Recent Posts
- 153 registrars fingered for ICANN security probe
- ICANN axes Cancun again. Apparently there’s a pandemic
- Gun nut site crashes at Epik after GoDaddy shoots it down
- It’s pandemic continuity versus gender diversity in ICANN’s board wish-list
- Free domains for .in registrants
- Here’s why two ICANN directors opposed extending Marby’s CEO contract
- Rules for the next new gTLD round near the final straight
- Island demands return of its “naked” ccTLD
- Donuts punter welcomes our new alien overlords in December premium sale
- Net 4 India gets unwelcome Christmas gift from ICANN
- Fuji Xerox kills off gTLD after rebrand
- EURid suspends 80,000 domains as Brexit transition ends
- GoDaddy’s female geeks make a bit more than men
- Donuts acquisition of Afilias closes, integration work begins
- GoDaddy pranks employees with “insensitive” phishing test
- US sneaks public Whois demands into pandemic relief bill
- Verisign drops half a mill on pandemic relief
- Mixed messages from ICANN on pandemic travel in 2021
- ICANN predicts rosy post-pandemic domain industry — time to start panicking?
- DI World Global International Headquarters is relocating
- ICANN throws the book at Net4 over dodgy transfer claims
- Fraud checks coming to .ch as SWITCH renews contract
- South African registry to be merged with film censor, broadband regulator
- There’s one obvious pick for next year’s ICANN Community Excellence Award
- ICANN could block Donuts from buying Afilias
- Westerdal offloads two more gTLDs to Donuts
- Whois privacy group finds its new chair
- Three more new gTLDs blink out of existence
- NamesCon Europe founder Dietmar Stefitz reportedly dies
- Credit union gTLD changes hands to perhaps surprising buyer
- After 20 years, DomainTools takes its first VC dough
- Gay charities get first taste of domain cash
- CIRA hits major .ca milestone on 20th anniversary
- .org made $97 million last year
- XYZ launches its beauty-themed gTLDs with slashed prices
- “Criminal” domain suspensions drop again in .uk but thousands of pandemic domains frozen
- NameSilo in profit as sales rise 11%
- CentralNic more than doubles revenue as parking business thrives
- WIPO handles 50,000th UDRP case as coronavirus drives complaints
- Brits get small reprieve in Brexit domain crackdown
- Vaccine agency to get more domain takedown powers next year
- Domain growth dropped off in Q3, says Verisign
- Donuts boss discusses shock Afilias deal
- GoDaddy has a secret weapon in its push into corporate domains
- Donuts acquires Afilias to create registry giant
- ICANN finally addresses Net 4 India meltdown, but mysteries remain
- Masochistic mug urgently wanted for thankless, pay-free ICANN leadership role
- ICANN made over $500k in secret lawyer payments over [REDACTED] legal dispute
- .spa registry relocates to .xyz
- .forum sunrise period will cost less than half the regular reg fee
- .trust finds a new home with UNR
- Web.com acquires Kiwi registrar Freeparking
- GoDaddy set to pay millions to settle robocalling class action
- Tributes as “great mentor” Marilyn Cade dies
- GoDaddy sees 12% growth in domains revenue
- One-letter .lu domains could be bought for peanuts
- Another domain firm going private as Endurance announces $3 billion deal
- Verisign increases focus on .com after flogging public DNS to Neustar
- Blood on the boardroom floor after MMX admits revenue screwup
- Angry investor sues for 30% of new .spa gTLD
- Amazon sold rights to .box gTLD for $3 million
- Big pharma firm dumps its gTLD
- Facebook to enter the retail registrar business?
- .web ruling might not come this year
- Verisign sells a million more domains than it did last year
- Free speech, or bad faith? UDRP panels split on Everything.sucks domains
- The internet just got its first proper new gTLD of the year, and the timing couldn’t be worse
- ICANN may not meet again for a looong time
- ICANN denies Whois policy “failure” as Marby issues EU warning
- These eight companies account for more than half of ICANN’s revenue
- Lockdown bump was worth $600,000 to ICANN, but end of Club Med saves 10x as much
- That .sucks weirdness? Worse than I thought
- Something weird’s going on at .sucks
- Are 25x price increases on the cards as XYZ corners the cars market?
