The internet is still working after KSK roll

The first-ever change to the security keys at the top of the DNS tree appears to have been a non-event.
While ICANN received reports of some disruptions after last Thursday’s KSK rollover, the impact appears to have fallen short of the millions of users that had been speculated.
ICANN said yesterday:

After evaluation of the available data, there does not appear to be a significant number of Internet end-users who have been persistently and negatively impacted by the changing of the key.
The few issues that have arisen appear to have been quickly mitigated and none suggested a systemic failure that would approach the threshold (as defined by the ICANN community) to initiate a reversal of the roll. In that context, it appears the rollover to the new Key Signing Key, known as KSK 2017, has been a success.

The KSK, also sometimes called the “trust anchor”, is the ultimate cryptographic key in the chain that secures all DNSSEC queries on the internet.
October 11 was the first time it had been changed since the first version came online in 2010.
While changing the key was broadly considered sound security practice, the roll was delayed by a year after it was discovered that potentially millions of endpoints were using DNS resolvers not properly configured to use the 2017 key.
After much research, outreach and gnashing of teeth, it was decided that the risk posed by rolling the KSK now fell within acceptable parameters of collateral damage.
Experts from the likes of Google and Verisign, and one ICANN director, had urged caution and said perhaps the roll should be delayed further while more data was gathered.
But they were in the minority, ICANN went ahead anyway, and it seems their fears have not come to pass.
The KSK is now likely to be rolled regularly — it could be as little as once every five years, or more frequently.
It also gives ICANN the opportunity to eventually update the system to swap out its current RSA keys for keys based on elliptical curve cryptography, which could reduce the traffic load on the DNS as a whole.

1 Comment Tagged: DNSSEC, ICANN, ksk, ksk rollover

Donuts loses to ICANN in $135 million .web auction appeal

Donuts has lost a legal appeal against ICANN in its fight to prevent Verisign running the .web gTLD.
A California court ruled yesterday that a lower court was correct when it ruled almost two years ago that Donuts had signed away its right to sue ICANN, like all gTLD applicants.
The judges ruled that the lower District Court had “properly dismissed” Donuts’ complaint, and that the covenant not to sue in the Applicant Guidebook is not “unconscionable”.
Key in their thinking was the fact that ICANN has an Independent Review Process in place that Donuts could use to continue its fight against the .web outcome.
The lawsuit was filed by Donuts subsidiary Ruby Glen in July 2016, shortly before .web was due to go to an ICANN-managed last-resort auction.
Donuts and many others believed at the time that one applicant, Nu Dot Co, was being secretly bankrolled by a player with much deeper pockets, and it wanted the auction postponed and ICANN to reveal the identity of this backer.
Donuts lost its request for a restraining order.
The auction went ahead, and NDC won with a bid of $135 million, which subsequently was confirmed to have been covertly funded by Verisign.
Donuts then quickly amended its complaint to include claims of negligence, breach of contract and other violations, as it sought $22.5 million from ICANN.
That’s roughly how much it would have received as a losing bidder had the .web contention set been settled privately and NDC still submitted a $135 million bid.
As it stands, ICANN has the $135 million.
That complaint was also rejected, with the District Court disagreeing with earlier precedent in the .africa case and saying that the covenant not to sue is enforceable.
The Appeals Court has now agreed, so unless Donuts has other legal appeals open to it, the .web fight will be settled using ICANN mechanisms.
The ruling does not mean ICANN can go ahead and delegate .web to Verisign.
The .web contention set is currently “on-hold” because Afilias, the second-place bidder in the auction, has since June been in a so-called Cooperative Engagement Process with ICANN.
CEP is a semi-formal negotiation-phase precursor to a full-blown IRP filing, which now seems much more likely to go ahead following the court’s ruling.
The appeals court ruling has not yet been published by ICANN, but it can be viewed here (pdf).
The court heard arguments from Donuts and ICANN lawyers on October 9, the same day that DI revealed that ICANN Global Domains Division president Akram Atallah had been hired by Donuts as its new CEO.
A recording of the 32-minute hearing can be viewed on YouTube here or embedded below.

