Latest news of the domain name industry

Recent Posts

Decision on .org deal may come sooner than you think

Kevin Murphy, April 28, 2020, Domain Registries

If you’re against the acquisition of .org and are thinking about an objection or spot of lobbying at the eleventh hour, be aware: this is the eleventh hour.

The deal, which would see Ethos Capital buy Public Interest Registry from the Internet Society for over a billion dollars, is on the agenda for a meeting of the ICANN board of directors this Thursday.

ICANN and Ethos have agreed to a May 4 deadline for a decision, but is whispered that the board plans to give the deal the nod, or not, at the Thursday meeting.

Given how long it usually takes for ICANN to post the results of its board meetings, typically a few days, there’s a decent chance that PIR, Ethos and ISOC could be given formal approval before any opponents have time to react to the resolution.

I think it could go either way.

The one thing I have a fairly high degree of confidence in is that I do not expect a unanimous vote.

While I think ICANN’s institutional instincts are to approve, the breadth and depth of the outrage over the deal may be difficult for some directors to ignore.

If it were only domain investors objecting, approval would be a slam dunk. But here we also have non-profits, civil liberties groups and governments crying foul.

Perhaps most importantly, there’s the objection of the California attorney generalobjection of the California attorney general to consider.

He has power over ICANN because it’s a non-profit registered in his state, and he’s said “will take whatever action necessary to protect Californians and the nonprofit community”.

His last letter to ICANN is believed to have caused the board to remove the .org deal from the agenda at its last meeting and seek a deadline extension from PIR.

One plausible interpretation of that chain of events is that the board was ready to give Ethos the nod, but the AG’s letter gave it pause.

ICANN meeting got “Zoombombed” with offensive material

Kevin Murphy, April 27, 2020, Domain Policy

An ICANN meeting held over the Zoom conferencing service got “Zoombombed” by trolls last month.

According to the organization, two trolls entered an ICANN 67 roundup session for Spanish and Portuguese speakers on March 27 and “shared inappropriate and offensive audio and one still image” with the legitimate participants.

The session was not password protected (rightly) but the room had (wrongly) not been configured to mute participants or disable screen-sharing, which enabled the offensive material to be shared.

The trolls were quickly kicked and the loopholes closed, ICANN said in its incident report.

ICANN appears to have purged the meeting entirely from its calendar and there does not appear to be an archive or recording, so I sadly can’t share with you the gist of the shared content.

Zoombombing has become an increasingly common prank recently, as the platform sees many more users due to the coronavirus-related lockdowns worldwide.

Coronavirus could cause “high risk of widespread outages”, ICANN says

Kevin Murphy, April 21, 2020, Domain Tech

There’s a “high risk of widespread outages” in the DNS if ICANN can’t get enough people in the same room for its next root DNSSEC ceremony because of the coronavirus pandemic.

That’s according to ICANN’s own board of directors, which yesterday published a contingency plan that — in the worst case scenario — could see parts of the internet come to a screeching halt in July.

The problem is with the elaborate “ceremonies” that ICANN and its IANA/PTI unit uses to make sure the internet can support DNSSEC — the secure version of the DNS protocol — all the way from the root servers down.

Every quarter, ICANN, Verisign and a select few “Trusted Community Representatives” from all over the world meet in person at one of two secure US-based facilities to generate the public Zone Signing Keys for the root.

In addition to the complex cryptographic stuff happening in the computers, there’s a shedload of physical security, such as retinal scans, PIN-based locks, and reinforced walls.

And the “secret key-holders”, memorably fictionalized in a US spy drama a few years ago, actually have physical keys that they must bring to these ceremonies.

The events are broadcast live and archived on YouTube, where they typically get anything from a few hundred to a few thousand views.

Obviously, with the key-holders dotted all over the globe and most under some form of coronavirus-related lockdown, getting a quorum into the same facility at the same time — originally, Culpeper, Virginia on April 23 — isn’t going to be possible.

So IANA has made the decision to instead move the ceremony to the facility in El Segundo, California, within easy driving distance of ICANN’s headquarters, and have it carried out almost entirely by ICANN staff, wrapped in personal protective equipment and keeping their distance from each other.

The TCRs for El Segundo live in Mauritius, Spain, Russia, Tanzania, Uruguay and on the east-coast of the US, according to ICANN.

Four of these key-holders have mailed their keys to different IANA staff “wrapped in opaque material” and sealed in “tamper-evident bags”. These IANA employees will stand in for the TCRs, who will be watching remotely to verify that nothing fishy is going on.

Verisign and the independent auditors will also be watching remotely.

That’s the current plan, anyway, and I’ve no reason to believe it won’t go ahead, but ICANN’s new contingency plans do provide four alternatives.

