Latest news of the domain name industry

Recent Posts

Domain security arrives in .com

Kevin Murphy, April 1, 2011, Domain Tech

VeriSign announced late yesterday that it has fully implemented DNSSEC in .com, meaning pretty much anyone with a .com domain name can now implement it too.

DNSSEC is a domain-crypto protocol mashup that allows web surfers, say, to trust that when they visit wellsfargo.com they really are looking at the bank’s web site.

It uses validatable cryptographic signatures to prevent cache poisoning attacks such as the Kaminsky Bug, the potential internet-killer that caused panic briefly back in 2008.

With .com now supporting the technology, DNSSEC is now available in over half of the world’s domains, due to the size of the .com zone. But registrants have to decide to use it.

I chatted to Matt Larson, VeriSign’s VP of DNS research, and Sean Leach, VP of technology, this afternoon, and they said that .com’s signing could be the tipping point for adoption.

“I feel based on talking to people that everybody has been waiting for .com,” Larson said. “It could open the floodgates.”

What we’re looking at now is a period of gradual adoption. I expect a handful of major companies will announce they’ve signed their .coms, probably in the second half of the year.

Just like a TLD launch, DNSSEC will probably need a few anchor tenants to raise the profile of the technology. Paypal, for example, said it plans to use the technology at an ICANN workshop in San Francisco last month, but that it will take about six months to test.

“Most people have their most valuable domains in the .com space,” said Leach. “We need some of the big guys to be first movers.”

There’s also the issue of ISPs. Not many support DNSSEC today. The industry has been talking up Comcast’s aggressive deployment vision for over a year now, but few others have announced plans.

And of course application developer support is needed. Judging from comments made by Mozilla representatives in San Francisco, browser makers, for example, are not exactly champing at the bit to natively support the technology.

You can, however, currently download plugins for Firefox that validate DNSSEC claims, such as this one.

According to Leach, many enterprises are currently demanding DNSSEC support when they buy new technology products. This could light a fire under reluctant developers.

But DNSSEC deployment will still be slow going, so registries are doing what they can to make it less of a cost/hassle for users.

Accredited registrars can currently use VeriSign’s cloud-based signing service for free on a trial basis, for example. The service is designed to remove the complexity of managing keys from the equation.

I’m told “several” registrars have signed up, but the only one I’m currently aware of is Go Daddy.

VeriSign and other registries are also offering managed DNSSEC as part of their managed DNS resolution enterprise offerings.

Neither of the VeriSign VPs was prepared to speculate about how many .com domains will be signed a year from now.

I have the option to turn on DNSSEC as part of a Go Daddy hosting package. I probably will, but only in the interests of research. As a domain consumer, I have to say the benefits haven’t really been sold to me yet.

Microsoft spends $7.5 million on IP addresses

Kevin Murphy, March 24, 2011, Domain Tech

It’s official, IP addresses are now more expensive than domain names.

Nortel Networks, the bankrupt networking hardware vendor, has sold 666,624 IPv4 addresses to Microsoft for $7.5 million, according to Delaware bankruptcy court documents (pdf).

That’s $11.25 per address, more than you’d expect to pay for a .com domain name. Remember, there’s no intellectual property or traffic associated with these addresses – they’re just routing numbers.

This, I believe, is the first publicly disclosed sale of an IP address block since ICANN officially announced the depletion of IANA’s free pool of IPv4 blocks last month.

The deal came as part of Nortel’s liquidation under US bankruptcy law, which has been going on since 2009. According to a court filing:

Because of the limited supply of IPv4 addresses, there is currently an opportunity to realize value from marketing the Internet Numbers, which opportunity will diminish over time as IPv6 addresses are more widely adopted.

Nortel contacted 80 companies about the sale a year ago, talked to 14 potential purchasers, and eventually received four bids for the full block and three bids for part of the portfolio.

Microsoft’s bid was the highest.

The Regional Internet Registries, which allocate IP addresses, do not typically view IP as an asset that can be bought and sold. There are processes being developed for assignees to return unused IPv4 to the free pool, for the good of the internet community.

But this kind of “black market” – or “gray market” – for IP addresses has been anticipated for some time. IPv4 is now scarce, there are costs and risks associated with upgrading to IPv6, and the two protocols are expected to co-exist for years or decades to come.

In fact, during ICANN’s press conference announcing the emptying of the IPv4 pool last month, the only question I asked was: “What is the likelihood of an IPv4 black market emerging?”.

