Whois officially died today

Domain registries and registrars are no longer obliged to offer Whois services as of today, the deadline ICANN set for formally sunsetting the protocol.

It’s been replaced by RDAP, the newer Registration Data Access Protocol, which offers a more structured way to deliver domain ownership information.

Under ICANN’s standard Registry Agreement and Registrar Accreditation Agreement, January 28 marks the end of the RDAP “ramp up period” and the moment Whois becomes purely optional.

I expect many registrars will offer Whois and RDAP in parallel for a while, so ingrained in internet architecture is the older protocol. Likewise, the term “Whois” will likely be used colloquially to refer to RDAP for some time.

The data delivered by RDAP is not substantially different to that delivered by Whois, and those who access Whois via a web interface, such as ICANN’s lookup.icann.org, probably won’t notice any difference.

The main headaches will likely be experienced by those using custom software to access Whois over port 43, who may find they have to tweak their code to parse incoming RDAP responses instead.

Importantly, the switch to RDAP does not mean users will get data that was already redacted in Whois. Privacy laws such as GDPR apply equally to RDAP.

The only way to obtain private data is contacting the relevant registrar, directly or via ICANN’s Registration Data Request Service, and crossing your fingers.

Comment Tagged: ICANN, rdap, whois

Typo left MasterCard open to hackers for years

A typo in MasterCard’s DNS configuration left the company open to hackers for years, it has emerged.

As first reported by Krebs On Security, from June 2020 until this month one of az.mastercard.com’s nameservers was set as akam.ne rather that akam.net, a domain used by DNS resolution provider Akamai.

The .ne version, in Niger’s ccTLD, was unregistered until security researcher Philippe Caturegli discovered the typo and spent $300 to secure the domain and check to see how much traffic it was getting, before handing it to MasterCard.

Had Caturegli been a bad actor, he could have used the domain to set up a man-in-the-middle attack, diverting a big chunk of traffic intended for mastercard.com to the server of his choosing.

MasterCard said its systems were not at risk and the typo has been corrected, Krebs reports.

4 Comments Tagged: akamai, dns, mastercard, security

Could ICANN approve an R-word gTLD?

ICANN could be faced with the headache of approving or rejecting a new gTLD containing a term broadly considered a slur for the first time.

Unstoppable Domains has revealed that it is working with a client on an application for .retardio, which is linked to a memecoin cryptocurrency of the same name.

Unstoppable says the domain “symbolizes pride and a blend of brilliance with eccentricity”.

But the application could come up against significant challenges if it goes ahead, due to the various reviews and objection procedures all applications face.

The word “retard”, originally a medical term for people with mental disabilities, over the years morphed into a fun playground insult but is now considered offensive enough that, unless you’re Elon Musk, it’s often referred to as the “R-word”.

(I’m only typing it out in full here for the benefit of people who are reading this in their second language, who otherwise might not know what I’m talking about.)

Since 2009, the Special Olympics has held an annual Spread the Word to End the Word awareness day, which seeks to reduce usage of the word, which it describes as a form of “bullying”.

The British comedian Rosie Jones, who has cerebral palsy, faced a barrage of criticism from her own community when she provacatively titled her 2023 documentary about online ableist bullying “Am I a R*tard?” (asterisk in original).

There can be little doubt that it’s an offensive term in most of the Anglophone world, but does that mean it cannot be included in a gTLD string?

The current draft of ICANN’s Applicant Guidebook says that applicants “should be mindful of limitations to free expression” and there are multiple avenues through which a .retardio application could be killed off.

The most obvious way would be via the Governmental Advisory Committee, which has broad powers to instruct ICANN to reject applications on public policy grounds.

The AGB says the GAC Advice objection is for applications that are “problematic” or “potentially violate national law or raise sensitivities”, but that’s a pretty wide net.

If a couple of governments decided to champion an objection to .retardio, it’s easy to imagine they’d be able to rustle up enough support to meet the “consensus” threshold for formal GAC Advice.

ICANN’s board of directors is able to reject such advice, but in the 2012 application round it pretty much did what it was told.

