ICANN to mull bulk registration ban

ICANN policymakers are to take a look at banning bulk domain registrations in ongoing efforts to combat DNS abuse.

While in the very early stages of discussion, the GNSO Council is being urged to start gathering data “to further explore the role that bulk registrations play in DNS Abuse” and “to consider whether further action on bulk registrations is deemed necessary”

The recommendation is among several in a newly published report of a cross-constituency GNSO “small team”, which may lead to “tightly focused and scoped policy development”.

While acknowledging “there are also examples in which bulk registrations are used for legitimate purposes”, the report states:

The small team recommends that the GNSO Council requests the Registrar Stakeholder Group and others (for example, ICANN org, the RySG and the DNSAI) to further explore the role that bulk registrations play in DNS Abuse as well as measures that Registrars may have already put in place to address this vector. Based on the feedback received, the GNSO Council will consider whether further action on bulk registrations is deemed necessary.

The report is to be considered later this month at the GNSO Council’s monthly meeting. Any actual policy outcome, if any, will be years away.

.com and .net are the drag factor on domain industry growth

Verisign’s own gTLDs .com and .net slowed overall domain industry volume growth in the second quarter, according to its latest Domain Name Industry Brief.

June ended with 351.5 million registrations across all TLDs, up 1 million sequentially and 10.4 million year-over-year.

Growth would have been slightly better without the drag factor of .com and .net, which were down 200,000 domains each sequentially, as Verisign previously reported in its Q2 financial results. There were 161.1 million names in .com and 13.2 million in .net.

The ccTLD world grew by 700,000 names sequentially and 2.6 million compared to a year earlier, the DNIB states.

New gTLD names were up by the same amount sequentially and 4.1 million year over year, ending the quarter at 27 million.

It’s ICANN versus the blockchain in Kuala Lumpur

Internet fragmentation and the rise of blockchain-based naming systems were firmly on the agenda at ICANN 75 in Kuala Lumpur today, with two sessions exploring the topic and ICANN’s CTO at one point delivering a brutal gotcha to a lead blockchain developer.

Luc van Kampen, head of developer relations at Ethereum Name Service, joined a panel entitled Emerging Identifier Technologies, to talk up the benefits of ENS.

He did a pretty good job, I thought, delivering one of the clearest and most concise explanations of ENS I’ve heard to date.

He used as an example ICANN’s various handles across various social media platforms — which are generally different depending on the platform, because ICANN was late to the party registering its name — to demonstrate the value of having a single ENS name, associated with a cryptographic key, that can be used to securely identify a user across the internet.

Passive aggressive? Maybe. But it got his point across.

“We at ENS envisage a world where everyone can use their domain as a universal identifier,” he said. Currently, 600,000 users have registered 2.4 million .eth domains, and over 1,000 web sites support it, he said.

He described how ENS allows decentralized web sites, is managed by a decentralized autonomous organization (DAO) and funded by the $5 annual fee for each .eth name that is sold.

Van Kampen had ready responses to questions about how it would be feasible for ENS to apply to ICANN to run .eth in the consensus root in the next new gTLD application round, suggesting that it’s something ENS is thinking about in detail.

While not confirming that ENS will apply, he described how a gateway or bridge between the Ethereum blockchain and the ICANN root would be required to allow ENS to meet contractual requirements such as zone file escrow.

What did not come up is the fact the the string “eth” is likely to be reserved as the three-character code for Ethiopia. If the next round has the same terms as the 2012 round, .eth will not even enter full evaluation.

But the real gotcha came when ICANN CTO John Crain, after acknowledging the technology is “really cool”, came to ask a question.

“What kind of safeguards and norms are you putting in place regarding misbehavior and harm with these names?” Crain asked.

Van Kampen replied: “Under the current implementation of the Ethereum Name Service and the extensions that implement us and the integrations we have, domains are unable to be revoked under any circumstances.”

“So if I understand correctly, under the current solution, if I’m a criminal and I register a name in your space, I’m pretty secure today,” Crain asked. “I’m not going to lose my name?”

Van Kampen replied: “Under the current system, everything under the Ethereum Name Service and everything registered via us with the .eth TLD are completely censorship resistant.”

Herein lies one of the biggest barriers to mainstream adoption of blockchain-based alt-roots. Who’s going to want to be associated with a system that permits malware, phishing, dangerous fake pharma and child sexual abuse material? Who wants to be known as the maker of the “kiddy porn browser”?