- .gay and Star Trek star troll the right to promote new gTLD
- Forty weddings and a funeral? .wed is dead but may come up for auction
- Holy Scheisse! Did you know ICANN 69 starts TOMORROW?
- MMX probing accounting of mystery contract
- NamesCon will be back to in-person events next July
- .eu registry contract up for grabs
- EURid suspends and delays thousands of coronavirus domains
- .jobs plans to raise millions from premium names after dumping its sponsor
- Peaceful transfer of power? GNSO’s next chair is a shoo-in
- Two American women appointed to ICANN board
- Europe’s top dogs could decide the future of Whois
- ICANN playing ping-pong on closed generics controversy
- Has ICANN cut off its regulatory hands?
- Will you shut up, man? Trump takedown domain on sale for ridiculous fee
- MMX revenue down even as sales rise during pandemic
- This ICANN comment period is a Kafkaesque nightmare
- Could .cpa be the most successful new gTLD sunrise yet?
- ICANN 69 returning to YouTube
- Three-letter .blog domains priced up to $100k
- Whois plan approved, but it may be a waste of money
- Should YOU have to pay when lawyers access your private Whois info?
- Nominet shuts down “hostile” discussion forum
- Donuts to launch .contact next week
- GoDaddy denies weird front-running claim
- Is India’s largest registrar about to go titsup? And where the hell is ICANN?
- Webcentral rejects Web.com buyout bid for LOWER offer from Aussie telco
- Portugal reports lockdown boom continued through the summer
- No ICANN meetings until 2021
- ZADNA hikes up the price of .za domains
- Floodgates, open! Trademark Clearinghouse now supports .com
- Radix premium renewals approach $1 million
- GoDaddy could lose control of .co this week
- ICANN ordered to freeze .hotel after “serious questions” about trade secrets “theft”
- CentralNic parking boosts revenue even as its registrars suffer
- ICANN will spend $51,000 on your broadband
- Verisign measures the industry’s lockdown bump
- ICANN apologizes to “arms dealer” claim security firm after email goes missing
- Amazon waves off demand for more government blocks
- Told us so? Nominet ditches auctions plan, will charge drop-catchers higher fees instead
- Schreiber really did sue you all, sorry
- Fight over closed generics ends in stalemate
- New gTLD prices could be kept artificially high
- Here’s what’s in the NamesCon Online schwag bag
- New back-end approval program could reduce the cost of a new gTLD
- Single/plural gTLD combos to be BANNED
- ICANN might pay for your lockdown broadband
- The end of the beginning? ICANN releases policies for next round of new gTLDs
- It’s a CONSPIRACY! Canadian registrant “sues” pretty much everybody
- “Arms dealer” registrar probed by ICANN
- No lockdown bump for .eu as domain base shrinks in Q2
- After a year’s delay, .gay reveals launch dates
Reports: .gov fails due to DNSSEC error
The .gov top-level domain suffered a DNSSEC problem today and was unavailable to some internet users, according to reports.
According to mailing lists and the SANS Internet Storm Center, it appeared that .gov rolled one of its DNSSEC keys without telling the root zone about the update.
This meant that anyone whose DNS servers do strict DNSSEC validation — a relatively small number of networks — would have been unable to access .gov web sites, email and other resources.
As a matter of policy, all second-level .gov domains have to be DNSSEC-signed.
The problem was corrected quite quickly — looks like within an hour or two — but as SANS noted, caching issues may prolong the impact.
Both .gov and the root zone are managed by Verisign, which isn’t on the best of terms with the US government at the moment.
Related posts (automatically generated):
VeriSign to deploy DNSSEC in .com next March
Afilias adds DNSSEC to .info zone
US government requests root DNSSEC go-ahead
It is ironic that the very initiatives that are supposed to help security have introduced errors into the system, while those that are identified as likely to produce errors — for instance, the introduction of new gTLDs, in the context of name collision issues — have produced none.
