.club — the whole TLD just went down

GoDaddy Registry’s .club gTLD appears to have been down for the last few hours.

At time of writing, no .club domain names are resolving, instead returning NXDOMAIN errors to browsers, and the registry is reportedly working on fixing whatever ails it.

The .club registry accounts for over a million domains, so the problem is affecting a lot of people.

At 1107 UTC, the registrar Namecheap wrote that “the DNS information cannot be queried for the domains”, updating half an hour later to say the registry is “working to resolve the issue within the nearest time possible.”

Cloudflare, also alerted by its customers, said on Twitter that it had “identified the name resolution problem on upstream Registry.”

Tucows confirmed that the problem is preventing customers from registering or managing their .club domains.

It appears to be a DNS issue. The gTLD’s name servers, which are all found at get.club, are not currently responding. All six official names servers use the same IPv4 and IPv6 addresses.

It appears that .hsbc, the dot-brand for the global bank HSBC, is suffering identical problems. It also runs on the GoDaddy back-end. Other gTLDs on the same infrastructure I checked appear to be working normally.

This is highly unusual. Entire TLDs do not typically just drop off the internet like this.

Like all gTLDs, .club has a DNS availability service level agreement of 100% uptime baked into its ICANN Registry Agreement, which it clearly has failed to meet this month.

The .club gTLD was acquired by GoDaddy from .CLUB Domains earlier this year, raising the possibility of some kind of handover-related problem. However, .club was already running on the old Neustar back-end, which GoDaddy acquired last year.

UPDATE: As of 1325 UTC, domains in .club and .hsbc appear to be resolving again (at least from where I’m sitting in the UK) after at least two and a half hours of downtime.

After the incident was resolved, the registry tweeted:

This morning there was a DNS service disruption impacting .Club websites. The issue has now been resolved. We apologize for any inconvenience this may have caused.

— .CLUB Domains (@getDotClub) October 7, 2021

GoDaddy Registry tweeted:

This morning there was a DNS service disruption impacting .club websites. The issue has now been resolved. We apologize for any inconvenience this may have caused.

— GoDaddy Registry (@GoDaddyRegistry) October 7, 2021

UltraDNS, the massively redundant DNS resolution service still owned by Neustar, identified the problem starting at 1030 UTC and being fixed by 1415 UTC. It did not specify what caused it, and suggested (contrary to the experience of some internet users) that it was restricted to Asia and Europe.

I’ve reached out for comment, and will update as we discover more…

Donuts’ DropZone approved despite competition fears

ICANN has approved Donuts’ proposed drop-catching service, DropZone, despite concerns it could add cost to the dropping domains market.

The Org and Donuts subsidiaries representing over 200 gTLDs signed amendments September 29 that incorporate DropZone into their Registry Agreements, according to ICANN records.

The full new text in the amendments, which does a pretty good job of describing the service, is:

Dropzone Service

Registry Operator may offer the Dropzone service, which is a Registry Service that will manage the release of domain names that have reached the end of their life cycle.

The Dropzone is a separate system, parallel to the main EPP system, that will manage on a daily basis the release of domain names that have been purged for a short period of time, called the Dropzone. Any TLD-accredited registrars may use the Dropzone to register a recently-purged domain name.

On a daily basis, at the end of the Dropzone period, the Registry will execute an awarding process, which will select, per domain name, the first domain creation request submitted (first come, first serve).

What the amendment doesn’t mention are fees. The original Donuts Registry Service Evaluation Request stated in August:

In addition to the standard or premium registration prices of a given domain name, The Dropzone service can support additional application fees to be configured on a per TLD basis. Applications fees where applicable will be charged in addition to the standard registration price of a domain name.

This caused concern at TurnCommerce, the company that runs the DropCatch.com network of registrars, which told ICANN last month that DropZone was anti-competitive and could raise the price of dropping domains.

But ICANN responded that DropZone passed its competition sniff test, and would not be referred to government authorities.

Donuts has not yet publicly announced plans to launch DropZone.

A virtually identical service, that did not mention added fees in its RSEP, was previous approved for Afilias, the registry operator Donuts acquired at the start of the year.

PIR poaches new CTO from Verisign

Public Interest Registry has announced the hiring of Rick Wilhelm as its new chief technology officer.

Wilhelm comes from Verisign, where he was VP of platform management. He’s also previously worked for Network Solutions and Neustar and sat on ICANN’s Security and Stability Advisory Committee.

He replaces Joe Abley, who quit for a job at Neustar in August.

Wilhelm started today, and reports to CEO Jon Nevett.

James Bond domains listed for sale by .bond registry

ShortDot has made James Bond related domain names in the gTLD .bond available for sale or lease, as the movie franchise’s latest outing smashes box office records.

Both james.bond and 007.bond are currently listed for sale for $25,000 each at Dan.com, with a lease-to-own option of $2,084 a month. The .bond registry is listed as the seller. They will renew at the standard rate.

