Root crypto rollover now slated for October

ICANN has penciled in October 11 as the new date for rolling the DNS root’s cryptographic keys, a delay of a year from its original plan.
The so-called KSK rollover will see ICANN remove the deprecated 2010 Key Signing Key, leaving only the 2017 KSK active.
The KSK acts as the “trust anchor” for DNSSEC across the whole internet.
After the rollover, any network not configured to use the latest KSK would see a service interruption.
This could mean many millions of internet users being affected, but ICANN doesn’t know the extent of the possible impact for sure.
ICANN told us in November that it knows of 176 organizations in 41 countries, fairly evenly spread across the globe, that are currently not prepared to handle the new KSK.
But its data is patchy because only a tiny number of DNS resolvers are actually configured to automatically report which KSKs they’re set up to use.
Key rollovers are recommended by DNSSEC experts to reduce the risk of brute force attacks against old keys. At the root, the original plan was to roll the keys every five years.
ICANN had named October 11 2017 as the date for the first such rollover, but this was pushed back to some time in the first quarter after ICANN became aware of the lack of support for the 2017 KSK.
This was pushed back again in December to Q3 at the earliest, after ICANN admitted it still didn’t have good enough data to measure the impact of a premature roll.
Since then, ICANN has been engaged in (not always successful) outreach to networks it knows are affected and has kicked off discussions among network operators (there’s a fairly lively mailing list on the topic) to try to gauge how cautious it needs to be.
It’s now published an updated plan that’s the same as the original plan but with a date exactly one year late — October 11, 2018.
Between now and then, it will continue to try to get hold of network operators not ready to use the new keys, but it’s not expecting to completely eliminate damage. The plan reads:

Implicit in the outreach plan is the same assumption that the community had for the earlier (postponed) plan: there will likely be some systems that will fail to resolve names starting on the day of the rollover. The outreach will attempt to minimize the number of affected users while acknowledging that the operators of some resolvers will be unreachable.

The plan is open for public comment and will require the assent of the ICANN board of directors before being implemented. You have until April 2 to respond.

Comment Tagged: DNSSEC, iana, ICANN, ksk, rollover, security

Uniregistry changes emails after “renewal scam” complaints

Uniregistry has modified its marketing emails after customers complained they looked like fake renewal “scams”.
One customer contacted DI last week to say they were “horrified” to receive pitches for cheap SSL certificates that “read like some of the worst domain expiration scams of the past”.
The company recently started reselling Comodo’s SSL certs as part of its plan to broaden its customer base beyond its roots in the domain investor community.
But the way these certs were marketed left more than one customer with concerns. One email, which I’ve lightly redacted, read as follows:

Dear [CUSTOMER],
FINAL NOTICE – Your SSL certificate for your domain has expired. Take action and renew your certificate today through Uniregistry.
If your SSL certificate expires your website will display a warning informing customers the site is not secure.
We’ve teamed up with Comodo CA to offer our valued customers discounts up to 78% off when they renew their SSL certificate through us.
Visit https://www.comodo.com/uniregistry/ to take advantage of this offer and renew your certificate before it expires.
Domains at Risk :
[LIST OF DOMAINS]
Average validation time is less than an hour could take longer. Don’t let your certificate expire and put your business at risk. We are here to help, contact one of our SSL Specialist for more information or if you need additional support.
Thank you for choosing Uniregistry and Comodo CA

