DNSSEC claims another victim as entire TLD disappears

A country’s top-level domain disappeared from the internet for many people yesterday, apparently due to a DNSSEC key rollover gone wrong.

All domains in Fiji’s ccTLD, .fj, stopped resolving for anyone behind a strict DNSSEC resolver in the early hours of the morning UTC, afternoon local time, and stayed down for over 12 hours.

Some domains may still be affected due to caching, according to the registry and others.

The University of the South Pacific, which runs the domain, said that it had to contact ICANN’s IANA people to get the problem fixed, which took a while because it had to wait for IANA’s US-based support desk to wake up.

IANA head Kim Davies said that in fact its support runs 24/7 and in this case IANA took Fiji’s call at 2.47am local time.

Analyses on mailing lists and by Cloudflare immediately pointed to a misconfiguration in the country’s DNSSEC.

It seems Fiji rolled one of its keys for the first time and messed it up, meaning its zone was signed with a non-existent key.

Resolvers that implement DNSSEC strictly view such misconfigurations as a potential attack and nix the entire affected zone.

It happens surprisingly often, though not usually at the TLD level. That said, a similar problem hit thousands of Sweden’s .se domains, despite the registry having a decade’s more DNSSEC experience than Fiji, last month.

Domain Incite had a similar problem recently when its registrar carried on publishing DNSSEC information for the domain long after I’d stopped paying for it.

UPDATE: This post was updated with comment from IANA.

4 Comments Tagged: .fj, DNSSEC, fiji, iana, ICANN

Ukraine’s emotional plea to ICANN 73

A Ukrainian government representative has delivered a powerful speech at ICANN 73, calling on ICANN, the community, and the domain name industry to do more to help the war-ravaged country.

Speaking at the opening plenary session of ICANN’s Governmental Advisory Committee, Ukraine representative Andrii Nabok gave his personal account of coming under Russian fire at his home near Kyiv, and praised the “heroic” efforts of ISPs and local ccTLD registry Hostmaster in keeping the internet functional for many Ukrainians.

He went on to condemn the invasion in the strongest terms, calling the Russian Federation “the empire of evil, the terrorist state number one, the fascist of the 21st century”.

Nabok welcomed ICANN’s offer of $1 million to aid with connectivity, saying that Ukraine is in need of satellite terminals, but questioned ICANN’s decision to refuse the country’s request to disconnect .ru from the DNS root.

He went on to call for the domain industry to contribute to anti-Russian sanctions, and questioned whether it is still appropriate for ICANN to have a Russian as one of its DNSSEC “trusted community representative” key-holders.

His speech was followed by prepared expressions of solidarity from the UK, France, the European Union, Switzerland, Australia, the US, Canada, Burkina Faso, Argentina, and Burundi.

Russia took the floor briefly to say that it does not believe ICANN is a suitable forum to discuss “political issues”.

No government echoed Ukraine’s call for ICANN to use its DNS root management powers to sanction Russia, with most expressing support for the Org’s neutrality and the multi-stakeholder model.

I’m going to publish Nabok’s entire speech here, taken from the official transcript with only minor formatting edits. Recordings of the session can be found on its web page (registration required).

“One world, one Internet.” This slogan in our opinion is wonderful. Multistakeholder model, a community-based, consensus-driven approach to policymaking, this model is great. Ukraine admires both the slogan and this model. Ukraine believes both in this slogan and this model. The Ukrainian government showed its support for them in its numerous actions and statements before.

On February 24th at 5:00 am, my family woke up from explosions. We saw a little fire and smoke in the window. Our city near Kyiv was shelled by rockets. I cannot put into words the feeling when you have to explain to your seven-year-old daughter that we urgently need to leave home to save our lives. In a few minutes, my friends from all parts of Ukraine confirmed that there had been missile strikes in the whole country. At once, all the values you lived with yesterday cease to exist, and now the main task is to save our families, relatives, and friends.

So Russian missiles attacked Ukraine. Putin said it is a special military operation in the territory of independent country. Putin said the goal is demilitarization and denazification to ensure the security of Russia. Security of the largest country in the world with the most enormous nuclear potential seems to be defending itself against [inaudible] without nuclear weapons.