In reply, Raul Echeberria, chair of ICANN’s Number Resource Organization, acknowledged the possibility, but played down its importance:

There is of course the possibility of IPv4 addresses being traded outside of the system, but I am very confident it will be a very small amount of IPv4 addresses compared to those transferred within the system. But it is of course a possibility this black market will exist, I’m not sure that it will be an important one. If the internet community moves to IPv6 adoption, the value of the IPv4 addresses will decrease in the future.

I doubt we’ll hear about many of these sales in future, unless they come about due to proceedings such as Nortel’s bankruptcy sale, but I’m also confident they will happen.

The total value of the entire IPv4 address space, if the price Microsoft is willing to pay is a good guide, is approximately $48.3 billion.

IPv4 addresses to run out Thursday

Kevin Murphy, February 1, 2011, Domain Tech

ICANN will announce the final depletion of its pool of IPv4 addresses this Thursday.

The Number Resource Organization will hold a “ceremony and press conference to make a significant announcement and to discuss the global transition to the next generation of Internet addresses”.

The NRO is ICANN’s supporting organization representing Regional Internet Registries, the outfits responsible for handing out IP addresses to network operators.

ICANN, the Internet Society and the Internet Architecture Board will also participate in the event, scheduled for Thursday February 3 at 1430 UTC. It will be webcast here.

Today, APNIC, the Asia-Pacific RIR, said that it has been assigned two /8 blocks of addresses, meaning IANA is down to its Final Five chunks.

Thursday’s ceremony will presumably entail ICANN/IANA officially handing out these last five blocks to the five RIRs, one each, as called for by its allocation policy.

After that, it’s all gone. No more IPv4. The age of IPv6 is upon us.

It is currently estimated that the RIRs will themselves run out of IPv4 in September. After that, if they need IP addresses they’ll receive IPv6.

IPv4 is rapidly becoming a scarce commodity.

Many people, including ICANN chairman Peter Dengate Thrush, have predicted a “gray market” for addresses to appear, with address blocks changing hands for less than the cost of upgrading to IPv6.

The focus on Thursday, however, will be all about the measures network operators need to implement in order to remain viable on an internet increasingly running IPv6 equipment.

DNS not to blame for Egypt blackout

Kevin Murphy, January 28, 2011, Domain Tech

Egypt got disconnected from the internet last night, but it does not appear that DNS is to blame.

It what appears to be an unprecedented move, internet traffic to and from Egypt dried up to a trickle, apparently as a result of a government effort to crack down on anti-presidential protests.

While a number of reports have blamed DNS for the outage, the currently available data suggests the problem is much more deeply rooted.

Traffic monitoring firm Renesys seems to be one of the best sources of primary data so far. The company’s James Cowie blogged today:

At 22:34 UTC (00:34am local time), Renesys observed the virtually simultaneous withdrawal of all routes to Egyptian networks in the Internet’s global routing table. Approximately 3,500 individual BGP routes were withdrawn, leaving no valid paths by which the rest of the world could continue to exchange Internet traffic with Egypt’s service providers. Virtually all of Egypt’s Internet addresses are now unreachable, worldwide.

BGP is the Border Gateway Protocol. It’s used where networks interconnect, enabling ISPs to “announce” what IP addresses they are responsible for and exchange traffic accordingly.

With no BGP routes into or out of Egypt, whether the DNS works or not is pretty much moot.

Blocking individual domain names, such as twitter.com, is one way to stifle communication. Another way is to instruct local ISPs to turn off DNS altogether.

But in both cases users can route around the blockade by choosing overseas DNS servers, such as the services Google and OpenDNS make available for free.

Even without DNS, users can still access web resources using IP addresses, if they know what they are.

But when ISPs stop announcing their IP addresses, even that becomes impossible. Even if you know how to find a web site, it has no way of finding you.

In this case, it seems likely that Egypt has physically unplugged itself from the global internet, which means its traffic is going nowhere, no matter what protocol you’re talking about.

But even this is not foolproof. According to experts interviewed on BBC news in the last hour, ISPs outside of the country are offering free dial-up access to Egyptians.

Egyptians with access to a dial-up modem, phone jack, compatible computer and long-distance service will presumably be able to use these services to reach the outside world, albeit at 1990s speeds.

With all the inter-governmental debate about the management of domain names over the last several years, the Egypt crisis is a useful reminder that DNS is not the quintessential element of internet governance it is often made out to be.

Go Daddy’s new billion-dollar business?