The offers were announced shortly before the weekend opening of No Time To Die made a reported $120 million internationally in cinema ticket sales, beating pandemic-related box office records.

Both “James Bond” and “007” are trademarks of movie producer EON Productions, so it seems buyers might be assuming some UDRP risk. I asked ShortDot about this last week but did not receive a response.

In a press release, the company made hay about the fact that that “James” is a super-common given name and “007” is a three-digit numeric, which are both sought-after categories of domains.

These are the kinds of assertions you’d expect in a UDRP defense.

.bond was originally a dot-brand for Bond University in Australia, but it was sold to ShortDot in 2019 after laying dormant for years.

Regular .bond domains retail for about $70 a year. There are over 4,000 currently registered.

Afnic gets renewed for .fr

Incumbent .fr registry Afnic has been reinstated for another five years by the French government.

The company said its contract has been re-upped for a further period starting July 1 next year, following an open call for rival bidders that opened in May.

Between now and then, the precise terms of the deal will be worked out. The government appears to want improved security and accountability at the ccTLD.

Afnic has been running .fr, which has been estimated as a €76 million contract, since 1997.

.fr has about 3.8 million domains under management, making it a the eighth-largest ccTLD by volume.

Tucows buys UNR’s registry business as Schilling bows out

Tucows has acquired UNR’s registry business, the latest in the piecemeal sale of the old Uniregistry by founder Frank Schilling.

The Canadian registrar said it is taking on the technology platform as well as 10 UNR staffers.

Not many details of the deal, not even the purchase price, have been revealed.

“While I am slowly getting out of the industry, it’s important to me to know that my businesses are being left in the best hands,” Schilling said in a brief Tucows press release.

The deal gives Tucows a registry component to match rival GoDaddy, which acquired Neustar’s registry business last year, and makes the company the latest to throw itself into the vertically integrated domain space.

GoDaddy acquired Uniregistry’s registrar business last year also.

The UNR registry was originally Internet Systems Consortium’s but was acquired by UNR towards the beginning of the current new gTLD cycle.

It’s not currently clear which TLDs, if any, continue to run on the UNR platform. The company auctioned off 20 gTLDs in May, making $40 million, but did not disclose the buyers and none of the ICANN contracts have yet changed hands.

Certain ICANN approvals are needed before the deal closes, Tucows said.

Neither company answered DI’s questions about which TLDs are making the move, but Tucows VP Dave Woroch told us:

We are purchasing their registry platform and technology/intellectual property. In addition to servicing a number of registry operators, this platform will be applicable or beneficial to our broader registrar business, and we are looking at how we can implement some of that technology into our registrar platform. Along with this purchase of the registry platform, we have the unique opportunity to bring on a very experienced team of software engineers with specific expertise, and that will benefit our domain business at a time when it has been particularly challenging to add talent…

Tucows will be actively marketing itself as a backend registry provider, both for gTLDs and ccTLDs, and if there is another round of new gTLDs, we would fully expect to participate there as well.

Neustar exec fingered in Trump’s Russian “collusion” probe

A senior former Neustar executive has been outed as a participant in 2016 research that sought to establish nefarious links between then US presidential candidate Donald Trump and the Russian government.

According to a US federal indictment last month, former Neustar senior VP and head of security Rodney Joffe and others used DNS query data collected by the company to help create a “narrative” that Trump’s people had been covertly communicating with Kremlin-connected Alfa Bank.

The indictment claims that they did so despite privately expressing skepticism that the data was conclusive in establishing such ties.

Joffe did this work while under the impression he would be offered a top cybersecurity job in Hilary Clinton’s administration, had she won the 2016 general election, the indictment claims.

Joffe has not been accused of any illegality or wrongdoing — he’s not even named in the indictment — and his lawyer has told the New York Times that the indictment gives an “incomplete and misleading” version of events.

The indictment was returned by a federal grand jury on September 16 against Washington DC lawyer Michael Sussmann, as a result of Special Counsel John Durham’s investigation into the origins of the Trump-Russia “collusion” probe, which ultimately found insufficient evidence of illegality by the former president.

Sussman is charged with lying to the FBI when, in September 2016, he showed up with a bunch of evidence suggesting a connection between Trump and Alfa Bank and claimed to not be working on behalf of any particular client.

In fact, the indictment alleges, he was working on behalf of the Clinton campaign and Joffe, both of whom had retained his services. Lying to the FBI is a crime in the US.

The indictment refers to Joffe as “Technology Executive 1”, but his identity has been confirmed by the NYT and others.

Sussman’s evidence in part comprised DNS data supplied by Joffe and analyzed by himself and other researchers, showing traffic between the domain mail1.trump-email.com and the Russian bank.

At the time, Neustar was a leading provider of domain registry services, but also a significant player in DNS resolution services, giving it access to huge amounts of data about domain queries.

“Tech Executive-1 [Joffe] used his access at multiple organizations to gather and mine public and non-public Internet data regarding Trump and his associates, with the goal of creating a ‘narrative’ regarding the candidate’s ties to Russia,” the indictment claims.