Logic has left our chat. Today is the 12th day of the war. Not some operation, but a war. A war in Europe, undeclared Russian war on Ukraine. It is the 12th day of Russian bombing in our peaceful Ukrainian cities and even villages, schools, kindergartens, maternity clinics, even nuclear stations. But Putin’s blitzkrieg became blitz failure. The whole world admires the courage of Ukrainian soldiers and civilians, on social media, in private messages, on TV. Unfortunately, thousand Ukrainians have been killed, including 38 children.

Millions of Ukrainians have been forced to leave their homes. Many of you sent us many words of support, sheltered us, and helped our army. Many thanks to you. Many of you understood that the real goal of Kremlin and Russian dictatorship is to destroy freedom, peace and human rights, right to life, right to dignity, right to freedom, and right to Internet.

Last year our team carried out a large state infrastructure project for deploying fiber optics networks in the most remote villages of our country. According to our last data, we had the highest level of coverage of high-capacity networks among all the European countries. About 97% of the Ukrainian population had the opportunity to connect to Internet based on fiber optic technologies.

Those settlements where the Russian army enters are cut off from the Internet. For example, in one of the villages where my relatives live, there are currently several thousand Russians. As soon as they captured the village, they immediately cut the optical cable and shot at the mobile operator’s base station with a machine gun. People are now cut off from the world.

Today is the 12th day of destroying Ukrainian Internet infrastructure by Russian bombs. Our heroic ISPs rebuild it under fire, risking their lives to save communications for people. Thanks to our heroic ISPs and Elon Musk’s support, people in bomb shelters still have a chance to know whether their relatives are safe or not, whether they are alive, or unfortunately, no more.

Our cybersecurity is also under threat. Thanks to heroic efforts, the .UA domain is stable. All services have been moved to backup positions and function independently from the Ukrainian infrastructure. Hostmaster LLC strengthened Anycast secondaries to prevent possible attacks on domain service.

“ICANN has been built to ensure that the Internet works, not for its coordination role to be used to stop it from working.”

I fully support these words of Göran Marby, ICANN CEO. But I would like to ask you, will it be okay for you if Internet is working for all except Ukrainians? Just because Russian assassins will kill Ukrainians. Of course, this is an apocalyptic scenario that will not be implemented. Ukrainians will not allow this. Ukraine has already received invaluable support from nearly all ICANN constituencies and at individual level. We are grateful for your help in strengthening the cybersecurity of .UA as well as other items of our critical infrastructure. We welcome the decision of ICANN Board to allocate an initial sum of 1 million US dollars to be used to provide financial assistance to support access to Internet infrastructure in emergency situations.

It will be great to spend a part of this sum to buy more Starlinks for Ukrainian Internet users. Of course, ICANN cannot close the sky over Ukraine, but I would like to ask all of you to appeal to your governments to protect Ukraine, and the infrastructure of the Internet for that matter, from the barbaric actions of Putin’s Russia. We fully support ICANN’s commitment to ensure a single and global Internet. Moreover, we have already asked to limit the Kremlin’s influence on our common free digital space since the national Russian peculiarities of Internet governance are known worldwide. Kremlin wants and will be happy to get the sovereign Internet, and they will get it by destroying “one world, one Internet” if we do not unite against such threats.

On March 11th, Russia will completely disconnect from the global Internet but the Russian representative will retain his role as one of the 12 holders of the DNSSEC root key. Are you serious? That is why we call on ICANN community, IANA, registrars and registries and the vendors who make the Internet free and available for everyone on the Earth to join the enforcement to the sanctions of the civilized world recently imposed on Kremlin, Russian companies and individuals. Do not allow them to use the Internet as a cyber battlefield against fundamental human rights and do not allow them to attack critical infrastructure for bloody warfare.

We also call on public and private entities to make steps in technological exodus from the Russian Federation, the empire of evil, the terrorist state number one, the fascist of 21st century. Last person out turns off the lights. I hope it will not be ICANN.

Thank you, dear community, for your support. We believe that you are also on the side of freedom and light.

Comment Tagged: gac, ICANN, icann 73, russia, ukraine, war

ICANN extends Covid-19 abuse monitoring to Ukraine war

ICANN has started monitoring domains related to the war in Ukraine for potential abuse, expanding an ongoing project related to the Covid-19 pandemic.