The reader said that while they have some domains with Uniregistry, their SSL certs had been bought elsewhere.
They added that the certs had not “expired” as the email claimed and said that they were not due to expire for months.
In addition, the email is quite clearly asking the customer to “renew” their cert via Uniregistry and Comodo, which should not be possible if the current cert was bought from a different Certificate Authority. It’s actually a solicitation to buy a new cert.
The scare-tactics wording is reminiscent of the old “slamming” scams carried out by Brandon Gray Internet Services, going under the moniker Domain Registry Of America and similar, until ICANN terminated its contract in 2014.
These “fake renewal” scams were delivered in the form of final-demand invoices, but were in fact solicitations to transfer domains, at a huge premium, from their current registrar to the scammer’s registrar.
A major difference between the DROA scam and Uniregistry’s marketing is that Uniregistry only contacted its existing customers. It was not spamming SSL owners at random.
Uniregistry told DI that the emails in question were part of an “A/B test” — when a company tests two emails to different sets of customers to see which one gets the best response rate — that were sent to “small number” of its customers.
Chief operating officer Kanchan Mhatre said in an email:

The initial content sent came from a previous campaign and it’s fair to say that it needed modifying to more accurately reflect what we were trying to convey. Based on the feedback received from you and other customers, we have modified the messaging and we are currently reviewing cert expiry date validation to ensure that we communicate with our customers in a timely manner.

2 Comments Tagged: brandon gray, droa, slamming, ssl, uniregistry

CPE probe: “whitewash” or “fig leaf”?

A few weeks ago, when I was reporting the conclusions of a probe into ICANN’s new gTLD program, I wrote a prediction on a piece of paper and placed it into a sealed envelope.*
I wrote: “They’re gonna call this a whitewash.”
And I was correct! Ta-dah! I’m here all week.
The lawyer for applicants for .music and .gay gTLDs has written to ICANN to complain that a purportedly independent review of the Community Evaluation Process was riddled with errors and oversights and should not be trusted.
In a letter on behalf of dotgay LLC, Arif Ali calls the report a “whitewash”. In a letter on behalf of DotMusic, he calls it a “fig leaf”.
Both companies think that the CPE probe was designed to give ICANN cover to proceed with auctions for five outstanding gTLD contention sets, rather than to get to the bottom of perceived inconsistencies in the process.
Both of Ali’s clients applied for their respective gTLDs as “community” applicants, trying to avoid auctions by using the Community Priority Evaluation process.
During their CPEs, both carried out by the Economist Intelligence Unit, neither applicant scored highly enough to win the exclusive right to .gay or .music, meaning the next stage was to auction the strings off to the highest bidder.
After repeated complaints from applicants and an Independent Review Process finding that ICANN lacked transparency and that staff may have had inappropriate influence over the EIU, ICANN hired FTI Consulting to look into the whole CPE process.
FTI’s report was finally delivered late last year, clearing ICANN on all counts of impropriety and finding that the EIU’s evaluations had been consistent across each of the applications it looked at.
The remaining gTLDs affected by this are .music, .gay, .hotel, .cpa, and .merck.
ICANN’s board of directors is due to meet to discuss next steps this weekend, but Ali says that it should “critically evaluate the [FTI] Report and not accept its wholesale conclusions”. He wrote, on behalf of DotMusic:

The report reveals that FTI’s investigation was cursory at best; its narrow mandate and evaluation methodology were designed to do little more than vindicate ICANN’s administration of the CPE process.
…
It is evident that FTI engaged in a seemingly advocacy-driven investigation to reach conclusions that would absolve ICANN of the demonstrated and demonstrable problems that afflicted the CPE process.

Among the applicants’ list of complaints: their claim that FTI did not interview affected applicants or take their submissions seriously, and the fact that ICANN was less than transparent about who was conducting the probe and what its remit was.
The same letter quotes ICANN chair Cherine Chalaby, then vice-chair, saying in a January 2017 webinar that he had observed inconsistencies in how the CPEs were carried out; inconsistencies FTI has since found did not occur.
That should be enough to provoke discussion when the board meets to discuss this and other issues in Los Angeles on Saturday.
* I didn’t actually do this of course, I just thought about it, but you get my point.

