Another DNSSEC screw-up takes down thousands of .au domains

Australia’s ccTLD has become the latest to see a widespread outage that appears to be the result of a DNSSEC misconfiguration.

A reported 15,000 .au domains were affected, though some suspect it could have been more.

Registry overseer auDA said on Twitter that .au “experienced an error” that affected a “small number of domains” and that an investigation was underway.

Earlier today the .au domain experienced an error. We regret that a small number of domains were affected but are pleased to report the .au is back up and operating. An investigation as to the cause of this issue is underway.

— auDA (@auda) March 22, 2022

Donuts subsidiary Afilias, which runs the back-end for .au’s more that 3.4 million domains, has yet to publicly comment.

Network operators and DNS experts took to social media and mailing lists to observe that .au’s DNSSEC was broken, though it appears the problem was fixed rather quickly.

(For those following along from home, .AU DNSSEC key management was broken from 05:48 – 06:18 UTC. Quick repair by AuDA.)https://t.co/jmHAbZdWKo https://t.co/SzOi9U7Kwi

— Bill Woodcock (@woodyatpch) March 22, 2022

DNSSEC creates a chain of cryptographic keys all the way to the DNS root, and when that chain is broken by a misconfiguration such as a missing key, most DNSSEC-enabled resolvers treat the affected domains as if they simply don’t exist.

That means services such as web sites and email addresses stop working until the chain is reestablished. People not using DNSSEC resolvers wouldn’t have seen a problem.

It’s the third TLD to experience a significant outage due to DNSSEC in the last six weeks.

In February, thousands of domains in Sweden’s .se went dark for hours, and Fiji’s entire .fj zone disappeared for DNSSEC users less than two weeks ago.

The outage comes at a particularly unfortunate time in terms of public relations for auDA, which on Thursday will start making direct second-level .au registrations available for the first time.

It’s not immediately clear whether the DNSSEC fluff is related to the SLD launch.

XYZ bought most of Uniregistry’s TLDs

XYZ.com has emerged as the winning bidder for 10 of the 17 new gTLDs that UNR, formerly Uniregistry, auctioned off last year.

The company bought .audio, .christmas, .diet, .flowers, .game, .guitars, .hosting, .lol, .mom and .pics, according to ICANN, which approved the transfer of each registry agreement today.

As previously reported, a new company called Dot Hip Hop bought .hiphop, albeit not at auction.

The contract reassignments come almost a year after the auction took place, and were delayed after ICANN got nervous about the fact that UNR had apparently sold matching Ethereum Name Service blockchain domains at the same time.

“This raised concerns because ICANN org was being asked to approve transactions that included not only the transfer of gTLD operations set out in the relevant registry agreements, but also included references and/or implications of the transfer of ownership rights in the gTLDs,” ICANN veep Russ Weinstein wrote today.

“To be clear, the registry agreements do not grant any property ownership rights in the gTLD or the letters, words, symbols, or other characters making up the gTLD string,” he added.

Six more UNR gTLD contracts remain in the approval process, but ICANN blamed this on the timing of when the assignment requests were submitted.

The UNR auction last April raised over $40 million, according to UNR.

What to make of this strange trend in new domain regs?

Are people getting the shortest domain possible when they register in a new gTLD?

Every month uber-registry Donuts publishes data about its portfolio, such as which gTLDs are most popular, in which region, what its most popular premium names are, and what keywords are most commonly registered at the second-level.

For the past few months, I’ve noticed what may be considered an unusual trend — many of the most popular SLD keywords are already gTLDs in their own right, suggesting registrants may not be getting their optimal domain.

The top 10 second-level keywords in February were: today, meta, letter, first, digital, verse, online, club, life, and home.

Put a dot in front of them, and five are also gTLDs — .today, .digital, .online, .club, and .life — some of which Donuts actually manages. One of them, .home, has multiple outstanding applications but has been essentially banned by ICANN due to high levels of name collision.

It’s even more noticeable in January’s numbers, with seven gTLD matches — online, life, digital, free, green, shop, world — in the top 10 SLD keywords.

In December there are six — today, group, online, digital, world and life. In November, four — online, digital, life, group. In October, six — digital, online, life, tech, shop, group.

It shouldn’t be hugely surprising that there’s a crossover between gTLD strings and popular SLD strings — one of the ways Donuts and others picked their gTLDs was by scouring the .com zone file for the most-common SLD endings.

The idea was that if Peter owned, or was thinking of registering, peterspickledpeppersonline.com, he might reasonably want to upgrade to the shorter peterspickledpeppers.online.

