That "improved" form of DNS breaks the DNS. Read what the IAB wrote about it. Think about what it does to things like email. It's just a bad, bad idea.

DNS like IPv4 is just a protocol. Creating a new protocol that returns the same IP address as DNS along with a safety score and text description, and a list of alternative domain names with their IP's and safety scores is not a crime against humanity. And hacking the existing DNS protocol to do much the same thing can also be a reasonable thing to do.

You understand that NXDOMAIN redirectors are getting copies of cookies, right?

   wwwwwwwwwwwwwww.bankofamerica.com has address 208.69.36.132
   wwwwwwwwwwwwwww.matasano.com has address 208.69.36.132

I think that you mean access to cookies. I doubt that Comcast is stealing your Bank of America cookies, but it's troubling that they have access to them. [Not necessarily my cookies, as I'm not on Comcast, and I don't use ISP-provided DNS anyways]

That's OpenDNS, not Comcast.

IIRC, Comcast was getting into this too. I'm referring to the specific practice of NXDOMAIN redirecting. Not just OpenDNS's practices.

http://www.semicomplete.com/blog/geekery/comcast-dns-hijack-...

I think that he felt you were celebrating the practice of disabling NXDOMAIN and returning a valid IP for every request with the non-existent ones resolving to the DNS-provider's advertisement page. This very much does break DNS.

OK, to clarify I still think you should rely on the application to handle invalid domain names so you don't break email ect. The problem is when someone creates a Malware site called microsof.com and it immediately compromises the browser of anyone who mistypes the domain name. Granted, the browser could keep a copy of bad domain names and worn the user, but Norton DNS could also do that same job. After all if you are going to query a system to find the IP address it might as well tell you as much as it can when it's responding. It's a packet based network and there is close to zero overhead to doing so.

Now I would hate it if my ISP where to institute such a practice but an independent DNS that let's me avoid most malware, spoofing, and parked domain names. Count me in as long as I can opt out at any time.

So, instead of fixing the root problem (dealing with the companies behind domain squating) we should keep adding redirects on the dns?

...from someone that already had his 2.0 cool domain redirected by a dozen isp because it was too close to another domain.