Latest news of the domain name industry

Recent Posts

Go Daddy plans Premium DNS service

Kevin Murphy, December 13, 2010, Domain Tech

Go Daddy is to launch a Premium DNS service that will include managed DNSSEC security, the company revealed during sessions at the ICANN meeting in Cartagena last week.

Go Daddy customers can currently get a brief overview of the forthcoming service by logging into their domain manager and finding the Premium DNS “Coming Soon” link, or looking here.

During a session on DNSSEC in Colombia last week, Go Daddy’s James Bladel laid out more detail on the service in a presentation (PDF) which contains screenshots of the interface.

The company started supporting DNSSEC for free on certain TLDs in the summer – it currently supports .net, .biz, .eu, org and .us – but it requires users to manually generate and manage cryptographic keys.

That’s beyond the ken of most domain name owners, so the registrar is adding a premium “set it and forget it” service which will see Go Daddy manage the complexities of DNSSEC.

Bladel said of the service:

it’s as simple as having a DNSSEC on/off switch. So customers who have no particular interest in the behind- the-scenes technology of DNSSEC can simply flip that switch and then enjoy the benefits of a secured domain name.

The DNSSEC standard helps prevent domains being hijacked through cache poisoning attacks by signing each domain’s zone with a validatable cryptographic key. The technology will be available for .com domains early next year.

It’s by no means free or easy for registrars to implement, and there’s been little demand for the technology among registrants, so I’ve been wondering how registrars planned to monetize it.

Now we know how Go Daddy at least plans to do so – the Premium DNS service will have other benefits beyond DNSSEC, which could spur adoption through osmosis.

The service will also include DNS up-time guarantees of 99.999%, vanity name servers, log tracking, and several other perks.

The company has not officially announced the service to customers yet, so I expect we’ll find out more details in due course.

VeriSign launches free cloud domain security service

Kevin Murphy, December 2, 2010, Domain Tech

VeriSign is to offer registrars a hosted DNSSEC signing service that will be free for names in .com and the company’s other top-level domains.

The inventively named VeriSign DNSSEC Signing Service offloads the tasks associated with managing signed domains and is being offered for an “evaluation period” that runs until the end of 2011.

DNSSEC is an extension to DNS that allows domains to be cryptographically signed and validated. It was designed to prevent cache poisoning attacks such as the Kaminsky Bug.

It’s also quite complex, requiring ongoing secure key management and rollover, so I expect the VeriSign service, and competing services, will be quite popular among registrars reluctant to plough money into the technology.

While some gTLDs, including .org, and dozens of ccTLDs, are already DNSSEC-enabled, VeriSign doesn’t plan on bringing the technology online in .com and .net until early next year.

The ultimate industry plan is for all domain names to use DNSSEC before too many years.

One question I’ve never been entirely clear on was whether the added costs of implementing DNSSEC would translate into premium-priced services or price increases at the registrar checkout.

A VeriSign spokesperson told me:

The evaluation period is free for VeriSign-managed TLDs and other TLDs. After that period, the VeriSign-managed TLDs will remain free, but other TLDs will have $2 per zone annual fee.

In other words, registrars will not have to pay to sign their customers’ .com, .net, .tv etc domains, but they will have to pay if they choose to use the VeriSign service to sign domains in .biz, .info or any other TLD.

VeriSign to deploy DNSSEC in .com next March

Kevin Murphy, October 29, 2010, Domain Tech

VeriSign is to start rolling out the DNSSEC security protocol in .net today, and will sign .com next March, the company said today.

In an email to the dns-ops mailing list, VeriSign vice president Matt Larson said that .net will get a “deliberately unvalidatable zone”, which uses unusable dummy keys for testing purposes, today.

That test is set to end on December 9, when .net will become fully DNSSEC-compatible.

The .com TLD will get its own unvalidatable zone in March, but registrars will be able to start submitting cryptographic keys for the domains they manage from February.

The .com zone will be validatable later in March.

The DNSSEC standard allows resolvers to confirm that DNS traffic has not been tampered with, reducing the risk of attacks such as cache poisoning.

Signing .com is viewed as the last major registry-level hurdle to jump before adoption kicks off more widely. The root zone was signed in July and a few dozen other TLDs, such as .org, are already signed.

DNSSEC to kill the ISP wildcard?

Kevin Murphy, October 19, 2010, Domain Tech

Comcast is to switch off its Domain Helper service, which captures DNS error traffic and presents surfers with sponsored search results instead, as part of its DNSSEC implementation.

The ISP said yesterday that it has started to roll out the new security mechanism to its production DNS servers across the US and expects to have all customers using DNSSEC by the “early part of 2011”.

The deployment will come in two phases. The first phase, expected to last 60 days, sees DNSSEC turned on for subscribers who have previously opted out of the Domain Helper system.

After that, Comcast will continue the rollout to all of its customers, which will involve killing off the Domain Helper service for good.

As the company says in its FAQ:

# We believe that the web error redirection function of Comcast Domain Helper is technically incompatible with DNSSEC.
# Comcast has always known this and plans to turn off such redirection when DNSSEC is fully implemented.
# The production network DNSSEC servers do not have Comcast Domain Helper’s DNS redirect functionality enabled.

When web users try to visit a non-existent domain, DNS normally supplies a “does-not-exist” reply. Over recent years it has become increasingly common for ISPs to intercept this response and show users a monetized search page instead.

But DNSSEC introduces new anti-spoofing features that require such responses to be cryptographically signed. This, it seems, means ISPs will no longer be able to intercept and monetize error traffic without interfering with the end-to-end functionality of DNSSEC.

Comcast, which has been trialing the technology with volunteers for most of the year, says that to do so “breaks the chain of trust critical to proper DNSSEC validation functionality”.

It looks like it’s the beginning of the end of the ISP error wildcard. That’s got to be a good thing, right?

Afilias adds DNSSEC to .info zone

Kevin Murphy, September 9, 2010, Domain Tech

The .info domain has become the latest gTLD to be signed with DNSSEC, the security standard for domain name lookups.

Afilias, which runs the .info registry, said today that it has signed its zone and added the necessary records to the DNS root.

DNSSEC is designed to prevent cache poisoning attacks, which can be used to hijack domain names and carry out phishing campaigns.

For registrants, DNSSEC in .info doesn’t mean much in practical terms yet. If you have a .info, you’ll have to wait for registrars to start to support the standard.

At the moment, only 19 second-level .info domains, including afilias.info and comcast.info, have been signed, as part of a “friends and family” testbed program.

The .org zone, which Afilias also provides the back-end for, was signed in June.

Neustar added full DNSSEC support for .biz in August, according to an announcement this week.

For .com and .net, VeriSign is currently planning to roll out the technology in the first quarter of 2011.