It’s already discarded the first two options, so if the current, third, plan for the ceremony can’t go ahead before June 19 for some reason, all that would be left is the nuclear option.

Option D: Suspend signing of the DNS root zone

This is the final option if there is no conceivable way to activate the KSK and perform signing operations. There would need to be a massive education campaign at short notice to have resolver operators disable DNSSEC validation. There is a high risk of widespread outages as it is not possible to ensure global implementation, and high risk this will fatally compromise trust in DNSSEC in general as a technology.

This is considered highly unlikely, but nonetheless the final option. Without exercising the option, in the absence of a successful key signing ceremony, DNSSEC validation would be unsuccessful starting in July 2020.

The reason for this scenario is that DNSSEC keys have a finite time-to-live and after that period expires they stop functioning, which means anyone validating DNSSEC on their network may well stop resolving the signed zones.

ICANN typically generates the keys one quarter in advance, so the current key expires at the start of July.

However, the planned April 23 ceremony will generate three quarters worth of keys in advance, so the root should be good until the end of March 2021, assuming everything goes according to plan.

Clearly, the idea that half the planet might be on the verge of lockdown wasn’t taken into consideration on February 12, the last ceremony, when ICANN’s biggest problem was that it couldn’t get into one of its safes.

If you’re interested in more about the ceremony and the coronavirus-related changes, info can be found here.

Free domains registrar gets FOURTH breach notice

Kevin Murphy, April 21, 2020, Domain Registrars

OpenTLD, the company that offers free and at-cost domain names under the Freenom brand, has received its fourth public breach of contract notice from ICANN.

The alleged violation concerns a specific expired domain — tensportslive.net — which was until its expiration last November hosting a Pakistani cricket blog.

ICANN claims OpenTLD failed to hand over copies of expiration notices it sent to the former registrant of the name, which expired November 12, despite repeated requests.

The blogger seems to have been royally screwed over by this situation.

ICANN first started badgering OpenTLD for its records on December 23, presumably alerting the company to the fact that its customer had a problem, when the domain had expired but was still recoverable.

ICANN contacted the registrar four more times about the domain before February 1, when it dropped and was promptly snapped up by DropCatch.com.

The public breach notice (pdf) was published February 27. OpenTLD has apparently since provided ICANN with data, which is being reviewed.

But it’s the fourth time the registrar has found itself in serious trouble with ICANN.

It got a breach notice in March 2015 after failing to file compliance paperwork.

Later that year, ICANN summarily suspended its accreditation — freezing its ability to sell domains — after the Dutch company was found to have been cybersquatting rival registrars including Key-Systems and NetEarth in order to poach business away from them.

That suspension was fought in an unprecedented arbitration case, but ICANN won and suspended the accreditation again that August.

It got another breach notice in 2017 for failing to investigate Whois accuracy complaints, which ICANN refers to in its current complaint.

OpenTLD/Freenom is perhaps best known as the registry for a handful of African ccTLD and Tokelau’s .tk, which is the second-largest TLD after .com by volume of registered domains.

Its business model is to give the names away for free and then monetize them after they expire or are deleted for abuse. In the gTLD space, it says it offers domains at the wholesale cost.

According to SpamHaus, over a third of .tk domains it sees are abusive.

Four more dot-brands join the gTLD deadpool

Kevin Murphy, April 21, 2020, Domain Registries

Four big-brand gTLDs have asked ICANN to terminate their contracts so far this year, bringing the total number of voluntarily discontinued strings to 73.

Notable among the terminations are two of the three remaining gTLDs being held by luxury goods maker Richemont, both of them Chinese-language generics.

It’s dumped .珠宝 (.xn--pbt977c) which is “.jewelry”, and .手表 (.xn--kpu716f) which is “.watches”.

The company, which applied for 14 gTLDs in the 2012 round, has already gotten rid of nine dot-brands. Only the English-language .watches remains of its former portfolio.

Also being terminated is .esurance, named for an American insurance provider owned by Allstate. This appears to be related to Allstate’s plan to discontinue the Esurance brand altogether this year.

There is still one .esurance domain active and listed in Google’s index: homeowners.esurance.

Allstate continues to own .allstate, which has a few active domains (which forward to its primary .com domain).

Finally, French reinsurance giant SCOR wants rid of .scor, which it has not been using.

As ICANN meets to decide .org’s fate, California AG says billion-dollar deal must be rejected

Kevin Murphy, April 16, 2020, Domain Policy

California Attorney General Xavier Becerra has urged ICANN to deny approval of Ethos Capital’s $1.13 billion acquisition of .org manager Public Interest Registry.

The call came in a letter (pdf) dated yesterday, just a day before ICANN’s board of directors was scheduled to meet to discuss the deal.