Comment Tagged: .gay, .music, community, cpe, dotgay, dotmusic, eiu, fti, ICANN, irp

US and EU call for Whois to stay alive

Government officials from both sides of the Atlantic have this week called on ICANN to preserve Whois as it currently is, in the face of incoming EU privacy law, at least for a select few users.
The European Commission wrote to ICANN to ask for a “pragmatic and workable solution” to the apparent conflict between the General Data Protection Regulation and the desire of some folks to continue to access Whois as usual.
Three commissioners said in a letter (pdf) that special consideration should be given to “public interests” including “ensuring cybersecurity and the stability of the internet, preventing and fighting crime, protecting intellectual property and copyright, or enforcing consumer protection measures”.
David Redl, the new head of the US National Telecommunications and Information Administration, echoed these concerns in a speech at the State of the Net conference in Washington DC on Monday.
Redl said that the “preservation of the Whois service” is one of NTIA’s top two priorities at the moment. The other priority is pressing for US interests in the International Telecommunications Union, he said.
Calling Whois “a cornerstone of trust and accountability for the Internet”, Redl said the service “can, and should, retain its essential character while complying with national privacy laws, including the GDPR.”
“It is in the interests of all Internet stakeholders that it does,” he said. “And for anyone here in the US who may be persuaded by arguments calling for drastic change, please know that the US government expects this information to continue to be made easily available through the Whois service.”
He directly referred to the ability of regular internet users to access Whois for consumer protection purposes in his speech.
The European Commission appears to be looking at a more restrictive approach, but it did offer some concrete suggestions as to how GDPR compliance might be achieved.
For example, the commissioners’ letter appears to give tacit approval to the idea of “gated” access to Whois, but called for access by law enforcement to be streamlined and centralized.
It also suggests throttling as a mechanism to reduce abuse of Whois data, and makes it clear that registrants should always be clearly informed how their personal data will be used.
The deadline for GDPR compliance is May this year. That’s when the ability of EU countries to start to levy fines against non-compliant companies, which could run into millions of euros, kicks in.
While ICANN has been criticized by registries and registrars for moving too slowly to give them clarity on how to be GDPR-compliant while also sticking to the Whois provisions of their contracts, its pace has been picking up recently.
Two weeks ago it called for comments on three possible Whois models that could be used from May.
That comment period ended on Monday, and ICANN is expected to publish the model upon which further discussions will be based today.

Comment Tagged: copyright, european commission, gdpr, ICANN, law enforcement, ntia, privacy, trademarks, whois

Is the Trump administration really trying to reverse the IANA transition?

Questions have been raised about the US government’s commitment to an independent ICANN, following the release of letters sent by two top Trump appointees.
In the letters, new NTIA head David Redl and Secretary of Commerce Wilbur Ross expressed an interest in looking at ways to “unwind” the IANA transition, which in 2016 severed the formal ties between ICANN and the US in DNS root zone management.
Responding to questions from senators during his lengthy confirmation process, now National Telecommunications and Information Administration assistant secretary Redl wrote:

I am not aware of any specific proposals to reverse the IANA transition, but I am interested in exploring ways to achieve this goal. To that end, if I am confirmed I will recommend to Secretary Ross that we begin the process by convening a panel of experts to investigate options for unwinding the transition.

The letters were first obtained by Politico under the Freedom of Information Act. We’re publishing them here (pdf).
They were sent last August, when Redl’s confirmation to the NTIA role was being held up by Senator Ted Cruz, who vehemently opposed the transition because he said he thought it would give more power over online speech to the likes of Russia and China.
He was confirmed in November.
The question is whether Redl was serious about unwinding the transition, or whether he was just bullshitting Cruz in order to remove a roadblock to his confirmation.
Technically, he only promised to “recommend” convening a panel of experts to his boss, Ross.
NTIA declined to comment last week when DI asked whether the department still supports the IANA transition, whether any efforts are underway to unwind it, and whether the panel of experts has already been convened.
Redl’s statements on ICANN since his confirmation have been more or less consistent with his Obama-era predecessor, Larry Strickling, in terms of expressing support for multi-stakeholder models, but with perhaps some causes for concern.
During his first public speech, delivered at the CES show in Las Vegas earlier this month, Redl expressed support for multi-stakeholder internet governance amid pushes for more multi-lateral control within venues such as the International Telecommunications Union.
However, he added:

