>>DNSSEC is not a magic solution and it's only one of the tools to start building >>a more secure infrastructure, and as McTim said just signing the TLDs don't >>do it, since the "chain of trust" starts from the root. > > It doesn't have to start from the root. There can be a Trust Anchor Repository instead. DNSSEC has already been implemented by several ccTLDs and .org That's right and it's what we are using for the zones that are already signed and we are gaining some operational experience and headaches right now, but it's not intended to be the final architecture. Regards Jorge