UK gov takes its lead from ICANN on DNS abuse

The UK government has set out how it intends to regulate UK-related top-level domain registries, and it’s taken its lead mostly from existing ICANN policies.

The Department for Science, Innovation and Technology said last year that it was to activate the parts of the Digital Economy Act of 2010 that allow it to seize control of TLDs such as .uk, .london, .scot, .wales and .cymru, should those registries fail to tackle abuse in future.

It ran a public consultation that attracted a few dozen responses, but has seemingly decided to stick to its original definitions of abuse and cybersquatting, which were cooked up with .uk registry Nominet and others and closely align to industry norms.

DSIT plans to define abuse in the same five categories as ICANN does — phishing, pharming, botnets, malware and vector spam (spam that is used to serve up the first four types of attack) — in its response to the consultation, published yesterday (pdf).

But it’s stronger on child sexual abuse material than ICANN. While registries and registrars have developed a “Framework to Address Abuse” that says they “should” take down domains publishing CSAM, ICANN itself has no contractual prohibitions on such content.

DSIT said it will require UK-related registries to have “adequate policies and procedures” to combat CSAM in their zones. The definition of CSAM follows existing UK law in being broader than elsewhere in the world, including artworks such as cartoons and manga where no real children are harmed.

DSIT said it will define cybersquatting as “the pre-emptive, bad faith registration of trade marks as domain names by third parties who do not possess rights in such names”. The definition omits the “and is being used in bad faith” terminology used in ICANN’s UDRP. DSIT’s definition includes typosquatting.

In response to the new document, Nominet tweeted:

The response highlights that Government recognises the work registries already do to support law enforcement agencies prevent the registration of domains to carry out illegal activity and "expect the existing voluntary arrangements to be used as the first port of call".

— Nominet (@Nominet) February 23, 2024

DSIT said it will draft its regulations “over the coming months”.

2 Comments Tagged: .uk, abuse, csam, cybersquatting, dea, dsit, ICANN, nominet

Tucows reports 2023 results

Tucows reported a domains business that was slightly stronger in the fourth quarter, as the company’s overall revenue grew by over 10%.

The registrar said its Tucows Domains unit grew by 2.6% at $61.8 million in the period, compared to Q4 2022. Gross profit was up 2.5% at $18.9 million and adjusted EBITDA was $10.8 million, up 2.1%.

For the full year, Domains brought in revenue down slightly at $242.1 million from $243.2 million in 2022. Gross profit was down from $78.2 million to $66.7 million and adjusted EBITDA was down to $42.6 million from $44.8 million in 2022.

CEO Elliot Noss said that he expects EBITDA for the domains business in 2024 to be $43 million.

Tucows’ domains under management was up at bit at the end of December, with 24.56 million names compared to 24.54 million at the end of Q3 and 24.39 million at the end of 2022.

Domains represents about 31% of the company’s overall business, with its Ting internet access services and Wavelo telecoms software unit making up the rest.

The company’s total revenue for Q4 was flat sequentially at $86.9 million, up from $78 million in the year-ago period. Full-year revenue was $339.3 million, up from $321.1 million in 2022.

Comment Tagged: earnings, financials, tucows

Twitter “completely unresponsive” on clickable domains

Elon Musk’s Twitter is “completely unresponsive” to outreach about Universal Acceptance of domain names, including problems such as the lack of linkification of new gTLD domains, according to an ICANN technologist.

Speaking at an ICANN 79 Prep Week session yesterday, senior UA technology manager Arnt Gulbrandsen said the Org has been attempting to work with major platforms such as Google’s Gmail and WordPress to encourage support for newer, longer gTLDs and internationalized domain names, but with mixed results.

“What we are doing is identifying the most important, the biggest actors… testing, reaching out or contributing changes,” he said. “We don’t work equally with all. If someone’s unresponsive, then we more or less stop talking to them and hope that they grow less important as time passes.”

“This means Twitter,” he said. “Twitter is completely unresponsive.”

Twitter and other platforms such as WhatsApp have been criticized recently by the people behind gTLDs including .music and .tube for failing to “linkify” their domains. When you tweet a .music domain without the http:// prefix it will not automatically become clickable, for example.

Twitter’s cut-off point for recognizing TLDs appears to be mid-2020. The three gTLDs delegated after that — .spa, .music and .kids — do not currently linkify.

