Securely Distributing the DNS Root
Google
VPN Consortium
This document recommends that recursive DNS resolvers get copies of the root zone, validate it using DNSSEC, populate their caches with the information, and also give negative responses from the validated zone. [[ Note: This document is largely a discussion starting point. ]]