Latest news of the domain name industry

Recent Posts

ICANN security advisor predicts “hundreds” of new gTLDs will “go dark”

Kevin Murphy, December 4, 2015, Domain Registries

A security company led by a member of ICANN’s top security committee reckons that “hundreds” of new gTLDs are set to fail, leading to web sites “going dark”.

Internet Identity, which provides threat data services, made the prediction in a press release this week.

IID’s CTO, quoted in the release, is Rod Rasmussen. He’s a leading member of the Anti-Phishing Working Group, as well as a member of ICANN’s influential Security and Stability Advisory Committee.

He has a dim view of new gTLDs:

Most new gTLDs have failed to take off and many have already been riddled with so many fraudulent and junk registrations that they are being blocked wholesale. This will eventually cause ripple effects on the entire domain registration ecosystem, including consolidation and mass consumer confusion as unprofitable TLDs are dropped by their sponsoring registries.

The press release acknowledges that ICANN has an Emergency Back-End Registry Operator (EBERO) program, which will keep failing gTLDs alive for up to three years after the original registry operator goes out of business.

But it continues:

questions abound as to who would risk an investment in poorly performing TLDs, especially as they start to number in the hundreds. “That’s why eventually some are going to just plain go dark,” added Rasmussen.

The prediction is for “2017 and beyond”. Given the existence of the EBERO, we’re probably looking at 2020 before IID’s claim can be tested.

It’s a bit of a strange prediction to come out of a security company.

The whole point of EBERO is to make sure domain names do not go dark, giving either the registry the chance to sell on the gTLD or the registrants a three-year heads-up that they need to migrate to a different TLD.

It would be a bit like being told that there’s a horrible bit of malware that is set to brick your computer, but that you’ll be fine if you change your anti-virus provider in the next three years.

I could live with that kind of security threat, personally.

But what are the chances of hundreds of live, non-dot-brand going fully post-EBERO dead in the next few years?

I’d say evidence to date shows the risk may be over-stated. It may happen to a small number of TLDs, but to “hundreds”?

We’ve already seen new gTLD registries essentially fail, and they’ve been taken over by others even when they’re by definition not profitable.

Notably, .hiv — which has a contractual agreement with ICANN to not turn a profit — failed and was nevertheless acquired by Uniregistry.

We also see registries including Afilias and Donuts actively searching for failing gTLDs to acquire.

It’s official: new gTLDs didn’t kill anyone

Kevin Murphy, December 2, 2015, Domain Tech

The introduction of new gTLDs posed no risk to human life.

That’s the conclusion of JAS Advisors, the consulting company that has been working with ICANN on the issue of DNS name collisions.

It is final report “Mitigating the Risk of DNS Namespace Collisions”, published last night, JAS described the response to the “controlled interruption” mechanism it designed as “annoyed but understanding and generally positive”.

New text added since the July first draft says: “ICANN has received fewer than 30 reports of disruptive collisions since the first delegation in October of 2013. None of these reports have reached the threshold of presenting a danger to human life.”

That’s a reference to Verisign’s June 2013 claim that name collisions could disrupt “life-supporting” systems such as those used by emergency response services.

Names collisions, you will recall, are scenarios in which a newly delegated TLD matches a string that it is already used widely on internal networks.

Such scenarios could (and have) led to problems such as system failure and DNS queries leaking on to the internet.

The applied-for gTLDs .corp and .home have been effectively banned, due to the vast numbers of organizations already using them.

All other gTLDs were obliged, following JAS recommendations, to redirect all non-existent domains to, an IP address chosen to put network administrators in mind of port 53, which is used by the DNS protocol.

As we reported a little over a year ago, many administrators responded swearily to some of the first collisions.

JAS says in its final report:

Over the past year, JAS has monitored technical support/discussion fora in search of posts related to controlled interruption and DNS namespace collisions. As expected, controlled interruption caused some instances of limited operational issues as collision circumstances were encountered with new gTLD delegations. While some system administrators expressed frustration at the difficulties, overall it appears that controlled interruption in many cases is having the hoped-for outcome. Additionally, in private communication with a number of firms impacted by controlled interruption, JAS would characterize the overall response as “annoyed but understanding and generally positive” – some even expressed appreciation as issues unknown to them were brought to their attention.

There are a number of other substantial additions to the report, largely focusing on types of use cases JAS believes are responsible for most name collision traffic.

Oftentimes, such as the random 10-character domains Google’s Chrome browser uses for configuration purposes, the collision has no ill effect. In other cases, the local system administrators were forced to remedy their software to avoid the collision.

The report also reveals that the domain name, which is owned by long-time ICANN volunteer Mikey O’Connor, receives a “staggering” 30 DNS queries every second.

That works out to almost a billion (946,728,000) queries per year, coming when a misconfigured system or inexperienced user attempts to visit a .corp domain name.

Verisign v XYZ judge confirms both companies suck

Kevin Murphy, November 21, 2015, Domain Registries

Verisign and have both come out of a US lawsuit looking like scumbags.

Explaining his dismissal of Verisign’s false advertising lawsuit against .xyz registry, Virginia judge Claude Hilton today said that’s statements about its registration numbers were “verifiably true”.