CEO Göran Marby has during multiple sessions at ICANN 73 this week said that the Org will soon announce an extension of its DNSTICR project — pronounced “DNS Ticker” and standing for Domain Name Security Threat Information Collection & Reporting.

The plan is to alert registrars about Ukraine-related domain names being used to scam people or drop malware.

“There will be coming up more information about this very soon, but we have decided to also add names in relationship to the conflict in Ukraine,” Marby said during a session with the Commercial Stakeholders Group.

DNSTICR was launched in March 2020, when the pandemic was in full swing, to find new domains containing keywords such as “covid”, “pandemic” and “coronavirus”, and check them against domain abuse lists.

From May 2020 to August last year, it flagged 210,939 pandemic-related domains, and found that 3,791 of them were malicious with “high confidence”.

CTO John Crain said in a session on Monday: “There’s a lot of stuff in the press and some technical papers out there that show clearly that the bad guys, as always, have, once again, pivoted to whatever is happening in the world. So if we can do a little bit to help, we will.”

Comment Tagged: dns abuse, dnsticr, ICANN, icann 73, malware, phishing, ukraine, war

ICANN’s Ukraine relief may extend to Russians too

Russian domain name registrants affected by sanctions could benefit from ICANN’s relaxation of its renewal rules.

ICANN on Monday announced that it was classifying the war in Ukraine as an “extenuating circumstance” under the terms of its standard Registrar Accreditation Agreement.

This means that Ukrainians cut off from the internet due to the invasion could be cut some slack, at their registrar’s discretion, when it comes to renewing their gTLD domains.

But ICANN’s executive team was asked, during a session at ICANN 73 later that day, whether the same benefits could be extended to Russian registrants, perhaps unable to pay due to Western sanctions on payment systems.

Visa, Mastercard, American Express and Paypal are among those to restrict Russian accounts in recent days.

ICANN mostly ducked the question.

Co-deputy CEO Theresa Swinehart responded by deferring to the original blog post, and general counsel John Jeffrey followed up by quoting some of the post’s language:

“I think we’re clear in that the events in Ukraine and the surrounding region are now considered by ICANN to be an extending circumstance under the Registrar Accreditation Agreement, under 3.7.5.1,” he said.

The words “surrounding region”, found in the original post alongside “affected region” and “affected area”, seem to be key here.

They could just as easily refer to Russia as they could to places such as Poland and Hungary, which are currently accepting hundreds of thousands of Ukrainian refugees.

It seems the registrars may have the discretion here; ICANN was apparently in no hurry to provide clarity.

The exchange came during a 90-minute session in which ICANN’s executive team were peppered with community questions, many related to the war and how ICANN might be affected by US-imposed sanctions.

Execs said that ICANN would comply with any US laws related to sanctions but that so far it had not seen anything that would affect its ability to contract with Russian companies.

A question apparently related to whether ICANN was reviewing its relationships with law firms and banks that may be involved with Russian oligarchs, much like Tucows is doing, was ducked.

They were also asked how the $1 million ICANN at the weekend earmarked to help keep Ukraine online might be spent, and while CEO Göran Marby alluded to a broad request from Ukraine for satellite terminals, he said it had been less than a day since the resolution was passed and it was too early to say.

“We obviously will focus on what we can do that makes the maximum impact as close to our mission as we possibly can,” added Sally Costerton, senior VP of stakeholder engagement.

Comment Tagged: ICANN, icann 73, raa, russia, sanctions, ukraine, war

ICANN offers $1 million to Ukraine projects, supports Ukrainian registrants

ICANN has allocated $1 million to help protect internet access in war-torn Ukraine.

Its board of directors at the weekend voted to set aside the “initial sum” of money “to provide financial assistance to support access to Internet infrastructure in emergency situations.”

There’s an expectation that the cash will be spent “on support for maintaining Internet access for users within Ukraine”, where the Russian invasion is described as “tragic and profoundly troubling”, over the next few months, the board said.

It’s not clear yet exactly how the money will be spent, though something related to the keeping the DNS up and running would seem to be the most probable. The resolution calls for the CEO to develop a process to figure it out.

Ukraine’s ccTLD manager, Hostmaster, moved its servers into other European countries shortly after the invasion, and signed up to Cloudlflare’s DDoS protection service. It’s not clear whether it had to spend money on these moves.