Becerra, who started looking into the deal in late January, wrote, right out of the gate:

I urge ICANN to reject the transfer of control over the .ORG registry to Ethos Capital. The proposed transfer raises serious concerns that cannot be overlooked.

Chief among his concerns is the fact that ICANN originally granted PIR the right to run .org largely because it was a non-profit with a committment to serve non-profits. He wrote:

If, as proposed, Ethos Capital is permitted to purchase PIR, it will no longer have the unique characteristics that ICANN valued at the time that it selected PIR as the nonprofit to be responsible for the .ORG registry. In effect, what is at stake is the transfer of the world’s second largest registry to a for-profit private equity firm that, by design, exists to profit from millions of nonprofit and non-commercial organizations

He’s also bothered about the lack of transparency about who Ethos is and what its plans are. The proposed new owners of PIR are hidden behind a complex hierarchy of dummy LLCs, and Ethos has so far refused to name its money men or to specify what additional services it might offer to boost its revenue.

Becerra also doesn’t buy the business plan, which would see PIR required to pay off a $300 million loan and, as a newly converted for-profit entity, start paying taxes.

He’s particularly scathing about the fact that ICANN approved the removal of PIR’s price caps last year despite receiving over 3,000 public comments opposing the changes and only half a dozen in favor.

“There is mounting concern that ICANN is no longer responsive to the needs of its stakeholders,” he writes.

Despite saying he “will take whatever action necessary to protect Californians and the nonprofit community”, Becerra does not specify what remedies are available to him.

But it looks like ICANN faces the risk of legal action no matter which way its board of directors votes (or voted) today.

Its current deadline to make a decision is April 20.

Whois privacy talks in Bizarro World as governments and trademark owners urge coronavirus delay

Kevin Murphy, April 15, 2020, Domain Policy

Coronavirus may have claimed another victim at ICANN — closure on talks designed to reopen private Whois data to the likes of law enforcement and trademark owners.

In a remarkable U-turn, the Governmental Advisory Committee, which has lit a series a fires under ICANN’s feet on this issue for over a year, late last week urged that the so-called Expedited Policy Development Process on Whois should not wrap up its work in June as currently planned.

This would mean that access to Whois data, rendered largely redacted worldwide since May 2018 due to the GDPR regulation in Europe, won’t be restored to those who want it as quickly as they’ve consistently said that they want it.

Surprisingly (or perhaps not), pro-access groups including the Intellectual Property Constituency and Business Constituency sided with the GAC’s request.

In an email to the EPDP working group’s mailing list on Thursday, GAC chair Manal Ismail indicated that governments simply don’t have the capacity to deal with the issue due to the coronavirus pandemic:

In light of the COVID-19 pandemic, and its drastic consequences on governments, organizations, private sector and individuals worldwide, I would like to express our serious concerns, as GAC leaders, that maintaining the current pace of work towards completion of Phase 2 by mid-June could jeopardize the delivery, efficacy and legitimacy of the EPDP’s policy recommendations.

While recognizing that the GAC has continually advised for swiftly completing policy development and implementing agreed policy on this critical public policy matter, we believe that given the current global health emergency, which puts many in the EPDP and the community under unprecedented stress (for example governments has been called to heightened duties for the continuity of essential public services), pressing important deliberations and decisions in such a short time frame on already strained participants would mean unacceptably sacrificing the product for the timeline.

We understand there are budget and human resources considerations involved in the completion of Phase 2 of the EPDP. However, we are all living through a global health pandemic, so we call on the EPDP Team to seriously reassess its course and expectations (be it on the duration of its calls, the turn-around time of reviews, its ultimate timeline and budget) emulating what numerous governments, global organizations, and households are doing to adapt during these challenging times across the world.

In April last year, before the EPDP group had even formally started its current phase of talks, Ismail wrote to ICANN to say the GAC expected the discussions to be more or less wrapped up by last November and that the new policy be implemented by this April.

Proponents of the access model such as Facebook have taken to suing registrars for not handing over Whois data in recent months, impressing the need for the issue to be urgently resolved.

So to now request a delay beyond June is a pretty big U-turn.

While Ismail later retracted her request for delay last Thursday, it was nevertheless discussed by the working group that same day, where the IPC, the BC and the ALAC all expressed support for the GAC’s position.

The registrars and registries, the non-commercial users and the ISPs were not supportive.

Delay might be tricky. For starters, hard-sought neutral working group chair Janis Karklins, has said he can’t continue working on the project beyond June 30, and the group has not secured ICANN funding for any further extensions to its work.

It will be up to the GNSO Council to decide whether to grant the extension, and the ICANN board to decide on funding.

The working group decided on Thursday to ask the Council for guidance on how to proceed.

