Top-level domain count likely to top 300 this year

Perusing the big stack of marketing literature that I picked up at ICANN Brussels in June, I noticed that few companies agree about how many top-level domains currently exist.
Mildly surprising really, given that the official count isn’t especially difficult to come by. According to IANA’s database, there are 292 delegated TLDs today.
That number breaks down like this:

251 ASCII ccTLDs
9 IDN ccTLDs
4 gTLDs
3 “restricted” gTLDs
1 “infrastructure” TLD
13 “sponsored” gTLDs
11 test IDN TLDs

Interestingly, according to IANA, there are only four vanilla, open gTLDs – .com, .net, .org and .info.
I wonder how many sites NeuStar has shut down because .biz is “restricted” to business users? Or how many .mobi domains have been put on hold for breaking the “sponsored” guidelines.
The list does not yet count the six IDN ccTLDs that ICANN’s board approved August 5. So there are actually 298 approved top-level domains today.
In the IDN ccTLD pipeline as of Brussels were also Qatar, Singapore and Syria, which had met string approval but were not yet delegated, and about 15 others that had not.
There are two (or three) more voting meetings for ICANN’s board this year, and so it seems likely that the delegated TLD count will break through the 300 mark before 2011.

Palestine gets its own Arabic domain names

ICANN has awarded five more non-ASCII top-level domains under its internationalized domain name fast-track process for country-code TLD managers.
Palestine, Tunisia and Jordan will all shortly receive delegations for Arabic-script versions of their existing ccTLDs. They join previous recipients including Saudi Arabia and Egypt.
Palestine gets فلسطين, Tunisia gets تونس and Jordan gets الاردن.
These apparently translate as “Falasteen”, “Tunis” and “al-Ordan”, respectively, and are presumably more useful to Arabic speakers than .ps, .tn and .jo.
Because they’re all Arabic, the dots appear to the right of the TLD, rather than the left.
The Occupied Palestinian Territory is, of course, a fringe case when it comes to ccTLDs.
But long ago, IANA made it a matter of policy that it would make no decision about which country or territory deserves its own ccTLD.
If it’s on the ISO 3166-1 list, which is overseen by the UN, it’s in. Palestine was added to that list in 1999, and was awarded .ps by ICANN/IANA in 2000.
The .ps registry is sponsored by the Palestinian National Authority’s telecoms ministry.
ICANN has also resolved to delegate Thailand the IDN ccTLD .ไทย and Sri Lanka both .ලංකා and .இலங்கை.
Interestingly, these two TLDs were approved as part of yesterday’s board meeting’s consent agenda.
The three Arabic names were approved separately, preceded by this:

RESOLVED (2010.08.05.13), the Board IANA Committee is directed, in coordination with ICANN’s CEO, to create improvements to the processes and new guidelines for implementation of the IDN ccTLD Fast Track process.

Bulgaria polls public for Cyrillic TLD ideas

The Bulgarian government is asking its people what Cyrillic top-level domain it should ask for if ICANN refuses to reverse its rejection of .бг.
The Ministry of Transport, Communications and Information Technology has published a poll on its web site, presenting four options for an IDN ccTLD.
Its first choice, .бг, was rejected by ICANN/IANA in May due to its visual similarity to another ccTLD, believed to be Brazil’s .br.
The four new options are .бгр, .българия, .бя and .бъл.
Bulgarians can also vote for “nothing but .бг” or declare that they do not want a Cyrillic domain at all.
The poll page, via Google Translate, suggests that the Ministry is prepared to wait for another opportunity to apply for .бг or for an ICANN appeals process to be created, if that’s what the public wants.
The Minister had previously promised to appeal the rejection of .бг.
(First reported by Novinite.)

Chinese TLDs now live, broad adoption achieved in just seven days

Check it out: 教育部。中国.
That’s one, but by no means the only, of the first live, fully Chinese-script domain names. It’s China’s Ministry of Education.
Previously, it had been announced that the .中国 internationalized country-code TLD would not go live until August.
But on Friday CNNIC said that 90% of China’s ministries have got their .中國 domains already, along with 95% of news websites, 90% of universities and 40% of China’s Top 500 enterprises.
Not only was that level of adoption achieved very quietly, it was also achieved very quickly. According to IANA, .中國 was delegated just seven days earlier, on July 9.
IANA also reports that .中國, the IDN for Hong Kong went live on July 12. Taiwan’s .中國 was delegated on July 14.
All of these Chinese-script TLDs were approved by ICANN’s board at the conclusion of the Brussels meeting last month.
It’s perhaps not surprising that ICANN did not broadly announce the latest delegations. It got burnt for pre-empting Arab nations’ publicity when the first IDN TLDs went live in May.
I wonder whether this will help CNNIC reverse the trend of declining registrations in its namespace. According to the latest statistics, the .cn has halved in size over the last year.