ICANN’s million will come from its regular operating budget, not the stash it has set aside from its new gTLD auctions. The auction money will probably be spent on similar things eventually, but the process for allocating that is still being worked out in a committee.

ICANN also said this week that it is, as I and others suggested, exercising section 3.7.5.1 of its Registrar Accreditation Agreement to declare the invasion an “extenuating circumstance”, meaning Ukrainians who are unable to renew their domain name registrations before they expire may not lose them.

Registrars now have the option to keep these domains registered after their usual expiration date and ICANN will not send its Compliance enforcers after them.

“We encourage registrars and registries to support this action and take these circumstances into consideration when reviewing impacted registrants’ renewal delinquencies in affected regions,” ICANN said.

It’s the first time ICANN has exercised this power in connection with a human-made disaster. It previously invoked 3.7.5.1 in response to Hurricane Maria in Puerto Rico and worldwide in response to the Covid-19 pandemic.

Hostmaster itself has extended the redemption period for .ua domains from 30 to 60 days.

Comment Tagged: compliance, hostmaster ua, ICANN, raa, russia, ukraine, war

Here’s a way ICANN could actually help the people of Ukraine

ICANN may have today decided to decline Ukraine’s request for Russian and Belarusian top-level domains to be taken down, but there’s still at least one way it could do a little bit to help the country’s citizens.

ICANN has the power to help make sure Ukrainian registrants’ domain names don’t expire, which would render their email and web sites unusable if they are unable to access the internet to pay for renewals for an extended period.

The Org is able to waive the contractual requirement for registrars to cancel domains that have not been renewed, in the event of “extenuating circumstances”.

ICANN has used this power twice before. The first time when Hurricane Maria hit the Caribbean in 2017. The second was when the ongoing coronavirus pandemic hit the world in April 2020.

In both cases, ICANN invoked section 3.7.5.1 of the standard Registrar Accreditation Agreement and said the circumstances amounted to a “natural disaster”.

But there’s nothing in the RAA that limits “extenuating circumstances” to just “natural disasters”. The term “natural disasters” does not appear in the contract.

The contract says “other circumstance as approved specifically by ICANN” is a good enough reason to waive the deletion requirements.

It appears that ICANN can unilaterally decide whether the war in Ukraine is a sufficiently “extenuating circumstance” to give Ukrainian domain name owners a break when it comes to renewals.

6 Comments Tagged: icann. war, raa, russia, ukraine

GoDaddy stops selling .ru domains, commits money to support Ukraine

Domain registrar market-share leader GoDaddy will no longer sell .ru domain names, and has reached into its pocket to provide financial support for Ukraine relief efforts.

In a two-pronged response to the Russian invasion, the company outlined several measures aimed at both supporting Ukraine and putting some sanction-style pressure on Russia.

It’s not kicking out existing Russian registrants, but it is, according to a statement:

• Removing the Russian version of our website
• No longer supporting new registrations of .ru and .ru.com
• Removing all .ru domain names from our domain name aftermarket
• Removing the Russian Ruble

“What’s happened in Ukraine is horrible. We do not condone the unwarranted aggression from the Russian Government,” the statement says.

For Ukrainian customers, GoDaddy is renewing their products and services due to expire in the next 60 days for free.

“Customers can also contact us at any time, and if they need something specific, we’ll help them as best we can,” the company added.

It’s also donating $500,000 to humanitarian relief in Ukraine, donation-matching its employees’ gifts, and offering to help pay its Ukrainian contractors’ salaries for the next 60 days.

Other registrars to share their support for Ukraine so far include Namecheap, Tucows, IONOS and Gandi.

2 Comments Tagged: godaddy, russia, ukraine, war

Gandi says it supports Ukraine but WON’T cut off Russians

Gandi has become the latest large registrar to issue a statement about the war in Ukraine, saying that while it deplores the violence it won’t be disconnecting Russian customers.

CEO Stephan Ramoin wrote that Gandi “condemns” the invasion and is “working on supporting Ukraine, according to the suggestions of our Ukrainian tech colleagues”, adding:

The internet is about including all humanity and working toward a greater goal, giving every human being a voice and a clear vision of the world, not excluding and antagonizing one group of people against another. That’s why we want to support the people of Russia and Belarus expressing their disagreement with this war. We don’t need to escalate, war is not the answer.

