Recent Posts
- Seat reservations and waiting lists on the cards for ICANN 74
- New gTLDs or Whois access? What’s more important?
- Domain sales down even as revenue booms at CentralNic
- ICANN kicks the can on .web yet again
- ALAC’s brutal takedown of that “aggressive” ICANN 74 coronavirus waiver
- .link gTLD buyer revealed
- After 10 months, ICANN board “promptly” publishes its own minutes
- China yanks Daily Stormer domain after Buffalo mass shooting
- Fewer domain companies closing down than expected
- ICANN highlights “not getting things done” risk
- Another single-TLD brand protection service planned
- Dot Hip Hop slashes prices 80% in relaunch
- Three gTLDs to lose Donuts trademark protection
- Tucows to reanimate Tucows brand as sales flatten
- Blockchain domains pose “significant risks” to internet, says ICANN
- Russian registry hit with second breach notice after downtime
- Two countries could lose registrar competition after breach notices
- .tattoo — another UNR gTLD auction winner emerges
- Neustar now linked to scandal in the Catholic church
- SSAD: Whois privacy-busting white elephant to be shelved
- ICANN reports shocking increase in pandemic scams
- Kaufmann selected for ICANN board
- Secondary market fluffs GoDaddy amid slowdown concerns
- Washington DC picked for ICANN 77
- UDRP suspended in Ukraine
- Gee, thanks. auDA cuts price of .au names by five cents
- ICANN salary porn: 2021 edition
- A sign of things to come? Verisign slashes outlook in post-pandemic slowdown
- UDRP comments reveal shocking lack of trust in ICANN process
- CentralNic sees 51% growth in Q1
- Ukraine won’t delete domains until war is over
- Covid surge scuppers ICANN LA meetings
- Vox Pop defends its favorite cybersquatter
- ICANN picks recipient of $1 million Ukraine aid
- More friction over closed generics
- ICANN’s Covid-19 waiver formally appealed
- GoDaddy and XYZ sign away rights after UNR’s crypto gambit
- Verisign wipes free TLDs from the world stats
- ICANN picks 28 registries for abuse audit
- TMCH turning off some brand-blocking services
- Bye-bye Alice’s Registry
- .kids goes live, plans to launch this year
- ICANN suggests its Covid waiver may be worthless
- Domain sales exempt from US sanctions on Russia
- African Union can’t register .africa domain
- Microsoft seizes domains Russia was using to attack Ukraine
- Blacknight objects to ICANN 74 Covid waiver
- DNS Abuse Institute names free tool NetBeacon, promises launch soon
- Radix renewals drive growth as revenue hits $38 million
- GoDaddy formally signs .tv registry contract
- ICANN lists the reasons I probably won’t be going to ICANN 74
- A public apology for my April Fool’s blog post
- ICANN accidentally summons Lesser Old One in DNSSEC snafu
- ICANN “volunteers” want to get paid for sitting through pandemic Zoom calls
- War fails to stop .ua domains selling
- Marby pledges low red tape in $1 million Ukraine donation
- 2LDs boost .au’s growth
- With mystery auction winner, .sexy prices go from $25 to $2,500
- Ukraine registry hit by 57 attacks in a week
- ICANN says higher domain prices may be in the public interest
- .org price caps: ICANN chair denies “secret” meetings
- Nigeria slashes prices to compete with .com
- .au names available today
- GoDaddy acquires DNAcademy
- Google to launch a shopping-themed gTLD next week
- Another DNSSEC screw-up takes down thousands of .au domains
- XYZ bought most of Uniregistry’s TLDs
- What to make of this strange trend in new domain regs?