Another way .retardio could fail is through the Limited Public Interest Objection, which can be filed against strings that are “contrary to generally accepted legal norms of morality and public order that are recognized under principles of international law”, such as:

Incitement to or promotion of discrimination based upon race, color, gender, ethnicity, religion or national origin, or other similar types of discrimination that violate generally accepted legal norms recognized under principles of international law

Literally anybody can file a LPI Objection, and they presumably could use the UN Convention on the Rights of Persons with Disabilities to tick the “principles of international law” box.

If successful, such objections force the applicant to withdraw.

The International Olympic Committee has never been shy about participating in ICANN, so if the affiliated Special Olympics, or the IOC, or indeed any disability rights advocacy groups, wanted to make a point by objecting to .retardio, the LPI Objection would be the way to do it.

2 Comments Tagged: gac, gac advice, ICANN, limited public interest objection, new gTLDs, unstoppable

These are the TLD growers and shrinkers of 2024 (part two)

Following on from the annual ccTLD growth statistics DI published last week, today we’ll look at the gTLDs, where .shop was by far the biggest volume winner and .com was by far the biggest loser.

GMO Registry’s .shop added 1,315,000 names to its zone file in 2024, ending the year with 3,470,000 domains. It’s now the second-largest of the 2012 batch of gTLDs, after .xyz.

The growth seems to have been pretty consistent across the year and is presumably due to the low first-year prices offered by many registrars. At least 10 registrars offer .shop for under a dollar currently, one as low as $0.27, though around $25 appears to be the floor for renewals.

.xyz, .lol, .bond and .sbs recorded similar growth stats, up 495,000, 487,000, 468,000 and 459,000 domains to end the year with 3,801,000, 601,000, 710,000 and 824,000 respectively.

Of the 750-odd gTLDs (excluding dot-brands) for which I have stats, only about 200 grew by more than one domain per day. About 60 grew by five-figure amounts. About 280 shrank. The rest were either still unlaunched or recorded negligible growth.

Only about 80 currently have over 50,000 names in the zones which, if the number matched domains under management, would be the threshold for triggering ICANN’s per-transaction fees.

At the other end of the table, .com was by far the biggest volume loser, down 3,769,000 zone file domains to end the period at 153,856,000. Verisign has blamed economic factors in China and price increases at American registrars for the decline. Verisign’s .net lost 424,000 names to end with 12,485,000.

ShortDot’s .cfd, a stable sister to .sbs and .bond at the top end of the table, lost over three quarters of its domains over the course of the year, ending December down 782,000 at 238,000 names, showing that domains sold for pennies tend not to stick around very long.

The next five shrinkers were .click, .space, .buzz, .live and .bio, which were down 94,000, 72,000, 43,000, 41,000 and 30,000 to end the year with 471,000, 310,000, 316,000, 545,000 and 48,000 domains respectively.

.social, .gay, .win, .mobi, .monster, .website and .biz all saw declines in the low five figures in the period.

Figures in this article are sourced from domain counts in zone files collected on January 1 2024 and 2025, rounded to the nearest thousand.

Comment Tagged: new gTLDs, stats

GoDaddy ordered to stop lying about crappy security

GoDaddy has agreed to roll out some pretty basic security measures and has been told to stop lying about how secure its hosting is, under an agreement with US regulators.

It turns out that the company, while claiming that security “was at the core of everything we do”, was failing to do some pretty basic stuff like installing software patches, retiring end-of-life servers, or securing internet-facing APIs.

Its settlement with the Federal Trade Commission finds that GoDaddy engaged in “false or misleading” advertising and orders that it “must not misrepresent in any manner” its security profile in future.

The FTC complaint (pdf), filed in 2023 after reports of mass hacking incidents, states:

Despite its representations, GoDaddy was blind to vulnerabilities and threats in its hosting environment. Since 2018, GoDaddy has violated Section 5 of the FTC Act by failing to implement standard security tools and practices to protect the environment where it hosts customers’ websites and data, and to monitor it for security threats.

The complaint says that GoDaddy had a slack patching regime that was left up to individual product teams to execute, with no centralized management.

This meant thousands of boxes in its Shared Hosting environment were subject to critical vulnerabilities that allowed bad guys to get in and steal data such as user credentials and credit card info for months.