Comment Tagged: .web, auction, cep, donuts, ICANN, irp, last resort, lawsuit, ndc, new gTLDs, nu dot co, ruby glen, verisign

ICANN says it can spend quarter-billion-dollar auction fund however it likes

ICANN can tap into its $236 million new gTLD auction fund whenever it wants, and there’s nothing the community can do about it, according to its board of directors.
The board this week said it has a “legal and fiduciary responsibility” over the money, and would be obliged to spend the cash to meet ICANN’s obligations if it ever needed to.
The statement came in a letter to the leaders of a community working group that this week published a set of preliminary recommendations (pdf) for how the money should be distributed.
The group — a cross-community working group or CCWG — laid out a few options for how the money should be administered, either by ICANN alone or in conjunction with a charitable third party, and distributed.
The money was collected from new gTLD applicants that participated in ICANN’s “last-resort” auctions to settle their contention sets. Over half of the money came from Verisign’s winning bid for .web, which is still being contested.
The CCWG said that the money should be used to:

• Benefit the development, distribution, evolution and structures/projects that support the Internet’s unique identifier systems;
• Benefit capacity building and underserved populations, and;
• Benefit the open and interoperable Internet

But the CCWG could not agree among itself whether ICANN Org or community groups such as the GNSO or GAC should be able to grab some of the cash, which is currently held in a special fund, separated from ICANN’s operational budget.
The group asked the board for its opinion, and the board responded (pdf):

ICANN maintains legal and fiduciary responsibility over the funds, and the directors and officers have an obligation to protect the organization through the use of available resources. In such a case, while ICANN would not be required to apply for the proceeds, the directors and officers would have a fiduciary obligation to use the funds to meet the organization’s obligations.

In other words: it doesn’t matter what rules you put in place, it’s our money and we’re duty-bound to spend it if we have to.
The board added, however, that ICANN Org “currently does not foresee a situation where it would need to apply for the proceeds”.
ICANN is pretty well-funded. It would have to hit hard times indeed before it needed to crack open the auction nest egg.
The board also said that supporting organizations and advisory committees would not be able to apply for funding because they’re not legal entities and wouldn’t pass the due diligence.
The CCWG’s initial report is now open for public comment until November 27.

1 Comment Tagged: auctions. last resort, ICANN, new gTLDs

Google abandons its .kid gTLD bid

Google has retreated from the interminable three-way battle for the .kids/.kid gTLDs.
The company this week withdrew its application for .kid, leaving the fight for .kids a two-horse race between Amazon and the not-for-profit DotKids Foundation.
Google’s application was intertwined with the two .kids applications due to a String Confusion Objection, which it won, drawing its bid into contention with DotKids and Amazon.
The contention set was, and arguably still is, due to be settled by an ICANN last-resort auction, but has been repeatedly postponed due to appeals to ICANN by DotKids, which doesn’t think it has the financial clout to beat its rivals.
Most recently, the auction was put on ice again after DotKids asked for ICANN money, then filed a Request for Reconsideration when ICANN refused.
Google’s .kid application had proposed an area for “kid-friendly content”. Registrants would have been vetted in advance of their domains going live to ensure they were established providers of such content.

Comment Tagged: .kid, .kids, amazon, dotkids, google, new gTLDs, string confusion objection, withdrawal

ICANN number two Atallah is new CEO of Donuts

Akram Atallah, head of ICANN’s Global Domains Division, has quit and joined Donuts as its new CEO, DI has learned.
According to multiple sources, Atallah’s last day at ICANN was yesterday.
While neither company has announced the move yet, I gather that ICANN staff were informed by CEO Goran Marby today.
The news comes just a month after private equity firm Abry Partners, which counts former ICANN CEO Fadi Chehade among its partners, acquired Donuts for an undisclosed sum.
While the revolving door between industry and ICANN is pretty much continuous, Atallah is probably the highest-profile example since Kurt Pritz in 2012 and Peter Dengate Thrush in 2011.
As head of ICANN GDD, he was responsible for all things gTLD. Before the creation of the role, he was COO.
He was also interim president and CEO of the organization on two occasions, keeping the seat warm prior to the arrival of Chehade and Marby,
Atallah and Chehade also worked together in their pre-ICANN days in the software industry.
Donuts is of course the largest new gTLD registry in terms of TLDs, with 241 in its stable.
I’ve no word yet on where Bruce Jaffe, Donuts’ current CEO, is going, but I’ll update this post when I do.
Jaffe joined Donuts as chief a little over a year ago, replacing founder Paul Stahura.
Presumably, Jaffe was the turnaround guy and with Donuts’ acquisition secured the new owners figured it was time to hire an ops guy.
UPDATE 2022 UTC: Donuts just issued a press release in which it said that Jaffe will remain a senior adviser during the transition. It also said that Atallah starts in his new job November 12.
UPDATE October 10: ICANN said in a statement overnight that VP of DNS industry engagement Cyrus Namazi will head GDD on an interim basis, with support from CTO David Conrad.

