Second DNSSEC screw-up takes down Aussie web sites

.au domains failed to resolve for many internet users for almost an hour on Monday, after the registry operator messed up a DNSSEC update.

ccTLD overseer auDA said the issue was caused by a “key re-signing process that generated an incorrect record”. Users on ISPs that strictly enforce DNSSEC would have returned not-found errors for .au domains during the outage.

.au’s technical back-end is managed by Identity Digital, which reportedly said that the outage lasted from 0005 UTC until 0052 UTC.

With over four million domains, .au is I believe the largest TLD zone to fall victim to DNSSEC-related downtime, but it’s not the first time it has happened to the domain.

In March 2022, thousands of .au domains were affected by a DNSSEC snafu that lasted a few hours.

DNSSEC is meant to make the DNS more secure by reducing the risk of man-in-the-middle attacks, but it’s appears to be easy to screw up, judging by a list of TLD outages. Just this year, Mexico, New Zealand and Venezuela have also suffered downtime.

Comment Tagged: .au, auda, DNSSEC, identity digital

Nominet adds handcuffs clause to proposed new Articles

Nominet wants to add a new clause to its foundational Articles of Association that would prevent it adventuring into non-domain businesses without telling its members.

The proposal follows the scandal surrounding its CyGlass security business, which the company invested about $23.5 million in before eventually selling for a dollar.

“The Board will inform the Membership in advance of any proposed significant change in scope, together with an explanation as to how this relates to the Company’s objects for the public benefit,” the new Article 2 reads.

While there’s nothing requiring member approval of diversification, notice would at least give members time to organize resistance if it looked like history repeating itself.

Nominet chair told members the proposed article “creates an important constitutional safeguard to ensure Nominet remains aligned with its Members in future.”

Members will vote on the proposed new Articles at the company’s AGM next month, but Nominet has set a massive 90% majority threshold for the changes to be approved.

Green said that the current board plans to live by the spirit of the proposed Article 2 even if the vote fails, but noted that there can be no guarantee future boards would also do so.

4 Comments Tagged: .uk, nominet

Single/plural gTLD combos to be UNBANNED

It’s looking like ICANN won’t ban companies from applying for plural versions of existing singular gTLDs, and vice-versa, after all.

Among the pieces of the GNSO’s new gTLD policy advice ICANN’s board of directors rejected at the weekend was a proposal to essentially ban potentially confusing singular/plural combos coexisting in the DNS.

The board threw out the advice because it reckons ICANN would be put in a position where it would have to police internet content, which is outside its mission and something it is very averse to.

The recommendations would have prevented two strings existing in the DNS if one was the plural of the other, but only if they were in the same language and had the same intended usage.

The example the GNSO gave was applications for .spring and .springs — if both were intended for English-language sites related to bouncy metal coils, they would be deemed confusingly similar and only one would be allowed to exist. But if .spring was intended to relate to the season, both would be permitted to coexist.

But ICANN is uncomfortable with this because no matter what an applicant says in its application about intended language and intended use, without some post-delegation policing actual use may vary.

“Though a gTLD applicant can arbitrarily set the language of a TLD during an application round, a registrant and end-user can only see
the script of the TLD string in its practical usage. So the singular/plural determination by the gTLD applicant does not carry
onward to the registrant and end user,” the board wrote.

“Restricting the use and potentially the content of strings registered in TLDs based on the intended use therefore raises concerns for the Board in light of ICANN’s Bylaws Section 1.1 (c),” it said, referring to the part of its bylaws that says it is not allowed to regulate internet content.

So it seems likely that plural/singular clashes are probably going to be permitted in future new gTLD round after all.

This, of course, reopens the business model of a lazy applicant going after the singular/plural of an existing registry’s string and piggybacking on its installed user base or marketing budget.

Comment Tagged: ICANN, new gTLDs, plurals, singular

ICANN rejects a whole bunch of new gTLD policy stuff

ICANN has delivered some bad news for dot-brands, applicants from poorer countries, and others, at the weekend rejecting several items of new gTLD policy advice that the community spent years cooking up.

The board of directors on Sunday approved a scorecard of determinations, including the rejection (or non-adoption) of seven GNSO recommendations that it deems “would not be in the best interests of the ICANN community or ICANN”.

In reality, it’s the latter that seems to have been foremost in the board’s mind; most of the rejections appear to be geared toward reducing ICANN Org’s legal or financial exposure.

Notably, dot-brands are denied some of the relief from cumbersome or expensive requirements that the GNSO had wanted rid of.

The board rejected a recommendation that would exempt them from the Continued Operations Instrument — a financial bond used to pay an Emergency Back-End Registry Operator should the applicant go out of business.

“[T]he Board is concerned that an exemption from an COI for Spec 9 applications would have financial impact on ICANN since there would be no fund to draw from if such a registry went into EBERO,” the board wrote.