At the same time, he confirmed that they came about as a result of a bullshit deal with Network Solutions to bolster .xyz’s launch numbers.

The judge’s ruling confirms for the first time the financial details of the deal between XYZ and (Network Solutions) that saw .xyz’s registration volume rocket in its first few weeks of general availability. He wrote: purchased 375,000 domain names for a price of $8 each totaling $3 million dollars. In exchange, XYZ purchased advertising from in the form of 1,000 impressions for $10 each, at a total cost of $3 million dollars. Instead of cash exchanging hands, advertising credit was given to XYZ and the .xyz domain names were given to, who subsequently gave them away as free trials to their subscribers.

In other words, XYZ bought $10,000 of advertising for $3 million and paid for it with $3 million of free .xyz domains — 375,000 of them.

That bogus deal enabled XYZ to report big reg volume numbers without actually, legally, lying,

“The statements regarding Defendants’ revenue and number of registrations are statements of fact that are verifiably true,” the judge wrote.

When the Defendants [] stated they were a market leader in new TLD’s and that they had the most new registrations than any other TLD, they were basing that information off of an accurate zone file. Further, the zone file confirms that there are over 120 million .com registrations and one {1) million .xyz registrations. These statements are also true.

The judge said he was dismissing the suit not just because XYZ wasn’t lying, but also because Verisign couldn’t show that it had been harmed.

The number of .com registrations has actually been going up, he noted.

Much of Verisign’s complaint centered on this ad:

Verisign said the ad lied about the availability of .com domains, which XYZ denied.

The judge said:

The video posted to YouTube is puffery and opinion. It displays no actual domain names, and communicates a subjective measure of value and superiority, not capable of being proven false.

“Puffery” is a term with legal weight in false advertising cases under US law. It basically means that advertisers are allowed to exaggerate. XYZ had in fact used the “puffery” defense.

The judge seems to have relied heavily on zone file analysis to reach his conclusions. He wrote.

according to Plaintiff’s [Verisign’s] own data, .com names are largely unavailable. In a given month, Plaintiff reports that it receives about two (2) billion requests to register <.com> domain names, yet fewer than three (3) million are actually registered.

I believe that “two billion” number refers to how many “attempted adds” Verisign gets every month for .com domains, as reported in its monthly reports with ICANN.

That number would include every automated attempt to register a dropping domain by every registrar.

It’s not a reflection of how many actual human beings attempt and fail to register .com domains and, in my view, it’s worrying that the judge took it to mean that.

In summary, the lawsuit managed to unearth the dirty reality behind XYZ’s launch “success”, whilst also making Verisign look like a petty, petulant, child.

Everybody loses.

Except the lawyers, obviously, who have been paid millions.

ICANN reveals 12 more data breaches

Kevin Murphy, November 20, 2015, Domain Registries

Twelve more new gTLD applicants have been found to have exploited a glitch in ICANN’s new gTLD portal to view fellow applicants’ data.

ICANN said last night that it has determined that all 12 access incidents were “inadvertent” and did not disclose personally identifiable information.

The revelation follows an investigation that started in April this year.

ICANN said in a statement:

in addition to the previous disclosures, 12 user credentials were used to access contact information from eight registry operators. Based on the information collected during the investigation it appears that contact information for registry operators was accessed inadvertently. ICANN also concluded that the exposed registry contact information does not appear to contain sensitive personally identifiable information. Each of the affected parties has been notified of the data exposure.

The glitch in question was a misconfiguration of a portal used by gTLD applicants to file and view their documents.

It was possible to use the portal’s search function to view attachments belonging to other applicants, including competing applicants for the same string.

Donuts said in June that the prices it was willing to pay at auction for gTLD string could have been inferred from the compromised data.

ICANN told compromised users in May that the only incidents of non-accidental data access could be traced to the account of Dirk Krischenowski, CEO of dotBerlin.

Krischenowski has denied any wrongdoing.

ICANN said last night that its investigation is now over.

English beats Portuguese in $2.2m .hotels auction

Kevin Murphy, November 19, 2015, Domain Registries has won the right to operate .hotels after an auction concluded a protracted fight over the gTLD.

In an ICANN-run auction yesterday, prevailed with a winning bid of $2.2 million.

Its sole competitors was Travel Reservations (formerly Despegar Online), which had applied for the Portuguese word .hoteis.

In 2012, a String Similarity Review panel concluded that .hotels and .hoteis look too similar to coexist, due to the likelihood of confusion between I and l in sans-serif fonts.

Neither applicant agreed with that decision, knowing that it would result in a expensive auction, and filed a Request for Reconsideration and then, in March 2013, an Independent Review Process complaint.

After two years, it lost the IRP. But the panel said it had “legitimate concerns” about the fairness of the SSR process and ordered ICANN to pay half of its costs.

Now, has had to fork out another $2.2 million for the string.

That’s not particularly expensive as ICANN-auctioned gTLDs go. Eight of the 13 other strings ICANN has auctioned have sold for more.

ICANN’s auction proceeds to date now stands at $63,489,127, which is being held in a separate bank account for purposes yet to be determined.