The complaint also describes a custom internet-facing API designed to enable customer support staff to access details about managed WordPress users, such as login credentials.

This API was apparently open to the internet, unfirewalled, used plaintext for credentials, and had no multi-factor authentication in place, again enabling hackers to steal data.

One or more “threat actors” abused this lax security to pwn tens of thousands of servers between October 2019 and December 2022, according to the complaint.

The settlement (pdf), in which GoDaddy does not admit or deny any wrongdoing, does not come with an associated fine.

Instead, GoDaddy has agreed to a fairly extensive list of requirements designed to increase the security of its hosting services.

Comment Tagged: ftc, godaddy, security

These are the TLD growers and shrinkers of 2024 (part one)

With all the excitement and concern surrounding the rise of artificial intelligence, the smart money might have been on .ai being the fastest-growing ccTLD in 2024. It wasn’t.

That honor instead goes to Russia’s .ru, which grew by the largest number of domains last year of any of the ccTLDs that have so far published statistics.

.ru grew by almost 388,000 domains to end the year at around 5,817,000, according to the registry. The matching Cyrillic ccTLD, .РФ, declined a little from 768,000 domains to 760,000.

Anguilla’s .ai, currently being re-homed on an Identity Digital back-end grew by just over 244,000 domains between late December 2023 and January 2 2025, according to registry stats.

After Russia, Indonesian ccTLD .id added the most domains in 2024, growing by almost 289,000 and breaking into seven figures in November to end the year with about 1,215,000 names.

Turkiye’s .tr is next on the list. Its second-level liberalization saw a sharp increase in registrations mid-year, and it ended the year with 1.283.000 names, up 271,000 over the period.

Portugal and Brazil (.pt and .br) are the only other two ccTLDs to report six-figure increases so far, with growth of 149,000 and 134,000 to 1,930,000 and 5,372,000 domains respectively.

.fr (France), .ir (Iran), .pl (Poland), .de (Germany), .my (Malaysia), .ca (Canada), .vn (Vietnam), .jp (Japan), .cz (Czechia) and .hu (Hungary) all reported growth measured in the five digits for the year.

At the other end of the table, the UK saw the biggest shrinkage in terms of registered domains in 2024, with .uk (second and third levels combined) down about 472,000 to end December at 10,261,000 domains.

The decline was primarily at the third level (such as the popular .co.uk), which lost 371,000 names compared to 100,000 at the second level. The third-level total is now 8,967,852 — below nine million for the first time in 15 years.

The ccTLD reporting the second-biggest loss was .nl, which lost 106,000 names to end the year with 6,192,000. The TLD has been on a downwards trajectory since its peak of 6.3 million domains in mid-2023.

Ukraine’s up next, reporting a 57,000-name decline to 458,000 at the end of December. Much as it’s hard to not speculate that international sanctions are behind the rise of .ru, one wonders whether the ongoing Russian invasion is not behind the decline of .ua. Entrepreneurial-aged men have more existential concerns right now.

.ar (Argentina), .dk (Denmark), .kr (South Korea), .at (Austria), .se (Sweden), .eu (European Union), .be (Belgium) and .nu (Niue, mainly sold in Sweden) all saw five-figure declines in their reg totals over the year.

.hk (Hong Kong), .cl (Chile), .it (Italy), .il (Israel), .mx (Mexico) and .ie (Ireland) all also saw modest dips in their totals.

About three quarters of the ccTLDs for which I have data were up in the year, with the rest going down.

I should note that this prose league table cannot be considered comprehensive. Many ccTLD registries with substantial DUM (eg China, the US) will not report their year-end numbers for months and others (eg .tv, .co, .in, .me) typically do not report numbers at all.

In addition, strict apples-to-apples comparisons between ccTLDs may not be fair, given the differing ways registries calculate their totals.

1 Comment Tagged: cctlds

Dead terrorist domains for sale, just without the hyphens

People are trying to make a quick buck flogging domains matching the names of suspects in recent terrorist atrocities, but they’re stopping short of including the hyphens.

The 2024 Christmas-New Year period was marked by two vehicular terrorist incidents on either side of the Atlantic: the Christmas market attack in Magdeburg, Germany on December 20 and the Bourbon Street attack in New Orleans, Louisiana in the early hours of January 1.