According to the indictment, Joffe had been offered a job in the Clinton administration. He allegedly wrote, shortly after the November 2016 election: “I was tentatively offered the top [cybersecurity] job by the Democrats when it looked like they’d win. I definitely would not take the job under Trump.”

The researchers — which also included employees of the Georgia Institute of Technology, ​Fusion GPS, and Zetalytics, according to the NYT — sought to create a case for a connection between Trump and the Russian government while privately expressing doubts that their conclusions would stand up to third-party scrutiny, the indictment claims.

The suspicions were briefed to the media by Sussman and the Clinton campaign, the indictment says, and widely reported prior to the election.

When the FBI investigated the alleged links, it concluded the suspicious traffic was benign and caused by the activities of a third-party marketing firm, according to reports.

As I said, it is not alleged that Joffe broke the law, and his people say the indictment is, as you might expect from an indictment, one-sided.

Still, it’s a very interesting, and possibly worrying, insight into how companies like Neustar and their employees are able to leverage DNS resolution data for their own private purposes.

The full indictment, which uses pseudonyms for most of the people said to be involved in the research, can be read here (pdf). The New York Times story, which reveals many of these identities, can be read here (paywall).

While Neustar’s registry business was acquired last year by GoDaddy, it appears that Joffe did not make the move and instead stayed with Neustar. His LinkedIn profile showed he “retired” at some point in the last few weeks, after 15 years with the company.

Donuts’ drop-catching service not anti-competitive, ICANN says

Donuts’ proposed DropZone service, which could see the registry start charging drop-catchers additional fees, is not anti-competitive, according to ICANN.

The service “does not raise any competition concerns”, ICANN VP Russ Weinstein said in a letter to registrar TurnCommerce, the company behind DropCatch.com.

He was responding to TurnCommerce’s concern that DropZone would allow Donuts to charge unlimited extra fees to register expiring names, while giving an advantage to its in-house registrars.

But Weinstein wrote (pdf):

The information received in the Dropzone RSEP request was thoroughly evaluated pursuant to our process, which included consideration of the matters raised in your letter. ICANN org determined that the Dropzone service as submitted by Donuts Inc. on behalf of [Donuts subsidiaries] Binky Moon, LLC and Dog Beach, LLC does not raise any competition concerns requiring ICANN org to refer either RSEP to a relevant competition authority.

DropZone would see Donuts handle its dropping names on a parallel registry system that registrars would have to obtain separate access to. Its Registry Service Evaluation Process request raises the prospect of new fees for such access.

Hold on to your stats! ShortDot gets two gTLDs approved in China

ShortDot, which makes a business repurposing unwanted gTLDs for the budget end of the market, said today it has had two more horses in its stable approved for use in China.

The company said that .bond and .cyou have been given the necessary nods by Chinese authorities.

What this could mean, if history is any guide, is a sharp increase in sales for the two extensions, possibly to the extent that they materially affect overall domain industry volume stats for the next few years.

ShortDot seems to think so, saying in a press release: “Given the massive success of .icu in China, it is quite clear that .bond and .cyou will follow suit to become largely successful.”

.icu currently has about 600,000 names under management, more than half of which are registered via Chinese registrars. Its numbers are on their way down.

At its peak 18 months ago it had more than 10 times as many, about 6.6 million, due to its low pricing and popularity among Chinese speculators.

The sudden rise and wholly predictable precipitous fall of .icu has been messing with overall new gTLD industry stats for the last couple of years. No volume analysis is complete without a .icu-related asterisk.

It’s by no means assured that the same will be true of .cyou and .bond of course.

.cyou, which was originally a dot-brand matching the ticker symbol of a Chinese company, had 118,000 names under management at the end of May and 136,000 in its zone file yesterday.

Names in .cyou can be had for $2 at Namecheap and NameSilo, its top two registrars, which together hold over 70% of the market.

.bond, originally an Australian university’s dot-brand, has fewer than 5,000 names at the last count and retails for about $55 retail at the low end.

CentralNic spends $6.5 million on traffic network

CentralNic this morning said it has paid $6.5 million to acquire “a publishing network of revenue generating websites”.

The company, which is seeing an increasingly large chunk of its revenue coming from domain monetization, said the network generates $2 million in annual revenue and $1.5 million in earnings.

The seller is White & Case, a 120-year-old international law firm, not exactly the kind of company you’d expect to own a bunch of random monetized domains.

Neither the size of the network nor the means of monetization were disclosed.

CentralNic said the network was already a customer for roughly half of its sites, so the acquisition will add about $1 million to revenue and $1.5 million to earnings, reducing annual cost of revenue by about $500,000.

While the company is best know for selling domain names, following recent acquisitions revenue from its fast-growing “online marketing” segment outpaced its traditional revenue sources, bringing in $96.4 million in the first half compared to $78.3 million in it two domain-related segments.