I’ll also focus on being a strong advocate for U.S. interests within ICANN. We need to ensure transparency and accountability in ICANN’s work. And in light of the implementation of the European General Data Privacy Regulation, or GDPR, we need to preserve lawful access to WHOIS data, which is a vital tool for the public.
In the coming weeks, I’ll be seeking out the views of stakeholders to understand how else NTIA can best serve American interests in these global Internet fora.

Could this be an allusion to the “panel of experts”? It’s unclear at this stage.
One of Redl’s first moves as NTIA chief was to slam ICANN for its lack of accountability concerning the shutdown of a review working group, but that was hardly a controversial point of view.
And in a letter to Senator Brian Schatz, the Democrat ranking member of the Senate Commerce Subcommittee on Communications, Technology, Innovation, and the Internet, sent earlier this month, Redl expressed support for the multi-stakeholder model and wrote:

NTIA will be a strong advocate for US interests with the Governmental Advisory Committee of the Internet Cooperation [sic] for Assigned Names and Numbers (ICANN) in the existing post-transition IANA phase. NTIA will also monitor the [IANA operator] Public Technical Identifiers (PTI) and take action as necessary to ensure the security and stability of the DNS root.

That certainly suggests NTIA is happy to work in the new paradigm, while the promise to “take action as necessary” against PTI may raise eyebrows.
While a lot of this may seem ambiguous, my hunch is that there’s not really much appetite to reverse the IANA transition. Apart from appeasing Cruz’s demons, what could possibly be gained?
Ross, quizzed by Cruz at his own confirmation hearing a year ago, seemed reluctant to commit to such a move.

1 Comment Tagged: commerce, iana, ICANN, ntia, pti, ted cruz, transition

MMX profitable as acquisition talks drag on

New gTLD registry Minds + Machines became profitable as an operating company for the first time in 2017, the company announced on Friday.
MMX saw billings of $10 million in the second half of the year, compared to $5.6 million in the first half, as domains under management grew 67% to 1.32 million.
Billings is a measure of sales, rather than the more formal measure of revenue for accounting purposes.
Renewals accounted for $5.6 million of billings in the year, which “for the first-time has exceeded fixed operating costs which have been reduced to below $5.5 million for 2017”.
The company’s bottom line will also boosted by $2.1 million due to MMX losing the .inc and .llc new gTLD auctions.
MMX also provided an update on its “strategic review”, a code word for the “acquisition by or sale/merger of the Company” that it announced last May.
The company said “the longevity of the discussions has been at times frustrating” but that it hopes to have something to announce by the time it reports its formal 2017 results in April.
MMX had originally hoped to have concluded these talks before last September.

3 Comments Tagged: acquisition, earnings, Minds + Machines, mmx

Emojis coming to another ccTLD

dotFM is to make emoji domain names available in the .fm ccTLD it manages.
The company said today that it’s currently taking expressions of interest in ‘premium’ emoji inventory, and that such domains will be registerable at an unspecified point in future.
It’s published a list of single-emoji domains it plans to sell.
Emoji domains “will be available based on Unicode Consortium Emoji Version 5.0 standards using single code point; and allowing a mix of letters and emoji characters under the top-level .FM, as well as the dotRadio extensions, .RADIO.fm and .RADIO.am”, dotFM said.
Very few TLDs allow emojis to be registered today.
The most prominent is .ws, which is Western Samoa’s ccTLD, marketed as an abbreviation for “web site”.
.fm is the ccTLD for Micronesia, but dotFM markets it to radio stations.
As ccTLDs, they’re not subject to ICANN rules that essentially ban them contractually in gTLDs.
Emojis use the same encoding as internationalized domain names, but do not feature in the IDN standards because they’re not used in real spoken languages.
Emoji domains are usually considered not entirely practical due to the inconsistent ways they can be rendered by applications.