Donuts consistently says that the domains it sells are 20% shorter than domains registered in .com over the comparable period.

But its data suggests that this they’re not always getting their optimal domain. People are registering in new gTLDs, but they’re often not using the gTLD that would make their overall domain shorter.

I wonder why this is.

Cost could certainly be a factor. There’s not a massive amount of difference between a .online and a .live, and both are typically more expensive than .com, but it might be an issue for registrants on tight budgets.

It seems more likely that a lack of awareness among registrants may be the main issue — they don’t know the full breadth of options available to them (hell, even I don’t, and this is my job).

Registrars’ name spinners aren’t always helpful raising this awareness.

I typed the string “peterspickledpeppersonline” into the storefronts of seven popular registrars, all of which carry new gTLDs, and found that two of them didn’t offer peterspickledpeppers.online among their suggestions at all.

On some, the domain was way down the list, after far less-relevant suggestions, even though it is shorter and carries a higher price.

EURid appoints new CEO

EURid has named its new CEO, or general manager, as Peter Janssen.

Janssen is currently technical manager at the registry, where he’s been since .eu went live over 15 years ago.

He’ll replace longstanding boss Marc Van Wesemael, who’s retiring.

Janssen previously worked for DNS Belgium, also as technical manager.

Nominet cuts off Russian registrars

Russian registrars will no longer be able to sell .uk domains, due to the war in Ukraine, Nominet announced today.

“We are not accepting registrations from registrars in Russia — we are suspending the relevant tags,” the registry said.

A “tag” is the unique identifier Nominet issues to its registrars to enable them to access the .uk registry.

I believe it’s the first example of a national domain registry taking action against Russian companies in response to the invasion of Ukraine.

While Nominet is independent, it’s pretty tight with the UK government, which with international partners has implemented some quite tough economic sanctions against Russia.

Nominet said that the “very small” number of existing domains with Russian addresses “will continue to operate as normal”.

Other measures the company announced include a £200,000 donation to the war relief effort, a reduction of its roughly £100,000 of investments in Russian companies to about £1,000, and the monitoring of new .uk registrations for possible Ukraine-related scams.

Other domain companies to announce what effectively amount to sanctions against Russia include Namecheap, Sedo, IONOS, GoDaddy and CENTR.

ICANN has also offered money to Ukraine and concessions to Ukrainian registrants, though the latter may also apply to Russians.

As Russia advances on Kyiv, .ua moves out-of-country

Ukraine’s ccTLD registry has moved its servers out of the country to avoid disruption due to the Russian invasion.

Hostmaster said that servers responsible for “the operability of the .ua domain” have been moved to other European countries, seemingly with the assistance of other registry operators.

The company’s technical operations were based in Kyiv, which is currently under threat from advancing Russian troops.

Hostmaster announced the news on Saturday, the third day of the invasion.

A day earlier, it said it had signed up to Cloudflare’s DDoS protection service to protect its two largest zones — .com.ua and .kiev.ua — from distributed denial of service attacks.

It had suffered one such attack earlier this month, before the invasion, with traffic at some points exceeding 150Gbps.

The company says it runs more than 550,000 .ua domains in total. This morning, all .ua web sites I tested from the UK were resolving normally.

GoDaddy among five companies competing for .za contract

Five companies are bidding for the contract to run the back-end for South Africa’s .za domains, which is expected to be awarded shortly.

Local ccTLD overseer ZADNA has named ZA Registry Consortium (ZARC), Lexreg and Fevertree Consulting Consortium, GoDaddy Registry, The Bean App & GMO Internet Group, and Catalytic Peter capital Consortium as respondents to its 2021 RFP.

Of those, only GoDaddy is a lone bidder, and the only one without an obvious South African partner. The rest are consortia, apparently newly created to bid for the contract.

ZARC is a venture of incumbent back-end ZA Central Registry and its affiliated commercial arm Domain Name Services, according to ZACR.

Lexreg and Fevertree Consulting Consortium appears to be made up of local corporate registrar Lexsynergy and a South African consulting firm.

The Bean App is a South African startup registrar. Its partner GMO is the Japanese registry provider behind .shop and a bunch of geographic and dot-brand gTLDs.

I’m sorry to say I have no idea what “Catalytic Peter” is. It has no internet footprint and ZADNA has not revealed any information beyond the name.

ZADNA said it is “currently at the advanced stage of the final checkpoints of the procurement process.”

.za has over 1.3 million domains and over 600 registrars. While ZACR currently runs four additional African geographic gTLDs, .za is by far its biggest deal in terms of registrations.