Bulgaria to file ICANN reconsideration appeal over rejected IDN ccTLD

Bulgaria is to appeal ICANN’s rejection of .бг, the Cyrillic version of its existing country code top-level domain, .bg.
Technology minister Alexander Tsvetkov said that the Bulgarian government will file a reconsideration request with ICANN, according to a DarikNews.bg interview.
The requested IDN ccTLD .бг was rejected because it looks quite a bit like Brazil’s existing ASCII ccTLD, .br, which could create confusion for Brazilians.
ICANN/IANA does not talk openly about ccTLD delegation issues. As far as I know, .бг is the only IDN ccTLD on the current fast-track program to be rejected on string-similarity grounds.
The Darik News interview, via Google Translate, reports Tsvetkov saying he “believes that this domain is the best way for Bulgaria” and that the government “will ask for reconsideration”.
Asked about the clash with Brazil, he said Bulgaria “will not quit” in its pursuit of its first-choice ccTLD.
Brazil has not been silent on the issue.
During the meeting on Tuesday between the ICANN board and its Governmental Advisory Committee, Brazil’s representative praised ICANN for rejecting .бг:

Brazil would like to express its support to the recent board’s decision about avoiding graphic similitude between new country codes and current country codes in Latin. This is particularly important inasmuch as any graphic confusion might facilitate phishing practices and all the problems related to it.

Many thanks to the Bulgarian reader who referred me to this Darik News interview.
For any other Bulgarians reading this, the interview also appears to contain lots of other really juicy information not related to domain names. Check it out.

ICANN staff need to get their pee tested

I imagine it’s a pretty hard job, largely thankless, working at ICANN. No matter what you do, there’s always somebody on the internet bitching at you for one reason or another.
The job may be about to get even more irksome for some staffers, if ICANN decides to implement new security recommendations made by risk management firm JAS Communications.
In a report published yesterday, JAS suggests that senior IANA staff – basically anyone with critical responsibilities over the DNS root zone – should be made to agree to personal credit checks, drug screening and even psych evaluations.
To anyone now trying to shake mental images of Rod Beckstrom peeing into a cup for the sake of the internet, I can only apologise.
This is what the report says:

JAS recommends a formal program to vet potential new hires, and to periodically re‐vet employees over time. Such a vetting program would include screening for illegal drugs, evaluation of consumer credit, and psychiatric evaluation, which are all established risk factors for unreliable and/or malicious insider activity and are routinely a part of employee screening in government and critical infrastructure providers.

I’ve gone for the cheap headline here, obviously, but there’s plenty in this report to take seriously, if you can penetrate the management consultant yadda yadda.
There are eight other recommendations not related to stoners running the root, covering contingencies such as IANA accidentally unplugging the internet and Los Angeles sinking into the Pacific.
Probably most interesting of all is the bit explaining how ICANN’s custom Root Zone Management System software, intended to reduce the possibility of errors creeping into the root after hundreds of new TLDs are added, apparently isn’t being built with security in mind.
“No formal requirements exist regarding the security and resiliency of these systems, making it impossible to know whether the system has been built to specification,” the report says.
It also notes that ICANN lacks a proper risk management strategy, and suggests that it improve communications both internally and with VeriSign.
It discloses that “nearly all critical resources are physically located in the greater Los Angeles area”, which puts the IANA function at risk of earthquake damage, if nothing else.
JAS recommends spreading the risk geographically, which should give those opposed to ICANN bloat something new to moan about.
There’s a public comment forum over here.
UPDATE (2010-06-13): As Michael Palage points out over at CircleID, ICANN has pulled the PDF from its web site for reasons unknown.
On the off-chance that there’s a good security reason for this, I shall resist the temptation to cause mischief by uploading it here. This post, however, remains unedited.