Kevin Murphy, January 25, 2011, Domain Tech

Go Daddy has officially unveiled its Premium DNS service, which will enable its customers to buy and use managed DNSSEC services for the first time.

The price is $2.99 per month, which works out to $35.88 a year.

For the money, buyers also get a bunch of other tools, such as reports and audits, off-site DNS functionality and backup name servers.

There’s also a “Vanity Nameserver” option, which appears to let customers set their domain’s name servers to display as something like brand.domaincontrol.com, rather than ns1.domaincontrol.com.

It also appears that users of Go Daddy’s standard service will now be limited to 100 forwarded sub-domains, with Premium DNS users getting an unlimited number.

But the big deal as I see it is the addition of managed DNSSEC.

DNSSEC is a new security protocol that substantially mitigates the risk of falling prey to a DNS hijacking using, say, a cache poisoning attack.

Remember the Kaminsky Bug? DNSSEC prevents that kind of thing from happening again.

The problem with DNSSEC is that it’s massively complex and quite hard work to manage, requiring frequent key generation and rollover.

Go Daddy users can already manage their own DNSSEC records if they choose, but that’s only really an option if you’re a hard-core DNS geek.

Paying a few bucks a month to have somebody else manage it for you is an absolute bargain, if you care enough about your domain’s security.

I suggest that this could be a lucrative business for Go Daddy primarily because proponents of DNSSEC hope that one day it will be ubiquitous. Every domain will use it.

Go Daddy has over 45 million domains under management today. If customers representing only 1% of its domains choose to upgrade, that’s an extra $16 million into company coffers annually.

If they all do (which is not going to happen) we’re talking about a $1.6 billion business.

I don’t think the new service is going to lead to a massive uptick in the number of signed domains, but it will certainly get the ball rolling. For enterprises, it’s good value.

But individuals and large domain portfolio holders will not flock to return to 1999 .com prices just in order to implement a protocol they’ve been doing just fine without.

The future of broad DNSSEC adoption is more likely to be in open-source and freeware tools and services that can be easily understood by geeks and non-geeks alike.

Google and Facebook to cut off thousands for World IPv6 Day

Kevin Murphy, January 12, 2011, Domain Tech

Some of the internet’s biggest companies are going to deliberately break their web sites for a day, for hundreds of thousands of users, in order to raise awareness of IPv6.

Google, Facebook and Yahoo are among the companies that will go into production with the protocol for 24 hours, starting at midnight UTC, June 8, for World IPv6 Day.

For the day, the companies will make their sites accessible using a dual stack of IPv4 and IPv6. Most users will be unaffected and will be able to access the services as normal.

But Google predicted on its blog that 0.05% of users may “experience connectivity problems, often due to misconfigured or misbehaving home network devices.”

Facebook purportedly has 500 million users, so presumably it’s expecting 250,000 of them to be cut off from its site for the day, with a corresponding dip in ad impressions and revenue.

World IPv6 Day is being overseen by the Internet Society. ICANN/IANA does not appear to have a role, despite it having global responsibility over IP address allocations.

ISOC’s site says:

The goal of the Test Drive Day is to motivate organizations across the industry – Internet service providers, hardware makers, operating system vendors and web companies – to prepare their services for IPv6 to ensure a successful transition as IPv4 addresses run out.

The IPv4 pool is estimated to be exhausted next month, when IANA allocates the final five /8 blocks to the Regional Internet Registries. The RIRs are expected to run out of addresses in November.

Not too long after that, IPv6 will be the only choice if you want to obtain IP addresses through official channels. If you want IPv4, you’ll have to head to the gray market.

Vixie takes on ISC chief scientist role

Kevin Murphy, January 7, 2011, Domain Tech

Internet Systems Consortium president Paul Vixie plans to address a “perfect storm” of internet addressing “crises” by becoming the organization’s chairman and chief scientist.

Vixie founded the not-for-profit ISC, which provides BIND – the software that runs most of the domain name system – in 1994. He will be replaced as president by Barry Greene.

Not known for mincing words, Vixie said in brief ISC statement today:

There are two huge technical crises arising simultaneously. The Internet is running out of address space and at the same time the level of criminal activity is increasing sharply. It’s the perfect storm. We need to deploy IPv6 and DNSSEC more or less simultaneously, and we need to develop and deploy, quickly, new technologies and new methodologies to measure and understand what is happening out there. I need to turn my full attention to these pressing and difficult problems, and I know that ISC will be in good hands with Barry as president.