Cutting off Russians and Belarusians would only encourage the creation of different closed worlds and digital networks. We have chosen to hold out our hand to these people. We are not at war with them. Only their leaders, and their madness, need to be stopped. We will of course react quickly against war propaganda of any kind.

The statement follows those coming from Namecheap and IONOS, which have both this week announced their intentions to remove most Russian and Belarusian customers.

Based in Paris, Gandi is one of the oldest registrars and has over 1.3 million gTLD domains under management.

1 Comment Tagged: gandi, russia, ukraine, war

Now IONOS kicks out Russian customers

IONOS has become the second major registrar to say it will turf out its Russian customers in response to the invasion of Ukraine.

The company’s board of directors today issued a statement expressing support for the people of Ukraine and saying:

To support worldwide sanctions on Russia, we are not accepting any new customer contracts from Russia and are also terminating existing relationships with Russian customers. This also applies to business relationships with Russian service providers and suppliers. We are currently reviewing all existing supplier contracts.

The directors said that many of their colleagues come from Ukraine and have family in the region.

It’s not immediately clear whether the ban applies to domain name registrants as well as hosting customers, and what options Russian registrants have been given. An IONOS spokesperson said the details are still being worked out.

Earlier in the week, US-based registrar Namecheap, which has its customer support based in Ukraine, gave its Russian registrants notice to transfer their names elsewhere. It later said it would offer free domains to Russian dissidents.

While a little smaller than Namecheap, IONOS is part of Germany-based United-Internet and, with over five million names, a top-10 registrar in terms of gTLD domains under management.

Comment Tagged: ionos, russia, ukraine, united internet, war

ICANN says NO to Ukraine’s Big Ask

“ICANN has been built to ensure that the Internet works, not for its coordination role to be used to stop it from working.”

That’s ICANN’s response to Ukraine, which earlier this week asked for Russia to lose its top-level domains and IP addresses, to help prevent propaganda supporting its invasion of the country.

The request was arguably based on a misunderstanding of the extent of ICANN’s powers, and CEO Göran Marby says as much in his response last night (pdf) to Ukraine’s deputy prime minister Mykhailo Fedorov:

In our role as the technical coordinator of unique identifiers for the Internet, we take actions to ensure that the workings of the Internet are not politicized, and we have no sanction-levying authority

He goes on to warn about the “devastating and permanent effects” of ICANN suddenly deciding to take unilateral action against .ru, .рф and .su:

For country-code top-level domains, our work predominantly involves validating requests that come from authorized parties within the respective country or territory. The globally agreed policies do not provide for ICANN to take unilateral action to disconnect these domains as you request. You can understand why such a system cannot operate based on requests from one territory or country concerning internal operations within another territory or country. Such a change in the process would have devastating and permanent effects on the trust and utility of this global system.

He concludes:

Within our mission, we maintain neutrality and act in support of the global Internet. Our mission does not extend to taking punitive actions, issuing sanctions, or restricting access against segments of the Internet — regardless of the provocations. ICANN applies its policies consistently and in alignment with documented processes. To make unilateral changes would erode trust in the multistakeholder model and the policies designed to sustain global Internet interoperability.

The response is expected, and I believe broadly, if not unanimously, supported in the ICANN community.

In a line I wish I’d written, the Internet Society’s CEO Andrew Sullivan put it pretty succinctly in a blog post yesterday:

The idea of unplugging a country is as wrong when people want to do it to another country as it is when governments want to do it to their own.

And Sébastien Bachollet, chair of ICANN stakeholder group EURALO, insisted (pdf) that “the Internet must remain intact”.

RIPE NCC, which had been asked to revoke IP addresses supplied to Russian organizations, wrote that it “believes that the means to communicate should not be affected by domestic political disputes, international conflicts or war.”

ICANN may take a short-term PR hit in the wider world, which includes people who have a misunderstanding of how powerful ICANN is and how tenuous its grasp on the powers it does have.

While .ru appears to be safe, there’s nothing I read in Marby’s letter that would preclude it from initiating retirement proceedings against .su, when the proper policies have been approved.

Comment Tagged: .ru, .su, ICANN, isoc, ripe ncc, russia, ukraine, war