Comment Tagged: .fm., .ws, dotfm, emojis, idns

Donuts releases free TLD-neutral name-spinner

Donuts has announced the release of a free name-spinner tool for registrars and resellers.
Relevant Name Search, found at rns.domains, isn’t a destination site in itself, but will be free for registrars to integrate into their storefronts.
The company said it’s been in beta testing with eNom, Dreamhost, Dynadot and Name.com, with eNom using it for over a year.
The service recalls something similar released by Verisign.
However, unlike the Verisign NameStudio tool, Donuts said RNS is “registry-neutral”, meaning it’s not designed to plug its own portfolio of TLDs over those from other registries.
I subjected the service to a quick, non-scientific test today and found the results much more semantically relevant than the Verisign tool, which only returns .com, .net and .cc results.
When I used NameStudio in November to search for “vodka”, my best offering was dogvodka.com. With RNS, I was offered the likes of vodka.bar, vodka.rocks, vodka.party, vodka.social and vodka.trade (all of which appear to carry premium pricing).
While Verisign offered me funattorney.com on a search for “attorney”, Donuts offered up attorney.lawyer, attorney.lgbt and attorney.blog.
RNS does not ignore legacy gTLDs, however. Doing a search for something a little more niche will bring up .com and .net domains, appropriately (in my view) ranked.
Search for “birmingham taxi” and you’ll get three relevant .limo domains (yeah, .limo exists, apparently) before birminghamtaxi.net.
Similarly, if you want to open up a pizza place in Cardiff, search for “cardiff pizza” and you’ll get offered cardiff.pizza, cardiffpizza.menu, cardiffpizza.restaurant, cardiffpizza.cafe and cardiffpizza.delivery before you get to cardiffpizza.com.
Many domain investors would say that the .com is unarguably the superior domain (it’s also unregistered and non-premium), but even those people would have to admit that the five more prominent suggestions have more semantic relevance.
Donuts said that RNS is configurable to take into account TLD-specific promotions, geography and marketing campaigns, and that it can be integrated with a single API call.

6 Comments Tagged: donuts, name spinner, namestudio, relevant name search, rns, verisign

New gTLD revenue cut by HALF in ICANN budget

The new gTLD industry is performing terribly when compared to ICANN’s predictions just six months ago.
ICANN budget documents published over the weekend show that by one measure new gTLDs are doing just 51% of the business ICANN thought they would.
The new budget (pdf) shows that for the fiscal year 2018, which ends June 30, ICANN currently expects to receive $4.6 million in registry transaction fees.
These are the fees registries must pay for each new registration, renewal or transfer, when the TLD has more than 50,000 domains under management.
In a draft budget (pdf) published March 2017, its “best estimate” for these fees in FY18 was $8.9 million, almost double its newest prediction.
That prediction lasted until the approved budget (pdf) published last August.
The budget published at the weekend expects this transaction revenue to increase 31.1% to $6 million by June 30, 2019, still a long way off last year’s estimate.
At the registrar level, where registrars pay a transaction fee regardless of the size of the customer’s chosen gTLD, ICANN expects new gTLD revenue to be $3.9 million in FY18.
That’s just 52% of its March/August 2017 estimate of $7.5 million.
Looking at all reportable transactions — including the non-billable ones — ICANN’s projection for FY18 is now 21.9 million, compared to its earlier estimate of 41.7 million.
ICANN even reckons the number of new, 2012-round gTLDs actually live on the internet is going to shrink.
Its latest budget assumes 1,228 delegated TLDs by the end of June this year, which appears to be a couple light on current levels (at least according to me) and down from the 1,240 it expected a year ago.
It expects there to be 1,231 by the end of June 2019, which is even lower than it expected have in June 2017.
I suspect this is related to dot-brands cancelling their contracts, rather than retail gTLDs going dark.
Revenue from fixed registry fees for FY18 is expected to be $30.6 million, $200,00 less than previous expectations. Those numbers are for all gTLDs, old and new.
Overall, the view of new gTLDs is not pretty, when judged by what ICANN expected.
It shows that ICANN is to an extent captive to the whims of a fickle market that has in recent years been driven by penny deals and Chinese speculation.
By contrast, legacy gTLDs (.com, .info, etc) are running slightly ahead of earlier projections.
ICANN now expects legacy registry transaction fees of $48.6 million for FY18, which is $200,000 more than predicted last year.
It expects registrar transaction fees of $29.5 million, compared to its earlier forecast of $29.4 million.
This is not enough to recoup the missing new gTLD money, of course, which is why ICANN is slashing $5 million from its budget.