VeriSign takes over .gov

Kevin Murphy, December 22, 2010, Domain Tech

VeriSign has taken over registry functions at .gov, the top-level domain for the US government.

IANA records show that VeriSign Global Registry Services was named technical contact for .gov possibly as recently as this Monday.

The TLD is still administratively delegated to the US General Services Administration. Google’s cache of the IANA site shows the GSA was the technical contact for .gov as recently as October 29.

VeriSign certainly kept this contract win quiet.

At least, the first I heard about it was tonight, in an email VeriSign sent to the dns-ops mailing list, asking DNS administrators to reconfigure their DNSSEC set-up to reflect the change.

A KSK [Key Signing Key] roll for the .gov zone will occur at the end of January, 2011. This key change is necessitated by a registry operator transition: VeriSign has been selected by the U.S. General Services Administration (GSA) to operate the domain name registry for .gov.

The email expresses the urgency of making the changes, which are apparently needed in part because .gov was signed with DNSSEC before the root zone was signed, and some resolvers may be configured to use .gov as a “trust anchor” instead of the root.

The .gov TLD is reserved for the exclusive use of US federal and state government departments and agencies.

It’s certainly a prestige contract for VeriSign.

This appears to be the GSA page awarding the contract to VeriSign, in September, following an RFP. It’s valued at $3,325,000.

Go Daddy plans Premium DNS service

Kevin Murphy, December 13, 2010, Domain Tech

Go Daddy is to launch a Premium DNS service that will include managed DNSSEC security, the company revealed during sessions at the ICANN meeting in Cartagena last week.

Go Daddy customers can currently get a brief overview of the forthcoming service by logging into their domain manager and finding the Premium DNS “Coming Soon” link, or looking here.

During a session on DNSSEC in Colombia last week, Go Daddy’s James Bladel laid out more detail on the service in a presentation (PDF) which contains screenshots of the interface.

The company started supporting DNSSEC for free on certain TLDs in the summer – it currently supports .net, .biz, .eu, org and .us – but it requires users to manually generate and manage cryptographic keys.

That’s beyond the ken of most domain name owners, so the registrar is adding a premium “set it and forget it” service which will see Go Daddy manage the complexities of DNSSEC.

Bladel said of the service:

it’s as simple as having a DNSSEC on/off switch. So customers who have no particular interest in the behind- the-scenes technology of DNSSEC can simply flip that switch and then enjoy the benefits of a secured domain name.

The DNSSEC standard helps prevent domains being hijacked through cache poisoning attacks by signing each domain’s zone with a validatable cryptographic key. The technology will be available for .com domains early next year.

It’s by no means free or easy for registrars to implement, and there’s been little demand for the technology among registrants, so I’ve been wondering how registrars planned to monetize it.

Now we know how Go Daddy at least plans to do so – the Premium DNS service will have other benefits beyond DNSSEC, which could spur adoption through osmosis.

The service will also include DNS up-time guarantees of 99.999%, vanity name servers, log tracking, and several other perks.

The company has not officially announced the service to customers yet, so I expect we’ll find out more details in due course.

VeriSign launches free cloud domain security service

Kevin Murphy, December 2, 2010, Domain Tech

VeriSign is to offer registrars a hosted DNSSEC signing service that will be free for names in .com and the company’s other top-level domains.

The inventively named VeriSign DNSSEC Signing Service offloads the tasks associated with managing signed domains and is being offered for an “evaluation period” that runs until the end of 2011.

DNSSEC is an extension to DNS that allows domains to be cryptographically signed and validated. It was designed to prevent cache poisoning attacks such as the Kaminsky Bug.

It’s also quite complex, requiring ongoing secure key management and rollover, so I expect the VeriSign service, and competing services, will be quite popular among registrars reluctant to plough money into the technology.

While some gTLDs, including .org, and dozens of ccTLDs, are already DNSSEC-enabled, VeriSign doesn’t plan on bringing the technology online in .com and .net until early next year.

The ultimate industry plan is for all domain names to use DNSSEC before too many years.

One question I’ve never been entirely clear on was whether the added costs of implementing DNSSEC would translate into premium-priced services or price increases at the registrar checkout.

A VeriSign spokesperson told me:

The evaluation period is free for VeriSign-managed TLDs and other TLDs. After that period, the VeriSign-managed TLDs will remain free, but other TLDs will have $2 per zone annual fee.

In other words, registrars will not have to pay to sign their customers’ .com, .net, .tv etc domains, but they will have to pay if they choose to use the VeriSign service to sign domains in .biz, .info or any other TLD.