It also rejected a request to exempt dot-brands from rules requiring them to contractually ban and monitor abuse in their TLDs. The GNSO had argued that single-registrant TLDs do not suffer abuse, but the board said this could lead to abuse from compromised domains going unaddressed.

“The Board concludes that Recommendation 9.2, if implemented, could lead to DNS abuse for second-level registrations in a single-registrant TLD going unaddressed, unobserved, and unmitigated,” it said.

Applicants hoping to benefit from the Applicant Support Program — which in 2012 offered heavily discounted application fees to poorer applicants — also got some bad news.

The GNSO wants the support to extend to other costs such as application-writing services and lawyers, which naturally enough put the frighteners on the board, which noted “such expansion of support could raise the possibility of inappropriate use of resources (e.g. inflated expenses, private benefit concerns, and other legal or regulatory concerns)”.

The board also rejected a couple of recommendations that could be seen as weakening its role as ultimate authority over all things gTLD.

It rejected a proposal to remove the controversial covenant not to sue (CNTS) from the application process unless other recommendations related to appeals processes are implemented.

ICANN said that because it has not yet approved these other recommendations, it has rejected this recommendation.

The board also rejected a recommendation that would have limited its ability to reject a gTLD application to only when permitted to do so by the rules set out in the Applicant Guidebook.

The idea was to prevent applications being arbitrarily rejected, but the board said this “may unduly limit ICANN’s discretion to reject an application in yet-to-be-identified future circumstance(s)”.

The rejections invoke part of the ICANN bylaws that now requires the GNSO Council to convene and either affirm or amend its recommendations before discussing them with the board. Presumably this could happen at ICANN 78 next month.

The bylaws process essentially gives the board the ultimately authority to throw out the GNSO recommendations if it can muster up a two-thirds supermajority vote, something it rarely has a problem achieving.

1 Comment Tagged: abuse, applicant support, coi, dot-brands, ebero, gnso, ICANN, new gTLDs, next round, subpro

Volkswagen ditches its dot-brand

Another major car-maker has thrown in the towel on its key dot-brand gTLD. This time it’s Volkswagen.

Referring to .volkswagen, the company has told ICANN: “This top level domain has never been utilized by Volkswagen of America and we do not intend to utilize it.”

The company had already ditched its secondary dot-brand, .大众汽车 (.xn--3oq18vl8pn36a), which is the Chinese version of its name.

Fiat Chrysler and Bugatti have both also previously terminated dot-brand contracts, while Seat and Audi each have thousands of names in their main dot-brand gTLDs.

Comment Tagged: dot-brands, ICANN, new gTLDs, termination

Radix looking for a back-end

Radix is looking for a back-end registry services provider, possibly ending its 10-year relationship with CentralNic (now Team Internet).

The company announced an invitation-only RFP covering all of its stable of TLDs: .online, .store, .tech, .website, .space, .press, .site, .host, .fun, .uno, and .pw.

.online alone has 2.6 million names in its zone right now; should it switch to a different back-end it would be the largest migration since 3.1 million .au domains changed hands in 2018.

Radix says its portfolio contains seven million domains altogether.

The company has put a September 16 deadline on interested parties returning their RFP forms. It expects to make its decision by the end of November.

1 Comment Tagged: back-ends, radix, rfp

Is this why WhatsApp hates some TLDs but not others?

Developers of major pieces of internet software, including the world’s most-popular messaging app, may be relying on seriously outdated lists of top-level domains.

That’s the picture that seems to be emerging from one new gTLD operator’s quest to discover why WhatsApp doesn’t recognize its TLD, and many others including major dot-brands, as valid.

And ICANN isn’t interested in helping, despite its declared focus on Universal Acceptance, the CEO of this registry claims.

When most social media apps detect the user has inputted a URL or domain name, they automatically “linkify” it so it can be easily clicked or tapped without the need for copy/paste.

But when Rami Schwartz of new gTLD .tube discovered that .tube URLs sent via WhatsApp, said to have two billion users, were not being linkified, despite the TLD being delegated by ICANN almost eight years ago, he set out to find out why.

Schwartz compiled a spreadsheet (.xlsx) listing which gTLDs are recognized by WhatsApp and which are not and discovered a rough cut-off point in November 2015. TLDs delegated before then are linkified, those delegated after were not.

According to my database, 468 TLDs have been delegated since December 2015, though not all are still in the root. That’s about a third of all TLDs.

This means that, for example, .microsoft domains linkify but .amazon and .apple domains do not; .asia domains linkify but .africa and .arab domains do not; .london works but .abudhabi doesn’t. Even .verisign missed the cut-off.

If WhatsApp users include a “www.” or “http://” then the app will linkify the domain, even if the specified TLD does not exist.

During the course of a discussion on the web site of the Public Suffix List — which maintains an open-source list of all TLDs and the levels at which names may be registered — it was discovered that the problem may be deeper rooted than the WhatsApp app.

