingedShark]

If MS DNS is implemented properly, it’s as secure as BIND. Most admins deploy MS DNS with secure updates turned off and zone transfers enabled from all sources, which is just a nightmare for administration and security overall.

But the point here is that BIND isn't secure either. Ironsides, on the other hand, is provably free of exceptions (the paper here) and both single-packet denial of service and remote code executions (this paper). That's a huge distinction.

[rarestia]

I’m absolutely not taking away from that point, sir. I just wanted to jump to the defense of MSDNS since the paper seemed to jump on it as flawed. Every system is flawed with the right backdoors or vulnerabilities to exploit.

We’re already discussing IRONSIDES here internally.