The DNSSEC problem — that of needing a chain of trust to make it effective — has been frequently raised by registrars and others. This shouldn’t have been a surprise to anyone.
What is does show is that *if* there is a problem, it can be addressed quickly and without major repercussions. That is true of DNSSEC or of name collision. The ICANN staff obsession with risk — that is, in preventing *all* risk, rather than assessing its probability, severity, and ease of mitigation — seems to be limited to those areas where the ICANN corporation faces some liability. In contrast, ICANN appears to be blandly unconcerned in areas where they could have done something (I’m thinking of better planning and communication rolling out DNSSEC), but where they unlikely to be identified as a culprit.
ICANN needs some real risk assessment capabilities, instead of relying on risk assessment from a legal perspective, which typically is satisfied only with 0% risk — which is not a real-world position to take, especially in a field as fast moving, and as filled with so many unknowns as the Internet. They would then be able to communicate honestly to the world as to why they take certain positions, instead of pointing helplessly at nebulous unknowns. If ICANN *really* wants to secure the security and stability of Internet, it’s going to need to take risks — calculated ones. There is no zero-risk scenario where ICANN is effective.
Antony
Problem started somewhere between 2013-08-14 08:51:41 UTC and 2013-08-14 12:26:40 UTC. It persisted at least until 2013-08-14 13:49:03 UTC.
.gov DNSSEC snapshots:
http://dnsviz.net/d/gov/UgtFHg/dnssec/
http://dnsviz.net/d/gov/Ugt3gQ/dnssec/
http://dnsviz.net/d/gov/UguK0A/dnssec/
http://dnsviz.net/d/gov/UguRGg/dnssec/
Everything involves risk. Crossing the street involves risk. We humans are constantly assessing the risk vs the benefit.
Shall I cross this slightly trafficked street (very small probability but risk of very bad event happening – death) to make my meeting on time (some benefit)?
We have to assess not only 1) the risk (chance of it happening) but 2) the magnitude of the potential harm, and 3) the magnitude of the benefit.
In the DNSSEC case, the probability of a negative event happening is non-zero (as this event shows), the magnitude of the bad event is medium and the benefit is medium.
The benefits to DNSSEC outweigh the risks. But make no mistake, there are risks to implementing DNSSEC. In fact, comparing DNSSEC and new TLDs, the change DNSSEC imposed on the DNS is much much larger than the change that new TLDs impose on the DNS.
Therefore the risks to implementing DNSSEC is much larger than the risk of new TLDs.
Comparing the benefits of the two, there are net benefits that DNSSEC brings to the world (more security), but the net benefits that new TLDs bring are even larger (competition, innovation, etc).
So we, the ICANN community, implemented DNSSEC even thought the risks are more (more change to the DNS) and the benefits are less than new TLDs.
“Name collisions” have a non-zero probability of happening, true (they happen every day in .com for example). But the consequence of a “name collision” is small (in my opinion very small, which is why we allow them to happen in .com) and the benefits brought by new TLDs, such as .home and .corp are big.
The v6 and DNSSEC evangelicals successfully added their pet causes as mandatory-to-implement by new gTLD operators, even if (a) located where native v6 is not available and/or (b) for use models lacking valuable targets (e.g., community-based applications).
These new operators are compelled to waste resources on v4 exhaustion & security theater, and are likely to make more mistakes than experienced, highly capitalized operators.
I differ from Antony and Paul, who offer specific comparisons of argued risk, and offer, as a general error of staff the insertion of the v6 and DNSSEC requirements for new registry operators, for which little value at start-up (years 1-5) can be offered.
There is a chicken-and-egg situation happening with both IPv6 and DNSSEC that requires the industry to adopt those even its numbers would indicate otherwise. I think ICANN was right in requiring those to be deployed, but it could have lessened such burden by indicating that IPv6 tunneling was OK (it’s possible to get tunneled-IPv6 for free) and providing DNSSEC capacity building as another avenue of applicant support.