In both cases, domains (almost) matching the names of the alleged attackers were registered within minutes of their identities being revealed.

The suspect in the New Orleans ramming attack, who was shot dead by police, has been named by authorities as Shamsud-Din Jabbar, and the .com matching his name was registered even before it was officially announced.

It seems reporters at NOLA.com were the first to reveal his identity, at around 1700 UTC yesterday, and shamsuddinjabbar.com was registered at 1720 UTC, some time before the news conference where he was officially named.

The more correct spelling, shamsud-dinjabbar.com, has not been registered. Apparently, attempting to make money from an attack that killed 15 people is okay, but registering a domain containing a hyphen is a step too far.

The domain that was registered leads to a Dynadot sales lander with a $7,038.94 buy-it-now price. This converts to a round €6,800, suggesting the owner is based in the Eurozone.

The matching .net has also been registered and currently leads to a GoDaddy parking page.

The suspect in the Magdeburg attack , currently in police custody and charged with five counts of murder, was named by German authorities as Taleb A., abbreviated due to German privacy laws, just a few hours after the fact, but his full name has been widely reported as Taleb Al-Abdulmohsen.

The .com matching (almost) his name, talebalabdulmohsen.com, was registered shortly before 0500 UTC on December 21, hours before it had been reported by major news outlets’ live blogs. It’s currently parked with GoDaddy.

Again, the hyphenated version was not registered and is still available. The matching .de has not been registered.

Professional domain investors consider registering such domains for profit not only pointless but unethical. The Internet Commerce Association, which represents domainers, has in its code of conduct:

Respect for Human Suffering and Victims of Tragedy. A [ICA] member shall be respectful of persons and communities involved in tragedy. A member shall not register domains with the intent to profit from a recent tragedy.

The ICA has no policy on hyphens, to my knowledge.

Comment Tagged: terrorism

ICANN eyes more price hikes as it predicts dismal year for industry

The domain industry may not be set to shrink, but it’s not set to grow either, according to predictions in ICANN’s newest draft budget, published this week.

The Org’s bean-counters have also confirmed that the recently announced fee increases for registries, registrars and registrants may become a “repeatable” occurence.

ICANN says its budget for fiscal 2026, which starts next July, sees funding and expenditure both at $142 million, down $3 million on its adopted 2025 budget.

It’s predicting a pretty flat domain industry for FY26, with no growth in transactions from legacy gTLDs (mainly .com) and 1% growth from new gTLDs. Legacy would stay at $83.1 million and new would grow to $12 million.

ICANN reckons it will lose 17 contracted gTLD registries by the end of FY26, going from 1,109 to 1,092. It reckons it will accredit just three new registrars over the same period.

The estimates are all mid-points. ICANN has also given high and low estimates that vary from transactions growing by 9% or shrinking by as much as 14%.

The financial predictions are also probably going to get revised, as they don’t include the impact of ICANN’s planned fee increases, which have not yet been given final approval.

The Org said in October that it plans to raise the per-transaction fee for registrars, which buyers usually added on at the check-out, from $0.18 to $0.20.

The registry transaction fee will go up from $0.25 to $0.258. Fixed fees for registries and registrars will also go up.

The draft budget calls the increases “equitable, contractually efficient, pragmatic, and repeatable”.

“Inflationary increases can continue at ICANN’s discretion as contemplated by the Base gTLD Registry Agreement,” suggesting they could become an annual inflation-linked event.

The budget us currently open for public comment.

Comment Tagged: budget, ICANN

Meet the six people battling to join ICANN’s board

Candidates from Verisign, Amazon, GoDaddy, Identity Digital, Tucows, and DotAsia have put themselves forward to become the domain name industry’s next pick for the ICANN board of directors.

The GNSO Contracted Parties House — registrars and registries — are currently holding an election to pick the next occupant of board seat 13, which will be vacated by term-limited incumbent Becky Burr next year.

These elections are usually pretty secretive — not even the names of the nominees are published — but this time around I am able to name all six candidates and five of them have kindly provided DI with their candidate statements, bringing candidates’ views to a public audience for the first time.