3 Comments Tagged: budget, ICANN, new gTLDs

ICANN slashes millions from its budget

ICANN has cut $5 million from its annual budget, warning the community that difficult decisions have to be made amid a slowing domain name market.
Staff and community members will all be affected by the cuts, whether in the form of less generous pay raises or fewer travel opportunities.
Cuts have also been proposed to international outreach, tech support, contractual compliance and translation services.
The organization at the weekend published for comment its proposed budget for fiscal 2019. That’s the year that begins July 1, 2018.
It would see ICANN spend $138 million, $5 million less than it expects to spend in fiscal 2018.
Four of the five top-line areas ICANN reports expenses will be cut for a total of $12 million in savings, while one of them — personnel — is going up by $7.3 million.
This rounds out to a $5 million cut to the total FY19 ICANN budget. Here’s the breakdown:

• Personnel costs going up from $69.5 million to $76.8 million, up $7.3 million.
• Travel and meetings costs are to go down from $17.8 million to $15.6 million, a $2.2 million saving.
• Professional services costs will go down from $27.7 million to $23.4 million, a $4.3 million saving.
• Administration and capital costs will go down from $22.5 million to $17.8 million, a $4.7 million saving.
• The contingency budget is going down from $5.3 million to $4.5 million, a $800,000 saving.

Personnel costs are going up due to a combination of new hires and pay rises, but the average annual pay rise will be halved from 4% to 2%, saving $1.3 million, ICANN documentation states.
Headcount is expected to level out at about 425, up from the current 400, by the end of FY19.
The travel budget is going down due to a combination of cuts to services provided at the three annual meetings and the number of people ICANN reimburses for going to them.
The Fellows program — sometimes criticized for giving people what look like free vacations for little measurable return — is seeing the biggest headcount cut here. ICANN will only pay for 30 Fellows to go its meetings in FY19, half the level of FY18. The Next Gen program, a similar outreach program for yoof participants, goes down to 15 people from 20.
The Governmental Advisory Committee will get its number of funded seats reduced by 10 to 40. The ALAC and the ccNSO also each lose a few seats. Other constituencies are unaffected.
At the meetings themselves, translation is to be scaled back to be provided on an as-requested basis, rather than automatically translating everything into all six UN languages. Key sessions will continue to have live interpretation.
Outside of the three main meetings, ICANN is pulling back on plans to expand its irregular “capacity building” workshops in “under-served” areas of the world.
It’s also slashing the “additional budget request” budget by 50%.
In terms of compliance, a proposed Technical Compliance Monitoring system that was going to be built this year — a way to make sure gTLD registries and registrars are stable and secure — appears to be at risk of being deprioritized.
ICANN said it “will develop an implementation plan in due time, depending on the RFP results and, if needed, work with the Board to identify necessary resources and funds to support implementation of the project.”
The documents published today are now open for public comment until March 8.
The cuts I’ve reported here can be found from page 19 of this document (pdf).
The reason for the cutbacks is that ICANN’s revenue isn’t growing as fast as it once did, due to the slower than expected growth of the domain name industry in general. I’ll get to that a later article.

Comment Tagged: .travel, budget, ICANN