(A) This days Cloudflare can sustain all the DNS amplifications without even blinking. This work doesn't help us in any way on the DoS front. This work helps smaller players that don't have spare network capacity. If anything, making amplification attacks harder _reduces_ our benefits.

(B) You are free to run ANY as you like on your domain. For domains you own, this RFC doesn't change anything.

(C) Would you advocate for responding to AXFR / zone transfers? There generally is consensus that allowing enumeration is not desired.

Would you give an equivalent argument that Microsoft pushes automatic security updates because Windows vulnerabilities make it "slightly harder for them to make a profit"; that "a small chance of becoming part of a botnet" is what Microsoft thinks about because it's their business; but that there's no reason to believe this is more important than individual users wishing to experiment with A-Life?

Sorry, but less DNS amplification attacks is more important than you having fun on the internet.

And relatively counter to Cloudflare's interest. The more people get DoSed the more reason they have to use Cloudflare.

I hear you. I think whois was neutered for anti-abuse purposes by the pay-for fake front proxy "privacy" vendors. Perhaps like you I use any in conjunction with dig, and muscle memory alone is going to keep the query alive in spite of 8482.

> individual users wishing to see what servers are behind a domain

Since most servers are web servers these days, you can get pretty close to this goal from certificate transparency logs.

Limiting ANY queries to just TCP would have been a reasonable middle ground, but now Cloudflare has a cleaner codebase and does not have to do any difficult thinking around what to do with synthetic rrsets in response to ANY queries. Good for Cloudflare!

> Limiting ANY queries to just TCP would have been a reasonable middle

This was proposed solution, the problem is that in case of attack, against a valid Authoritative service, launched via open resolvers, the open resolvers would just download Gigabits of ANY traffic with TCP. Read about this here: https://fanf.livejournal.com/140566.html

They could have done this locally, just for their authoritative servers, without trying to force their ideas about ANY on the rest of the Internet.

> But there's no reason to believe this is more important than individual users wishing to see what servers are behind a domain.

None of your business, really.

> Combined with GDPR killing off whois the internet is a much more boring, less transparent place.

Thank lord for that, there's literally no benefit from it, with WHOIS evil still did evil and normal users got their privacy violated, without WHOIS evil can still do evil and normal users' privacy is protected.