The candidates, in alphabetical order, are:

• James Bladel, VP of government and industry affairs at GoDaddy
• Edmon Chung, CEO of DotAsia
• Greg DiBiase, senior corporate counsel at Amazon
• Keith Drazek, VP of policy and government relations at Verisign
• Reg Levy, associate general counsel at Tucows
• Jonathan Robinson, director of Identity Digital subsidiary Internet Computer Bureau

While most of the candidates work for companies that operate as both registries and registrars, each only officially votes in one of the two CPH Stakeholder Groups, as indicated by “RySG” or “RrSG”, below.

Four of the candidates come from the North America region, while Chung is from the Asia-Pacific region and Robinson is European. Burr, who they would replace, is North American.

All of the candidates have been involved with ICANN for well over a decade, some since almost its foundation. Four are former or current chairs of the GNSO Council. One up until a few weeks ago served on the ICANN board for a single term in a different capacity.

Some of the candidates’ statements focus on issues at ICANN they would like to fix, improve, or build on, while others focus more on the candidate’s personal qualities and qualifications.

James Bladel, GoDaddy, RrSG

Bladel is an ICANN veteran with 20 years of experience on various policy-making working groups and committees, including a stint as chair of the GNSO Council. He’s also sat on the boards of the .uk and .me registries.

His candidate statement lists three shortcomings he sees in ICANN’s current trajectory that he believes he could help correct.

He says ICANN “faces a crisis of credibility” due to its failure “to make timely progress on key policy initiatives” and has “fallen into endless discussions and efforts to mitigate unknown risks”.

He gives the Next Round of new gTLDs and Whois policy as examples of where ICANN has moved too slowly to implement policies.

“ICANN must stop telling the world why its role is important and start showing clear examples of multistakeholder successes,” Bladel states, warning that governments will get involved if ICANN can not prove its worth.

He adds that while he does not believe blockchain-based naming systems are viable alternatives to the DNS, ICANN should be paying more attention to how they could be complementary and looking into why there appears to be demand for them.

Bladel provided his statement (pdf).

Edmon Chung, DotAsia, RySG

Chung is a 25-year ICANN vet and has just completed a three-year term on the board, as a Nominating Committee appointee, where he regularly fielded questions related to internationalized domain names, which is one of his specialties.

Chung said he would champion efforts such as Universal Acceptance Day and the new Applicant Support Program, both of which are intended to promote the newer TLDs, particularly those in non-Latin scripts.

As CEO of DotKids, he led the only new gTLD application in the 2012 application round to qualify for the ASP.

“I believe with another term on the board, I can contribute substance to shaping the discussions on [conflicts of interest], board agility and the business of TLDs,” Chung wrote.

Chung provided his statement (pdf).

Greg DiBiase, Amazon, RrSG

Current GNSO Council chair DiBiase claims credit for helping steer the community through its negotiations with the board over new gTLD policy recommendations, which if not exactly fractious have certainly been convoluted, over the last couple years.

He says he would focus on “improving communication” between board and CPH through informal channels with the contracted parties, building on Burr’s work.

He says he would attempt to plug gaps in processes, such as the uncertainty about the board’s power to change its mind on community recommendations it has already adopted.

The board’s attitude to risk is also a concern.

“Many in the ICANN Community view ICANN Org as extremely risk-averse and willing to reject community-made policy recommendations if they increase the probability of ICANN being sued,” DiBiase wrote.

“Whether true or not, I believe ICANN should focus on bigger-picture risks, like harm to credibility… and not just specific risks like lawsuits or IRPs,” he wrote.

DiBiase has headed Amazon Registrar’s legal team for eight years and previously worked in compliance for the Endurance group of registrars (now Newfold Digital).

He provided his statement (pdf).

Keith Drazek, Verisign, RySG

Drazek has been involved with ICANN for over 20 years, according to the bio published by current employer Verisign, the company for which he has been working since 2010. Prior to Verisign, he held a similar policy relations role at Neustar.

He has been GNSO Council chair, a member of the ccNSO Council representing North America, and chair of the RySG, among other roles in important policy working groups.