6 Comments Tagged: donuts, ICANN, new gTLDs

ICANN blocks .islam after government veto

After six years, ICANN has finally killed off the applications for the new gTLDs .islam and .halal, due to objections from several governments.
It has also rejected the application for .persiangulf from the same applicant.
The decisions were made by the ICANN board of directors last Wednesday. The resolutions were published Friday night.
The board said: “it is apparent that the vast majority of the Muslim community (more than 1.6 billion members) object to the applications for .HALAL and .ISLAM.”
This actually means that the Organization of Islamic Cooperation, the 57-nation treaty group with a combined 1.6 billion nominal Muslim citizens, objected to the applications.
Several governments with large Muslim populations — including the UAE, Malaysia, Turkey, India and Iran — had also individually told ICANN on the record that they were not happy.
The view from these governments seemed to be that if there’s going to be a .islam, it should be run under the umbrella of a group such as the OIC, rather than some random tuppenny ha’penny gTLD registry.
In Christianity, the comparable gTLD .catholic is run by an affiliate of the world’s oldest pedophile ring, while .bible is being run as a propaganda tool by a group of sexually repressed, homophobic American evangelicals.
The ICANN board said its decision to reject .islam and .halal was in tune with its “core values” to protect the “public interest”.
The decision was based “on its consideration of and commitment to ICANN’s Mission and core values set forth in the Bylaws, including ensuring that this decision is in the best interest of the Internet community and that it respects the concerns raised by the majority of the community most impacted by the proposed .HALAL and .ISLAM gTLDs”.
It’s been avoiding making this decision since at least December 2013.
But it has now voted that the two applications “should not proceed”. It does not appear to have banned organizations from applying for the strings in subsequent application rounds.
The applicant for .islam and .halal was Turkey-based Asia Green IT System. It applications have been “on-hold” since the GAC issued non-consensus advice against them back in April 2013.
The OIC filed Community Objections against both gTLDs with the International Chamber of Commerce, but failed on both counts.
Having failed to see any progress, in December 2015, AGIT filed an Independent Review Process appeal against its treatment by ICANN, and won.
The November 2017 IRP decision held that the “on-hold” status was a “new policy”, unilaterally put in place by ICANN Org, that unfairly condemned AGIT’s applications to indefinite limbo.
The panel ordered ICANN to make its damn mind up one way or the other and pay about $270,000 in costs.
While rejecting the applications may not seem unreasonable, it’s an important example of a minority group of governments getting an essential veto over a gTLD.
Under the rules of the 2012 application round, consensus GAC advice against an application is enough to kill it stone dead.
But the GAC had merely said (pdf):

The GAC recognizes that Religious terms are sensitive issues. Some GAC members have raised sensitivities on the applications that relate to Islamic terms, specifically .islam and .halal. The GAC members concerned have noted that the applications for .islam and .halal lack community involvement and support. It is the view of these GAC members that these applications should not proceed.

That’s non-consensus advice, which is expected to initiate bilateral engagement with ICANN’s board before a decision is made.
In the case of .persiangulf, also applied for by AGIT and also now rejected, the GAC didn’t even give non-consensus advice.
In fact, in its July 2013 Durban communique (pdf) is explicitly stated it “does not object to them proceeding”.
This appears to have been a not atypical GAC screw-up. The minutes of the Durban meeting, published months later, showed that the Gulf Cooperation Council states had in fact objected — there’s a bit of a dispute in that part of the world about whether it’s the “Persian Gulf” or “Arabian Gulf” — so the GAC would have been within its rights to publish non-consensus advice.
This all came out when the GCC filed its own IRP against ICANN, which it won.
The IRP panel in that case ordered ICANN to outright reject .persiangulf. Two years later, it now has.
While the three gTLDs in question are now going into “Will Not Proceed” status, that may not be the end of the story. One “Will Not Proceed” applicant, DotConnectAfrica, has taken ICANN to court in the US over its .africa application.