- EURid appoints new CEO
- Mutually assured destruction? Now Afilias faces .web disqualification probe
- Closed generic gTLDs likely to be allowed, as governments clash with ICANN
- 101domain throttles its business in Russia
- ICANN bigwigs support sanctions on Russian domains
- Soviet Union “no longer considered eligible for a ccTLD”, ICANN chair confirms
- Nominet cuts off Russian registrars
- Now Sedo pulls the plug on Russians
- DNSSEC claims another victim as entire TLD disappears
- Ukraine’s emotional plea to ICANN 73
- ICANN extends Covid-19 abuse monitoring to Ukraine war
- ICANN’s Ukraine relief may extend to Russians too
- ICANN offers $1 million to Ukraine projects, supports Ukrainian registrants
- Here’s a way ICANN could actually help the people of Ukraine
- GoDaddy stops selling .ru domains, commits money to support Ukraine
- Gandi says it supports Ukraine but WON’T cut off Russians
- Now IONOS kicks out Russian customers
- ICANN says NO to Ukraine’s Big Ask
- Namecheap offers free services to Russian dissidents
- CENTR kicks out Russia
- Ukraine asks ICANN to turn off Russia’s internet, but it’s a bad idea
- Namecheap boss goes nuclear on Russian customers
- Noss pressures bankers, lawyers over Russian oligarch links
- As Russia advances on Kyiv, .ua moves out-of-country
- Maybe now’s the time for ICANN to start dismantling the Soviet Union
- Cybersquatting cases down in .uk
- GoDaddy among five companies competing for .za contract
- Registrar hit with second porn UDRP breach notice this year
- Costa Rica’s only registrar gets terminated
- GoDaddy Registry to raise some TLD prices, lower others
- Supreme Court allows fight for .nu to proceed
- Liberties group appeals NIXI’s “two domains rule” brush-off
- ICANN stuck between Ukraine and Russia in time zone debate
- Greek .eu domains to be deleted
- UDRP cases soar at WIPO in 2021
- CentralNic buys a gTLD and a search engine for peanuts
- “It’s not our fault!” — ICANN blames community for widespread delays
- PIR to offer industry FREE domain abuse clearinghouse
- GoDaddy now making over $1 billion a quarter
- Post-lockdown blues hit Tucows’ growth
- Surprising nobody, Verisign to raise .com prices again
- Verisign and PIR join new DNS abuse group
- auDA ramps up marketing for direct .au launch
- Thousands of domains hit by downtime after DNSSEC error
- Is the .sucks mass-cybersquatting experiment over?
- At ICANN, you can have any registrar you want, as long as it begins with A
- .eu grows in Q4 after silly growth in Portugal
- Turkish registrar on the naughty step over abuse
- Court denies .sucks trademark bid
- ICANN hasn’t implemented a policy since 2016
- Satirists register Joe Rogan domain to promote Covid vaccines
- Do young people know how to use domain names?
- “GDPR is not my fault!” — ICANN fears reputational damage from Whois reform
- Cahn says .hiphop premiums could show up at auction next month
- No SSAD before 2028? ICANN publishes its brutal review of Whois policy
- ICANN board not happy with $100 million Whois reform proposals
- Over 6,000 Brexit domains snapped up after mass delete
Reports: .gov fails due to DNSSEC error
Kevin Murphy,
August 14, 2013, 17:34:34 (UTC),
Domain Tech
The .gov top-level domain suffered a DNSSEC problem today and was unavailable to some internet users, according to reports.
According to mailing lists and the SANS Internet Storm Center, it appeared that .gov rolled one of its DNSSEC keys without telling the root zone about the update.
This meant that anyone whose DNS servers do strict DNSSEC validation — a relatively small number of networks — would have been unable to access .gov web sites, email and other resources.
As a matter of policy, all second-level .gov domains have to be DNSSEC-signed.
The problem was corrected quite quickly — looks like within an hour or two — but as SANS noted, caching issues may prolong the impact.
Both .gov and the root zone are managed by Verisign, which isn’t on the best of terms with the US government at the moment.
It is ironic that the very initiatives that are supposed to help security have introduced errors into the system, while those that are identified as likely to produce errors — for instance, the introduction of new gTLDs, in the context of name collision issues — have produced none.
