Latest news of the domain name industry

Recent Posts

ICANN takes the lamest swipe at Namecheap et al over blockchain domains

Kevin Murphy, November 24, 2021, 15:58:58 (UTC), Domain Tech

ICANN has come out swinging against blockchain domains and the registrars that sell them. And by “come out” I mean it’s published a blog post. And by “swinging” I mean “offered the weakest criticism imaginable”.

The post starts off well enough, observing that services marketed as “domain names” that are not automatically compatible with the global DNS are probably not a great purchase, because they don’t work like regular domains.

Using these alternatives requires something like a browser plug-in or to reconfigure your device to use a specialist DNS resolver network, the post notes, before concluding with a brief caveat emptor message.

All good stuff. ICANN has been opposed to alt-root domain efforts for at least 20 years, and the policy is even enshrined in so-called ICP-3, which nobody really talks about any more but appears to still be the law of ICANN Land.

So, which domain-alternatives is ICANN referring to here, and which registrars are selling them? The post states:

Name resolution systems outside the DNS have existed for a long time. One could mention the Sun Microsystem Network Information Service (NIS), the Digital Object Architecture (DOA), or even the Ethereum Name Service (ENS)…

With some ICANN-accredited registrars now selling NIS, DOA, or other similar domains alongside standard domain names, the potential for confusion among unsuspecting customers seems high.

You may be asking: what the heck (or, if you’re like me, fuck) are NIS and DOA domains, and which registrars are selling them?

Great questions.

NIS is an authentication protocol (a bit like LDAP) for Unix networks developed in 1985 (the same year the original DNS standard was finalized) by Sun Microsystems, a company that hasn’t existed in over a decade.

To the best of my knowledge they’ve never been marketed as an alternative to regular domain names. Nobody’s ever used them to address a publicly available web site. Nobody sells them.

DOA, also known as the Handle System, is a more recent idea, first implemented in 1994, before some of you were born. Handles are mostly numeric strings used to address digital objects such as documents. Libraries use them.

The main thing to know about Handles for the purposes of this article is that they’re specifically designed to convey no semantic information whatsoever. They’re not designed to look like domain names and they’re not used that way.

So how many registrars are selling NIS/DOA domains? I haven’t checked them all, but I’m going to go out on a pretty sturdy limb and guess the answer is “none”, which is a lot less than the “some” that ICANN asserts.

But ICANN also mentions the Ethereum Name Service, a much newer and sexier way of cybersquatting, based on the Ethereum cryptocurrency blockchain.

ENS allows people to buy .eth domain names (which do not function in the consensus DNS) for the Ethereum equivalent of about $5. As far as I can tell, you can only buy them through, and no ICANN-accredited registrar is functionally capable of selling them.

The ICANN post also contains a brief mention of “Handshake”, and this appears to be what ICANN is actually worried about.

Handshake domains, also known as HNS, look like regular domain names and a handful of ICANN-accredited registrars are actually selling them.

Handshake is also based on blockchain technology, but unlike ENS it also allows people to create their own TLDs (which, again, do not function without special adaptations). Registrars including Namecheap, 101domain and EnCirca sell them.

It’s Namecheap’s storefront hover text, warning that HNS domains don’t work in the regular DNS, that ICANN appears to be paraphrasing in its blog post.

The registrar has a lengthy support article explaining some of the ways you can try to make a Handshake domain work, including an interactive comment thread in which a Namecheap employee suggests that DNS resolvers may choose to resolve HNS TLDs instead of conflicting TLDs that ICANN approves in future.

That’s the kind of thing that should worry ICANN, but it’s got a funny way of expressing that concern. Sun Microsystems? Digital Object Architecture? What’s the message here?

Twenty years ago, I interviewed an ICANN bigwig about, one of the companies attempting to sell alt-root domains at the time. He told me bluntly the company was “breaking the internet” and “selling snake oil”, earning ICANN a snotty lawyer’s letter.

Today’s ICANN post was ostensibly authored by principal technologist Alain Durand, but I’m going to give him the benefit of the doubt and assume comms and legal took their knives to it before it was published.

While some things haven’t changed in the last two decades, others have.

Tagged: , , , , , , , , , ,

Comments (12)

  1. Hahaha yes!

    I was wondering when I’d see a mention of Handshake here.

    Unlike DNS of today, Handshake aims to remove Certificate Authorities from the equation and use a mixture of blockchain, DANE, and DNSSEC instead.

    The easiest (and best, IMHO) way to resolve Handshake names on desktop is via Fingertip, a toolbar application by a company called Impervious.

    ICANN has every right to be concerned. They don’t innovate and they consistently push back planned dates for pretty much everything they publicly announce.

    Would you rather pay $100k just to have a *conversation* about getting your own TLD or bid on one via a Vickrey auction and possibly getting your desired TLD for free? While also helping the Internet be more secure? The choice is easy.

    Where ICANN is “winning” right now is…Handshake is still in its early days and infrastructure is being built as we speak. The next round of gTLDs isn’t slated for another 3-4 years and like clockwork, that’ll get pushed back. Handshake will be unstoppable by then.

    • Kevin Murphy says:

      Giving out TLDs for free to anyone who wants one makes the internet more secure? Even charging $185k a pop wasn’t enough to keep out the scumbags at the top level.

      • The way Vickrey auctions work, you pay the second highest price. So, if you’re the only one who bids on a TLD and the auction ends, you pay the second highest price, which would be 0. There’s also the functionality of adding a blind to your bid which effectively disguises your true bid. The purpose of doing this would be to dissuade others from bidding. Lots of gamification mechanics to make things interesting.

        In regards to making DNS more secure, Handshake relies on specifications like DANE/DNSSEC for the trust anchor, rather than CAs. Organizations are not immune to greed, spoofing, and other things that can compromise infrastructure (see ICANN’s proposed sale of .org, CAs getting hacked, &c). The Internet started out decentralized, Handshake is a way to bring it back while also providing incentives for doing so.

        All existing TLDs in the ICANN namespace are reserved on Handshake so there’s no conflict there. Honestly, ICANN would still be winning if they embraced Handshake, what with all the HNS they’d accumulate by claiming them with DNS proofs.

    • Kevin Murphy says:

      Oh, and thanks for reminding me about the former existence of “webrings”. As if I didn’t feel old enough already!

  2. Rubens Kuhl says:

    DOA is being sponsored by ITU in an attempt to get relevant in the world of the Internet. “Comparison and Analysis of DNS and DOA for Internet of Things Naming System” and other texts might give a hint on why it was mentioned.

  3. The Finger says:

    Handshake’s really been growing fast. I actually think this one is going to work.

    Exciting times.

  4. Rob Golding says:

    Whilst there was the potential initially for HNS it degenerated into a scammer/squatter heavy system pretty quick, and is stacked so heavily in the abusers favour now.

Add Your Comment