Four of the top 100 brands have insecure domain names

Some of the world’s most famous global brands have domain names that are still vulnerable to the Kaminsky exploit and could be hijacked by others.
Earlier today, I ran all of the brands on Deloitte’s list of the top 100 brands through a vulnerability testing tool provided by IANA.
The results show that four of these brands – all household names – have domains classed as “highly vulnerable” to the Kaminsky exploit.
If the IANA test is reliable, this means that false data could be injected into their name servers, potentially redirecting users to a web site belonging to the attacker.
Another eight brands had domains that the IANA tool reported might be “vulnerable” to attacks, but which had measures in place to mitigate the risk.
The Kaminsky bug has been public for almost two years. It’s a cache poisoning attack in which a recursive name server is tricked into providing false data about a domain.
It becomes particularly scary when a domain’s authoritative name servers also have their recursive functions turned on. A successful attack could redirect all traffic to a compromised domain to a server managed by the attacker.
The surest way to avoid vulnerability is to turn off recursion. IANA says: “Authoritative name servers should never be configured to provide recursive name service.”
Alternatively, a method known as source port randomization can make the risk of being compromised by the Kaminsky exploit so small it’s barely a threat at all.
The IANA tool reports that four of the top 100 brands have at least one “highly vulnerable” authoritative name server that has recursion enabled and no source port randomization.
The other eight “vulnerable” domains were identified as running on at least one authoritative server that had recursion turned on and source port randomization enabled.
I’m not an expert, but I don’t believe this second category of companies has a great deal to worry about in terms of Kaminsky.
I picked the Deloitte brand list for this experiment because it is the list of brands Deloitte believes require the most trademark protection under ICANN’s new TLD process.
.CO Internet is already using the list during its sunrise period for the .co domain.
Michele Neylon of Blacknight has found some more vulnerable servers over here.

ICANN accused of Twitter faux pas over Arabic domains

The registry behind one of the new Arabic-script ccTLDs has sharply criticised ICANN for the way it introduced internationalized domain names to the root this week.
Adrian Kinderis, CEO of AusRegistry, accused ICANN, specifically those responsible for the IANA function, of “embarrassing incompetency” and cultural insensitivity.
Kinderis’ beef is that IANA added the three new Arabic IDNs to the root without giving their local managers so much as a headsup.
AusRegistry is the back-end provider for امارات. the United Arab Emirates’ new IDN ccTLD, as well as its ASCII original.
“I was alarmed to discover that the relevant ccTLD Managers were only notified many hours after the fact, long after the same IANA staff member had broadcast the news on a personal Twitter account,” he blogged.
While Kinderis was diplomatic enough not to name names, he’s talking about IANA registry manager Kim Davies, who broke the web-changing news on Wednesday with a tweet.
“This was an inappropriate manner in which to announce an event of this importance,” Kinderis wrote. “It displays a disturbing lack of understanding and a complete disregard of the cultural and political significance of this event within the Arabic world.”
He goes on to point out that the announcement was made during Saudi Arabia’s weekend, leaving ccTLD managers scrambling to get their marketing in place on their day off.
I could keep quoting. It’s a fairly extraordinary attack on aspects of ICANN’s culture. Go have a read.

I-Root yanks Beijing node

Autonomica, which runs i-root-servers.net, has stopped advertising its Anycast node in Beijing, after reports last week that its responses were being tampered with.
In the light of recent tensions between China and the US, people got a bit nervous after the Chilean ccTLD manager reported some “odd behaviour” to the dns-ops mailing list last week.
It seemed that DNS lookups for Facebook, Twitter and YouTube were being censored as they returned from I-Root’s node in China, which is hosted by CNNIC.
There was no suggestion that Autonomica was complicit in any censorship, and chief executive Karl Erik Lindqvist has now confirmed as much.
“Netnod/Autonomica is 100% committed to serving the root zone DNS data as published by the IANA. We have made a clear and public declaration of this, and we guarantee that the responses sent out by any i.root-servers.net instance consist of the appropriate data in the IANA root zone,” he wrote.
While Lindqvist is not explicit, the suggestion seems to be that somebody on the Chinese internet not associated with I-Root has been messing with DNS queries as they pass across the network.
This is believed to be common practice in China, whose citizens are subject to strict censorship, but any such activity outside its borders obviously represents a threat to the internet’s reliability.
The CNNIC node is offline until further notice.