The DNSSEC problem — that of needing a chain of trust to make it effective — has been frequently raised by registrars and others. This shouldn’t have been a surprise to anyone.
What is does show is that *if* there is a problem, it can be addressed quickly and without major repercussions. That is true of DNSSEC or of name collision. The ICANN staff obsession with risk — that is, in preventing *all* risk, rather than assessing its probability, severity, and ease of mitigation — seems to be limited to those areas where the ICANN corporation faces some liability. In contrast, ICANN appears to be blandly unconcerned in areas where they could have done something (I’m thinking of better planning and communication rolling out DNSSEC), but where they unlikely to be identified as a culprit.
ICANN needs some real risk assessment capabilities, instead of relying on risk assessment from a legal perspective, which typically is satisfied only with 0% risk — which is not a real-world position to take, especially in a field as fast moving, and as filled with so many unknowns as the Internet. They would then be able to communicate honestly to the world as to why they take certain positions, instead of pointing helplessly at nebulous unknowns. If ICANN *really* wants to secure the security and stability of Internet, it’s going to need to take risks — calculated ones. There is no zero-risk scenario where ICANN is effective.
Antony
Problem started somewhere between 2013-08-14 08:51:41 UTC and 2013-08-14 12:26:40 UTC. It persisted at least until 2013-08-14 13:49:03 UTC.
.gov DNSSEC snapshots:
http://dnsviz.net/d/gov/UgtFHg/dnssec/
http://dnsviz.net/d/gov/Ugt3gQ/dnssec/
http://dnsviz.net/d/gov/UguK0A/dnssec/
http://dnsviz.net/d/gov/UguRGg/dnssec/
Everything involves risk. Crossing the street involves risk. We humans are constantly assessing the risk vs the benefit.
Shall I cross this slightly trafficked street (very small probability but risk of very bad event happening – death) to make my meeting on time (some benefit)?
We have to assess not only 1) the risk (chance of it happening) but 2) the magnitude of the potential harm, and 3) the magnitude of the benefit.
In the DNSSEC case, the probability of a negative event happening is non-zero (as this event shows), the magnitude of the bad event is medium and the benefit is medium.
The benefits to DNSSEC outweigh the risks. But make no mistake, there are risks to implementing DNSSEC. In fact, comparing DNSSEC and new TLDs, the change DNSSEC imposed on the DNS is much much larger than the change that new TLDs impose on the DNS.
Therefore the risks to implementing DNSSEC is much larger than the risk of new TLDs.
Comparing the benefits of the two, there are net benefits that DNSSEC brings to the world (more security), but the net benefits that new TLDs bring are even larger (competition, innovation, etc).
So we, the ICANN community, implemented DNSSEC even thought the risks are more (more change to the DNS) and the benefits are less than new TLDs.
“Name collisions” have a non-zero probability of happening, true (they happen every day in .com for example). But the consequence of a “name collision” is small (in my opinion very small, which is why we allow them to happen in .com) and the benefits brought by new TLDs, such as .home and .corp are big.
The v6 and DNSSEC evangelicals successfully added their pet causes as mandatory-to-implement by new gTLD operators, even if (a) located where native v6 is not available and/or (b) for use models lacking valuable targets (e.g., community-based applications).
These new operators are compelled to waste resources on v4 exhaustion & security theater, and are likely to make more mistakes than experienced, highly capitalized operators.
I differ from Antony and Paul, who offer specific comparisons of argued risk, and offer, as a general error of staff the insertion of the v6 and DNSSEC requirements for new registry operators, for which little value at start-up (years 1-5) can be offered.
There is a chicken-and-egg situation happening with both IPv6 and DNSSEC that requires the industry to adopt those even its numbers would indicate otherwise. I think ICANN was right in requiring those to be deployed, but it could have lessened such burden by indicating that IPv6 tunneling was OK (it’s possible to get tunneled-IPv6 for free) and providing DNSSEC capacity building as another avenue of applicant support.