If I were Crain I’d be feeling pretty smug after that exchange.

That’s not to say that ICANN put in a wholly reassuring performance today.

Technologist Alain Durand preceded van Kampen with a presentation pointing out the substantial problems with name collisions that could be caused by blockchain-based alt-roots, not only between the alt-root and the ICANN root, but also between different alt-roots.

It’s a position he outlined in a paper earlier this year, but this time it was supplemented with slides outlining a hypothetical conversation between two internet users slowly coming to the realization that different namespaces are not compatible, and that the ex-boyfriend of “Sally” has registered a name that collides with current boyfriend “John”.

It’s meant to be cute, but some of the terminology used made me cringe, particularly when one of the slides was tweeted out of context by ICANN’s official Twitter account.

To learn more about alternative naming systems, read #ICANN's OCTO publication >> https://t.co/LFYjy1KX3w | Emerging Identifier Technologies #ICANN75 pic.twitter.com/mWN7fCc7eR

— ICANN (@ICANN) September 21, 2022

Maybe I’m reading too much into this, but it strikes me as poor optics for ICANN, an organization lest we forget specifically created to introduce competition to the domain name market, to say stuff like “Market, you are a monster!”.

I’m also wondering whether “icannTLD” is terminology that plays into the alt-root narrative that ICANN is the Evil Overlord of internet naming. It does not, after all, actually run any TLDs (except .int).

The language used to discuss alt-roots came under focus earlier in the day in a session titled Internet Fragmentation, the DNS, and ICANN, which touched on blockchain alt-roots while not being wholly focused on it.

Ram Mohan, chief strategy officer of Identity Digital and member of ICANN’s Security and Stability Advisory Committee, while warning against ICANN taking a reflexively us-versus-them stance on new naming systems, wondered whether phrases such as “domain name” and “TLD” are “terms of art” that should be only used to refer to names that use the consensus ICANN-overseen DNS.

We ought to have a conversation about “What is a TLD”? Is a TLD something that is in the IANA root? Is a domain name an identifier that is a part of that root system? i think we ought to have that conversation because the place where I worry about is you have other technologies in other areas that come and appropriate the syntax, the nomenclature, the context that all of us have worked very hard to build credibility in… What happens if that terminology gets taken over, diluted, and there are failures in that system? … The end user doesn’t really care whether [a domain] is part of the DNS or not part of the DNS, they just say “My domain name stopped working”, when it may not actually be a quote-unquote “domain name”.

Food for thought.

Radix premium revenue hits $3.8 million in first half

New gTLD portfolio registry Radix this week gave its twice-yearly premium domain sales report, declaring first-half revenue of $3.8 million.

That figure includes $2.5 million in renewal revenue from premium-priced names, because Radix charges premium renewal fees.

For Radix, premiums sold through the registrar channel are arranged into eight tiers from $100 to $10,000 a year. While there were eight sales at the top end, most sales were concentrated in the $500-and-below tiers.

The average first-year revenue was $558 per domain.

There were 1,767 premiums sold across the stable of 10 gTLDs, compared to 1,378 in the second half of 2021 and 1,436 in H1 2021.

.tech is the highest-performing, with $643,825 of recurring retail renewal revenue reported.

.xyz kicks France out of the top 10 TLDs — Verisign

Verisign is reporting that the total number of registered domains worldwide topped 350 million in the first quarter, under its new reporting methodology.

The company’s latest Domain Name Industry Brief states that there were 350.5 million names across (almost) all TLDs, up by 8.8 million or 2.6% compared to the end of 2021 or 13.2 million (3.9%).

It’s sequential growth well beyond the 3.3 million increase reported in Q4, but the first quarter of any year is usually seasonally strong.

It’s the second DNIB that excludes Freenom’s collection of free TLDs, notably .tk, making comparisons beyond what Verisign itself calculates challenging.

Verisign’s own .com was up from 160 million to 161.3 million domains over the period, while .net was flat at 13.4 million.

Total ccTLD names were up 6 million or 4.7% sequentially to 133.4 million and up 3.1 million or 2.4% year over year.

The top 10 TLDs saw a new entry, with XYZ.com’s .xyz taking the tenth position with 4 million names, kicking out French ccTLD .fr, which has 3.9 million.

Another single-TLD brand protection service planned

BestTLD is planning to introduce a trademark-blocking service covering its single new gTLD, .best.

The company has asked ICANN for permission to launch what it calls the Best Protection service, which would provide domain blocks in lieu of defensive registrations in .best.