Drazek has not yet responded to my inquiries and I do not have his candidate statement. I will update this article should I receive it.

Reg Levy, Tucows, RrSG

Levy presents the fact that she is not following the typical path to the board — via, for example, sitting in the GNSO Council chair or on the Nominating Committee — as a strength.

She says she would be “a strong voice for the Community” on the board, which she said has shown a “worrying trend of the Board ignoring the Community and ignoring the role of the GNSO Council”.

Levy is the only candidate to take aim at ICANN’s finances in her statement, with criticisms of how its budget has ballooned beyond the scope of most non-profits over the last couple of decades, of its costly deals with long-incumbent vendors, and of its “shocking” and “disingenuous” executive compensation practices.

Levy says that she would probably be the youngest person on the current board, which could help with “ushering in a generational shift”. As the only female candidate, who would replace a female director, she notes that she’s the only chance of maintaining the current gender balance on the board.

Tucows published Levy’s statement (pdf) on its web site a couple weeks ago.

Jonathan Robinson, Identity Digital, RySG

Robinson’s statement focuses on his extensive industry experience, which dates back to when he founded the UK-based registrar NetBenefit back in 1997, and his long-time participation in the ICANN community.

His only current paid role in the industry is as the director of Internet Computer Bureau, the .io registry and Identity Digital subsidiary.

But Robinson’s key selling point appears to be that he would quit the ICB gig should he be elected, likely freeing him up to be able to engage in board discussions about new gTLD policy and other issues affecting the domain name industry.

ICANN directors are expected to recuse themselves from discussions on issues for which they have conflicts of interest. Burr does not currently recuse herself from such votes because, while she was originally elected while working for Neustar, she no longer has ties to the industry.

Robinson provided his statement (pdf).

*

The candidates have already faced at least one round of interrogation by their voters, including at a closed-door session at ICANN 81 last month.

I’m told the first round of voting takes place this Wednesday, December 18, with a second round likely given the number of candidates. The current timetable published on the GNSO web site appears to be out of date.

The winner of the election will take over from Burr at ICANN’s 2025 Annual General Meeting next October in Muscat.

3 Comments Tagged: election, ICANN

New gTLD use cases not much use

ICANN has come in for periodic criticism over the last decade or so for not being sufficiently enthusiastic in public about its new gTLD program, but this time around it’s trying to do something about it.

New gTLD program participants have said that ICANN should have thrown more of its substantial resources into marketing the program, raising the profile of both the application period and the availability of new gTLDs when they go live.

But, under community guidance for the 2026 application window, Org started promoting the program earlier this year, with the publication of a “Next Round Champion’s Toolkit” web site containing ready-made marketing materials that consultants and gTLD service providers are free to use to reach out to their respective communities or sales prospects.

The latest component of this effort is a batch of 13 “use case” documents, each covering a specific gTLD from the 2012 round, compiled by ICANN, “each providing a compelling example of how different types of organizations use gTLDs”.

ICANN was wise to avoid calling them “case studies”. They’re pretty lightweight, with not [m]any particularly useful insights or actionable nuggets of advice. A cynic might summarize the 13 documents thus:

Hey, did you know .CEO/.SECURITY/.BANK exists? It really does! Here’s barely 500 words of elevator-pitch fluff from the registry’s PR folk, presented in the format of one of those glossy, double-sided, one-page inserts you find in a conference schwag bag and toss into your hotel room trash can unread when trying to reduce the weight of your carry-on.

Six out of the 13 use cases are generics run by XYZ Registry. Five are big-C “Community” gTLDs (including the geographic/linguistic niche offerings .gal, .lat and .bzh). Microsoft is the only dot-brand registry represented.

Notably, given how much emphasis ICANN has been putting on its goal to expand outreach efforts in under-served regions (op-eds and press releases have started popping up in places like India and Nigeria recently), there are no IDN gTLD use cases yet. And all the use cases are in English.

Still, I expect the use cases could be useful to Next Round “Champions” in some scenarios, certainly not as later-stage decision support but rather as part of an arsenal of foot-in-the-door introductory materials aimed at prospects utterly unaware that new gTLDs exist.

Comment Tagged: ICANN, new gTLDs, next round