GoDaddy Registry to raise some TLD prices, lower others

GoDaddy Registry is to raise the base price of three of its recent acquired gTLDs and lower the price on three others.

The company is telling registrars that the prices of .biz, .club and .design domains are going up later this year, while the prices of .luxe, .abogado and .case are going down.

For .biz, which GoDaddy took over when it acquired Neustar’s registry business in 2020, the price will increase by $0.87 to $13.50.

While .biz hasn’t been price-regulated by ICANN since 2019, the new rise is lower than the annual 10% it was allowed to impose under its previous, price-capped contracts. It’s around 7% this year, roughly in line with .com’s capped increase. It will mean the price of a .biz has gone up by over 70% in the last decade.

For .club, which GoDaddy acquired last year, registrations, renewals and transfers are going up by a dollar to $10.95, the fourth consecutive year in which .club fees have increased.

It’s in the ball-park of what previous owner .CLUB Domains was already doing — .club launched in 2014 with a $8.05 fee, but that went up to $8.95 in 2019, then $9.45 in 2020, then $9.95 last year.

.club has about a million domains under management at the moment. If that level holds, it’s an extra million bucks a year to GoDaddy, which frankly will barely register on the company’s now billion-dollars-a-quarter income statement.

For lower-volume .design, another one of the 2021 acquisitions, the price is going up by $2 to $35.

All of these price changes go into effect September 1 this year, giving registrants over six months to lock-in their pricing for up to 10 years by committing to a multi-year renewal before the changes kick in.

Registrars in most cases pass on registry price increases to their customers, but they don’t have the same six-month notification obligations as registries.

For three other GoDaddy Registry TLDs, prices are coming down in the same timeframe, so registrants may wish to see if the savings are passed on in future by registrars.

.luxe prices are going down from $15 a year to $12, .abogado is going down from $25 to $20 and .casa is going down from $7.50 to $6. The latter two mean “lawyer” and “home” respectively in Spanish.

GoDaddy isn’t currently altering the regular price of the TLDs it acquired from MMX, but it is bumping the restore fee for expired domains by $10 to $40, bringing them into line with .com.

Supreme Court allows fight for .nu to proceed

A lawsuit fighting for control of the .nu ccTLD can go ahead, the Supreme Court of Sweden has ruled.

The court confirmed last week that the Government of Niue has standing to sue, despite a lower court ruling in favor of .nu registry IIS’s claims to the contrary two years ago.

The ruling means the case will go to trial, according to Niue representative Pär Brumark.

IIS is the ccTLD registry for Sweden’s .se, but it also took over Niue’s .nu, which coincidentally means “.now” in Swedish, from its original American manager in 2013.

Niue has been fighting for .nu to be returned to its control for over two decades. The ccTLD has proven popular with Swedish speakers, and has about 250,000 current registrations, making about $5 million a year.

That’s a lot of money for a tiny island nation like Niue, which has never seen any cash from .nu sales.

Niue sued in 2018 and defied convention by publicizing its IANA redelegation request in 2021.

Niue’s case was dismissed by a lower court in 2020 after the judge ruled the government lacked ability to sue in Swedish jurisdiction. That decision was overruled (pdf) last year by a Court of Appeals.

IIS appealed to the Supreme Court, which last week declined (pdf) to hear the case, upholding the appeals court ruling. There’s no further avenue of appeal.

The case now goes back to the court of first instance for a trial. A date has not been set.

Liberties group appeals NIXI’s “two domains rule” brush-off

The Internet Freedom Foundations, an Indian online rights group, says it is continuing to try to find out why local registry NIXI has implemented a highly weird “two domains” rule.

The rule, which appeared in late December, requires registrars to ask the personal permission of NIXI’s CEO if a registrant wants to register more than two .in domains.

As NIXI acts under the authority of the Indian government, IFF filed a request last month under the country’s Right To Information Act, asking under what authority the rule was imposed and how NIXI reached its decision to impose it.

The terse reply (pdf) simply refers the reader to a clause of the registry-registrar agreement stating that NIXI can roll out new rules at will.

Its February 10 response adds: “Above decision is taken with respect to National Security.”

That’s exactly what NIXI CEO Anil Kumar Jain told DI a month earlier.

Because three or four of IFF’s questions went unanswered, the group says it has appealed the response and requested more transparency.

“Repeating ‘national security’ as a mantra to defeat transparency, even when not probably emerging from the topic of policy formation, is a growing tendency in decision making,” IFF said.