The service is similar to Donuts’ Domain Protected Marks List and other industry offerings, but is perhaps most comparable to the Trademark Sentry offering .CLUB Domains came up with a few years ago.

While DPML lets brands block their marks as domains across Donuts’ entire stable of almost 300 TLDs, BestTLD’s offering, like .CLUB’s, focuses instead on blocking marks as a substring in a single TLD.

In other words, Facebook could subscribe to the service for the string “facebook” and it would block domains such as “facebook-login.best”.

A good thing about such services from a registry’s perspective is that, unlike domains, the same string can be sold multiple times to different owners of the same trademarked string.

The registry has filed a Registry Services Evaluation Process request with ICANN and said it is ready to launch with back-end provider CentralNic whenever it gets approval.

Pricing was not disclosed, but if .CLUB’s $2,000 tag is any guide one might expect a super-premium fee.

Regular .best domains sell for about $20 a year and over 30,000 have been registered to date.

Three gTLDs to lose Donuts trademark protection

Three gTLDs are set to lose the trademark protection coverage at the end of the month, following their sale from Donuts to Public Interest Registry.

As noted by corporate registrar Com Laude recently, .charity, .gives and .foundation will no longer fall under Donuts’ Domain Protected Marks List service as of June 1.

DPML is a blocking services whereby the registry reserves trademarked strings across its whole portfolio of almost 300 gTLDs in exchange for a fee that is a big discount on defensive registrations.

gTLDs not in the portfolio will naturally enough no longer qualify, but Com Laude reported that existing subscriptions will be honored and PIR will offer DPML users the chance to change to a full registration.

Donuts announced the sale of the three TLDs to PIR last December.

PIR doesn’t have its own DPML equivalent. Its portfolio is small and its biggest deal is .org, where the defensive blocking horse bolted decades ago.

Verisign wipes free TLDs from the world stats

The number of domain names registered globally dropped by over 25 million in the first quarter, but only because Verisign has stopped tracking .tk and its free sister ccTLDs in its quarterly estimates.

The latest Domain Name Industry Brief says that 2021 ended with 341.7 million registrations across all TLDs, substantially fewer that the 367.3 million it reported at the end of the third quarter.

But this is only because Verisign has decided to no longer count the six Pacific and African ccTLDs managed by Freenom, notably .tk, which had contributed 24.7 million names to the Q3 tally.

The report says: “the .tk, .cf, .ga, .gq and .ml ccTLDs have been excluded from all applicable calculations, due to an unexplained change in estimates for the .tk zone size and lack of verification from the registry operator for these TLDs.”

It sounds rather like there’s been another weird fluctuation in .tk’s numbers that threw off the overall trend picture again, and Verisign’s basically said “to hell with it” and decided to exclude Freenom from its reports from now on.

This means the normalized numbers for Q4 2021 — ignoring Freenom in all applicable quarters — are 341.7 million, up 3.3 million or 1.0% sequentially and up 1.6 million or 0.5% year over year, the DNIB states.

The Freenom business model is to give domains away for free, mostly, in the first instance. It makes its money by retaining and monetizing domains that either expire or, frequently, which it suspends for abuse.

.tk domains never get deleted, in other words, so counting them alongside TLDs with the industry-standard business model could give a misleading impression of the global demand for domain names.

It’s not so much that counting spam domains is bad — every TLD has a spam problem to a greater or lesser extent — but the lack of deletions can create faulty assumptions.

It’s also never been clear how Verisign and its third-party researcher, ZookNic, acquires its data on Freenom TLDs. Its .tk figure would often remain static for quarters on end, suggesting the data was only sporadically available.

I also tracked .tk’s published numbers independently for many years, and the last figure I have, from March 2019, is 41.3 million. It’s never been clear to me why the Verisign/ZookNic number has always been so much lower.

Verisign has always flagged up any oddities caused by .tk in its DNIB, and every edition has contained a footnote describing Freenom’s unusual practices.

The latest DNIB (pdf) says that .com had 160 million names, up 1.2 million, and .net had 13.4 million, down about 100,000, compared to Q3.

ccTLDs overall had 127.4 million, up about 700,000, a 0.6% sequential increase.

The ccTLD number was down by 5.3 million, or 4.0%, compared to the end of 2020, but that was due to a 9.4 million-name deletion by China’s .cn, which I noted in the second quarter and which Verisign calls a “registry-implemented zone reduction”.

Ignoring China, ccTLD names were up 4.1 million or 3.8%, the DNIB says.