It turns out a library in the Android operating system contains a hard-coded list of valid TLDs which hasn’t been updated since November 24, 2015.

Any app relying on Android to validate TLDs may therefore be susceptible to the same problem — any TLD younger than seven years won’t validate. Schwartz tells us he’s experienced the same issues with the Facebook app on Android devices.

The problem is of particular concern to Schwartz because he’s been planning to market .tube as a form of link-shortening service, and without full support among the most popular messaging apps such a service would be much less attractive.

“I can’t launch this now if it’s not going to work in WhatsApp, if it’s not going to work in Facebook,” he said.

While engineers from Facebook/WhatsApp parent Meta now seem to be looking into the problem, Schwartz says his complaints fell on deaf ears for a long time.

He additionally claims that “ICANN doesn’t really care about universal acceptance” and his attempts to get the Org to pay attention to the problem have been brushed off, despite ICANN making Universal Acceptance one of its key priorities.

Schwartz says ICANN is much more interested in UA when it comes to internationalized domain names (those in non-Latin scripts, such as Arabic or Chinese) and not the technical issues that underpin the functionality of all TLDs.

“I’ve no idea why ICANN makes the decisions it makes, but I think it has to do with inclusion, I think it has to do with diversity, I think it has to do with a lot of things — not technical,” he said. “But this is a technical issue.”

ICANN maintains a set of UA technical resources on its web site and supports the work of the independent Universal Acceptance Steering Group.

Comment Tagged: .tube, android, facebook, ICANN, meta, uasg, universal acceptance, whatsapp

Blockchain domain firm raises $2.5 million

Switzerland-based startup Freename said it has secured $2.5 million in seed funding to pursue its ambitions in blockchain-based domain names.

The round was led by Sparkle Ventures with participation from Abalone Asset Management, Golden Record Ventures, Blockchain Founders Fund, and Sheikh Mayed Al Qasimi, a member of a UAE royal family.

Freename, which can be found at freename.io, says it enables pretty much anybody to register a TLD on a blockchain and then earn 50% of the reg fee whenever somebody registers a second-level domain in that TLD.

The “free” appears to mean as in speech, rather than as in beer. If I want to register .murphy, it will apparently set me back $4,099, meaning I’d have to sell over 1,600 2LDs at $5 a pop to make my money back. A gibberish string of characters will cost $79. Freename says it does not charge renewal fees.

It also seems to be reserving strings when they match a “brand, organization, or notable person”, weakening the case that blockchain offers
a liberating alternative to the centralized control inherent to the ICANN root.

Terms associated with some crimes also appear to be blocked, as are strings that match existing generic TLDs in the authoritative DNS.

The company says it has issued 5,000 TLDs on multiple blockchains since it launched last year, but of course users need to install a custom browser plug-in for any of them to actually resolve.

Freename says it hopes to help make these “Web3” domains compatible with traditional “Web2” DNS over time.

Comment Tagged: alt-roots, blockchain, freename

Verisign: 1.7 million domain industry growth in Q2

The DNS grew by 1.7 million domains in the second quarter, according to Verisign’s latest Domain Name Industry Brief.

The quarter ended with 356.6 million domains across “all” TLDs, the company said. That’s up 1.7 million on the quarter and 4.3 million on the year.

I put “all” in quotes because it turns out Verisign hasn’t been including over a dozen TLDs in its calculations in previous reports.

Inexplicably, it hasn’t been counting 10 pre-2012 gTLDs — .aero, .asia, .cat, .coop, .gov, .museum, .pro, .tel, .travel and .xxx — for which zone files have been readily available for years. It’s also added six small ccTLDs to its calculations.

The upshot of this is that while a comparison with the Q1 DNIB would suggest growth of 2.6 million domains, it’s not, it’s just 1.7 million.

The report shows that both .com and .net shrunk in the quarter — 161.3 million versus 161.6 million and 13.1 million versus 13.2 million.

New gTLDs and ccTLDs were left to pick up the slack. Total ccTLD names was up 1.1 million to 137 million and total new gTLD domains was up 0.8 million to 28.1 million.

Comment Tagged: dnib, verisign

Namecheap has given away 500,000 free .me domains

A project started in 2014 has seen Namecheap give away 500,000 .me domains to university students in the Anglophone world.

The offer, started in 2014 at nc.me, is for the first year’s registration and is for students to create “online portfolios, resumes, blogs and other personal websites”.

Registrants authenticate themselves by having email addresses associated with universities, such as .edu in the US. Institutions in the UK and Australia are also supported.

Not all of the names registered over the last nine years are still registered, according to a spokesperson, but 500,000 would be a sizable chunk of .me’s total domains under management.

The registry, Domen, does not regularly publish its reg numbers but it hadn’t yet crossed the one million mark as of 2018, according to its web site.

The Namecheap spokesperson said that the registry provide the first-year regs for free under the partnership.

3 Comments Tagged: .me, domen, namecheap