What’s worrying about the request, or at least the IPC and BC’s support of it, is that coronavirus may just be being deployed as an excuse to extend talks because the IP owners don’t like the proposal currently on the table.

“The reality is we’re looking at a result that is… just not going to be sufficient from our perspective,” MPAA lawyer Frank Journoud, an IPC rep on the working group, said on its Thursday call. “We don’t want the perfect to be the enemy of the good, but right now we’re not even going to get to good.”

The current state of play with the working group is that it published its initial report (pdf) for public comment in February.

The group is recommending something called SSAD, for Standardized System for Access and Disclosure, in which a central gateway provider, possibly ICANN itself, would be responsible for granting Whois access credentials and fielding requests to the relevant registries and registries.

The almost 70 comments submitted before the March 23 deadline have been published in an unreadable, eye-fucking Google spreadsheet upon which transparency-loving ICANN may as well have hung a “Beware of the Leopard” sign. The staff summary of the comments is currently nine days late.

Kuala Lumpur meeting cancelled and ICANN 68 could be even trickier online

Kevin Murphy, April 9, 2020, Domain Policy

ICANN has as expected cancelled its in-person ICANN 68 meeting, which had been due to take place in Kuala Lumpur in June, due to the coronavirus pandemic.

The decision, which was never really in any doubt, was taken by its board of directors yesterday. The board considered:

Globally, a high number of people are under some form of a “stay at home” or lock-down order, directed to avoid contact with others except to receive essential services such as medical care or to purchase supplies. Schools and offices are closed, gatherings are prohibited, and international travel is largely on pause. We do not know when travel or in-person meetings will be authorized or possible. As it relates to Kuala Lumpur, Malaysia has a Movement Control Order in force at least until 14 April 2020 that prohibits meetings such as ICANN68. The duration of the Movement Control Order has already been extended once.

It appears that the four-day meeting, which will instead go ahead virtually (presumably on the Zoom conferencing service) might be even more disjointed than ICANN 67.

ICANN 67, which took place online in March, did have a centralized component — a bunch of ICANN staffers on location at its headquarters in Los Angeles — but that may not be possible this time around.

The board said that “due to current social distancing requirements, ICANN org is unable to execute a virtual meeting from a single location, and that a decentralized execution model might necessitate changes to the format.”

It added that there is support for “a flexible, modified virtual meeting format that focuses on cross-community dialogues on key policy topics, supplemented by a program of topical webinars and regular online working meetings scheduled around the key sessions.”

While there has been a lot of criticism of the Zoom platform in recent weeks due to security and privacy concerns, ICANN indicated this week that it’s not particularly concerned and will carry on using the service.

No ICANN tax relief for Chinese registrars

ICANN has declined a request from dozens Chinese registrars for a fee waiver due to the impact of coronavirus.

In February, almost 50 China-based accredited registries and registrars said they were suffering financially as a result of the outbreak and asked ICANN for an “immediate fee waiver” to “greatly help stabilize our business in the difficult time”.

ICANN has denied this request. In a letter (pdf), senior director of gTLD accounts and services Russ Weinstein wrote:

While we sympathize with the potential financial impact this unprecedented event may have on contracted parties, we are not prepared to provide a waiver at this time. We are closely monitoring the situation and its impact on the domain industry. We are interested in hearing more from representatives from the contracted parties to better understand the problems both the contracted parties and the registrants are facing and ideas for potential solutions.

As I said back in February, what was then largely a Chinese problem looked likely to quickly become a global problem, which unfortunately seems to be the course we’re on. Just six weeks later, China isn’t even the worst-affected country any more.

Even without fee waivers, ICANN has noted that it expects a “significant” impact on it is 2020-21 budget due to the pandemic.

ICANN declares coronavirus a “natural disaster” to protect expired domains

Registrants unable to renew their domain names when they expire may not lose them, following a decree from ICANN today.

The organization has declared the coronavirus a “natural disaster” and invoked part of the Registrar Accreditation Agreement that permits registrars to keep hold of domains that have come to the end of their post-expiration renewal period.

Under the RAA, registrars have to delete domains a maximum of 45 days after the reg period expires, unless there are “extenuating circumstances” such as an ongoing UDRP case, lawsuit or technical stability dangers.

There’s no accounting for natural disasters in the contract, but ICANN has the discretion to name any “other circumstance as approved specifically by ICANN” an extenuating circumstance. That’s what it’s done here.

It’s invoked this provision once before, following Hurricane Maria in late 2017.

ICANN said that policies to specifically protect domains in the event of natural disasters should be considered.

The new coronavirus exception applies to all registrars in all gTLDs, although implementation will vary by registrar.

The announcement follows Verisign’s announcement last week that it is waiving its registry-level restore fee for .com and .net domains until June 1.