21 Comments Tagged: .halal, .islam, .persiangulf, agit, asia green it system, gac, gcc, ICANN, new gTLDs, oic

Nominet to donate over $260,000 to Children In Need

UK ccTLD registry Nominet said today that it will donate £1 ($1.31) for every domain registered to the charity Children In Need.
The initiative, which runs from today until November 19, is being backed up with a £200,000 ($261,000) minimum donation commitment.
Every paid-for domain in .co.uk, .uk, .me.uk and .org.uk will count.
The .uk space typically has been doing about 125,000 to 130,000 new regs per month recently, across all subdomains and direct .uk, so we’re looking at a potentially substantial donation here.
The money raised will help fund technology-related youth projects across the UK, Nominet said.
Judging by today’s press release, non-profit Nominet is calling itself a “profit with a purpose” company nowadays.
Children In Need is a charity run by the BBC. It broadcasts a fundraising telethon every year, typically raising tens of millions of pounds.
This year’s show is being broadcast November 16.

3 Comments Tagged: .uk, children in need, nominet

CentralNic buys .fans for peanuts

CentralNic has acquired the flailing new gTLD .fans for an undisclosed sum.
The value of the deal was low enough that publicly traded CentralNic was not obliged to disclose the purchase to the market, CEO Ben Crawford confirmed.
The ICANN contract seems to have changed hands — transferred to a CentralNic subsidiary call Fans TLD Ltd — back in August.
We revealed back in May that CentralNic was acting as a caretaker for .fans, and sister TLD .fan, after original registry Asiamix Digital failed to make enough money to keep the business going.
.fan, which Asiamix bought from Donuts but never launched, was sold back to Donuts in June.
Donuts took .fan to sunrise last week and plans to take it to general availability in December.
.fans domains, meanwhile, have been in registrar storefronts since 2015, but the current tally of registered domains is barely above 1,600.
Domains are still selling for around the $100 mark, roughly double the expected retail price of .fan.

Comment Tagged: .fan, .fans, acquisition, asiamix, centralnic, donuts, ICANN, new gTLDs

Is auDA’s new marketing windfall working?

Australian ccTLD .au appears to be growing at a faster rate after registry auDA cut its wholesale prices and devoted millions of dollars to marketing.
While the numbers are by no means conclusive, in the three months after the new business model came into effect .au grew almost twice as much as in the comparable year-ago period.
At the end of June, auDA switch its back-end registry from Neustar to Afilias.
It cut its wholesale price by 10% and said it would invest AUD 8 million ($5.7 million) over four years into a marketing and innovation fund.
The fund offers financial incentives to registrars and resellers that promote .au domains.
Growing .au’s market share is one of the defined objectives of the program, and stats collected by DI show it might be working.
In the three months between June 28 (two days before the transition to Afilias) and September 28, the number of reported .au domains went up from 3,153,432 to 3,163,998, an increase of 10,566 domains.
In the immediately prior three months, registered domains actually declined by 1,150.
In the same period June-September period of 2017, domains were up by 5,734, about half the level of this year.
So is the new regime succeeding in growing numbers more rapidly? Maybe. It’s probably too early to tell for sure.
Any increase in DUM could be offset by declines from domain investors, if a proposed policy change about who is allowed to register domains comes into effect.
The numbers above have two caveats: 1) they’re based on the running total published more or less live on auDA’s web site, so should be considered ball-park as they may have been collected at different times during the day, and 2) it’s possible that Afilias and Neustar report numbers from their back-ends differently, which might mean comparisons of numbers reported before and after the transition are unfair.

Comment Tagged: .au, afilias, auda, neustar

Google adds censorship workaround to Android devices

Google is using experimental DNS to help people in censorious regimes access blocked web sites.
Alphabet sister company Jigsaw this week released an Android app called Intra, which enables users to tunnel their DNS queries over HTTPS to compatible servers, avoiding common types of on-the-wire manipulation.
The company reportedly says it has been testing the app with Venezuelan dissidents recently.
The feature will also be built in to the next version of Android — known as Android 9 or Android Pie — where it will be called Private DNS.
The app is designed for people who for one reason or another are unable to update their device’s OS.
Intra and Private DNS use “DNS over HTTPS”, an emerging protocol Google and others have been working on for a while.
As it’s non-standard, end users will have to configure their devices or Intra apps to use a DoH-compatible DNS server. The public DNS services operated by Google (8.8.8.8) and Cloudflare (1.1.1.1) are both currently compatible.
The release comes even as Google faces controversy for allegedly kowtowing to the Chinese government’s demands for censored search and news results.
You may notice that the new app is being marketed via a .org web site, rather than Google’s own .app gTLD, but intra.app takes visitors directly to the Intra page on the Google Play store.

Comment Tagged: alphabet, censorship, cloudflare, dns, dns over https, google, intra, jigsaw