Verisign only breaks out the top 10 ccTLDs separately, so the removal of .tk means that Australia’s .au is now in the top 10 list in tenth place with 3.4 million at the end of Q4. It will likely move up the ranks in the first quarter due to the release of second-level names, which has sped up its growth rate.

France’s .fr, with 3.9 million names, has now entered the overall top 10 TLDs due to .tk’s removal.

New gTLDs grew by 1.2 million names or 5.1% sequentially, but were down by pretty much the same amount annually, ending 2021 with 24.7 million names.

TMCH turning off some brand-blocking services

The Trademark Clearinghouse is closing down two of its brand protection services after apparently failing to attract and retain registry partners.

The company announced recently that TREx, its Trademark Registry Exchange, will shut down after its customers’ existing subscriptions expire, saying:

The communication that we receive from our agents, resellers, clients and other registries that we have reached out to around improving the product shows that there is currently little appetite for such a service.

TMCH said it may revive the service after the new round of new gTLDs happens.

TREx was a service similar to Donuts’ Domain Protected Marks List and others, whereby trademark owners can block their brands across a multitude of TLDs for a substantial discount on the cost of defensive registrations.

But the TMCH offering was not restricted to one registry’s portfolio. Rather, it consolidated TLDs from multiple smaller operators, including at least one ccTLD — .de — into one service.

It seems to have peaked at 43 TLDs, but lost three when XYZ.com pulled out a couple years ago.

Its biggest partner was MMX, which sold its 22 gTLDs to GoDaddy Registry last year. I’d be very surprised if this consolidation was not a big factor in the decision to wind down TREx.

I’d also be surprised if we don’t see a DPML-like service from GoDaddy before long. It already operates AdultBlock on its four porn-themed gTLDs.

The news follows the announcement late last year that TMCH will also close down its BrandPulse service, which notified clients when domains similar to their brands were registered in any TLD, when its existing subscriptions expire.

Both services leveraged TMCH’s contractual relationship with ICANN, under which it provides functions supporting mandatory rights protection mechanisms under the new gTLD program rules, but neither are ICANN-mandated services.

ICANN accidentally summons Lesser Old One in DNSSEC snafu

Southern California has come under the control of timeless demonic entities, plunging the Greater Los Angeles Area into a thousand years of darkness and torment, after a DNSSEC misconfiguration led to ICANN accidentally summoning a Lesser Old One into the mortal realm.

“I can confirm that there was an RRSIG glitch during the ceremony to sign the root zone ZSK for 2022Q2 and introduce HSM6W at our secure facility in El Segundo, California, today,” an ICANN spokesperson said.

“A downstream KSK misconfiguration was inadvertently introduced into the IMRS, resulting in a cascading Trust Anchor collapse across the entire constellation,” he said.

“This unfortunately led to the opening of a transdimensional portal to the Lost City of R’lyeh and the manifestation of an entity our initial analysis indicates may be Baoht Z’uqqa-Mogg, High Commander of the Armies of the Damned and celestial envoy for the mighty Cthulhu,” he added.

“And for some reason Facebook is down in Denver; we’re looking into that too,” the spokesperson said.

ICANN’s Seven Secret DNSSEC Key Holders were observed fleeing from the data center where the signing ceremony had been taking place, casting aside their cowls and robes and clawing at their eyes and skin, according to local reports.

They were pursued by a wailing, forty-foot-tall scorpion-faced lizard monster, emerging from a blinding disc of purple hellfire and bent on subjugating the human race to millennia of torment, local TV station Fox Action 5 Shooty Shooty Bang Bang News reported from the scene, shortly before its news chopper was plucked from the sky by a blistered tentacle and tossed into Z’uqqa-Mogg’s slavering, beak-like mandibles.

The entity was then seen slamming its cloven hoof into the ground and performing an obscene incantation, opening a rift through which poured a horde of bloodthirsty, crab-headed minions that proceeded to swarm through the streets of LA, devouring all in their path.

“This is the one thing we hoped would not happen,” the ICANN spokesperson admitted.

In response to the crisis, which has so far resulted in the deaths of millions and the enslavement into madness of half the US west coast, ICANN’s Security and Stability Advisory Committee has formed an ad-hoc working group to devise possible strategies to banish the Old One to its cthonic netherworld.

It’s planning to deliver an initial draft of its report no later than September 2023, after which its work will be opened to the Whatever’s-Left-Of-The-Public Comment process.