Gulbrandsen said ICANN has been getting a more encouraging response from developers within the WordPress ecosystem, where ICANN discovered that UA support relies a great deal on just three software components maintained by volunteer developers — linkify-it, phpautolink and phpmailer.

“I’m really happy about the responses from some of these obscure, open-source maintainers,” he said. “They really want to do the best for the world, and they are volunteers mostly.”

Two of the identified components currently support UA and ICANN is working with phpmailer, he said. ICANN has also been contributing UA code even further down the stack, to programming languages such as Java, Python and Ruby, he said.

Gulbrandsen’s presentation came during the ICANN 79 Prep Week session on UA, which included contributions from members of various UA working groups and focused largely on IDN and email problems. You can listen to the session in full here.

Comment Tagged: .ua, ICANN, linkification, new gTLDs, universal acceptance

ICANN spends $5 million more than planned in first fiscal half

ICANN published its second fiscal quarter financials yesterday, revealing a roughly $5 million overspend in the second half of 2023.

The Org spent $72 million of its $74 million revenue in the six months to December 31, more than the $67 million spend it had budgeted for.

ICANN said the overspend came mainly in its Community and Engagement reporting segment, with the $4 million excess “driven by higher than planned costs for ICANN78, community programs, and meetings support”.

The same report shows that ICANN 78, which took place in Hamburg last October, cost about $900,000 more than expected largely because it spent more on air fares and had to put on more sessions than it originally expected.

It also spent about $100,000 on its 25th anniversary celebration, a line item that had not appeared in its budget. Because who can predict an anniversary, right?

Hamburg was the most-expensive meeting since the pandemic ended, costing about $5.4 million and attracting over 2,500 attendees. The Kuala Lumpur meeting a year earlier had cost $4.7 million.

ICANN’s revenue was described as “flat”, but a breakdown shows a roughly $1 million (rounded) shortfall in both registry and registrar transaction fees compared to the budget. This is likely linked to shrinkages in Verisign’s .com sales over the period.

Comment Tagged: budget, earnings, financials, hamburg, ICANN, icann 78

.art takes a million domains off its premium list

UK Creative Ideas, the .art gTLD registry, is removing premium pricing from over a million domain names and slashing the premium pricing on others.

The company said today that most of the names losing their premium tag were on the lowest pricing tier, which is $70 wholesale a year. I believe the standard wholesale fee they will be moving to is $12 a year. Retail registrars will of course add their markups on their storefronts.

The registry said it’s “also moving a number of names from some higher premium tiers to lower priced premium tiers”.

The price changes, which come into effect February 21, are designed to make .art more attractive to both end users and domain investors, the company said.

.art had almost a quarter of a million domains under management at the last count. Not relying on cheapo registrations, it has one of the least lumpy growth trajectories of any 2012-round new gTLD, having a reliably steady incline pretty much since its 2017 launch.

Its top registrars are Namecheap, GoDaddy, Tucows and SquareSpace (formerly Google) in North America and Alibaba in China.

3 Comments Tagged: .art, premiums, uk creative ideas

KeyTrap ‘the most devastating vulnerability ever found in DNSSEC’

A security vulnerability in the DNSSEC standard that could crash DNS resolution in software such as BIND and services such as Cloudflare and Google Public DNS has been called “the most devastating vulnerability ever found in DNSSEC”.

Named KeyTrap, it enables attackers to overwhelm a DNS resolver’s CPU for as long as 16 hours, forcing it to process up to two million times its usual load, using a single malicious DNS packet, making for a potentially crippling denial-of-service attack.

The flaw was discovered last year by Elias Heftrig, Haya Schulmann, Niklas Vogel, and Michael Waidner from ATHENE, the German National Research Center for Applied Cybersecurity, and publicly disclosed last week after vendors were given time to develop and deploy patches.

While KeyTrap has been present in DNS software for almost a quarter-century, the researchers are not aware of it being exploited in the wild.

The vulnerability is actually baked into the DNSSEC technical standards, developed in the 1990s, rather than being specific to any one implementation of the specs, according to the researchers. In fact, in order to patch the problem vendors had to break with the standard RFCs.

KeyTrap works because DNSSEC is (believe it or not) designed to avoid causing downtime when it fails, so it tries too eagerly to validate cryptographic signatures by checking all the keys available to it. Exploiting this helpfulness, an attacker could trick a resolver into eating up all its CPU resources checking huge numbers of keys.

Schulmann wrote in an article explaining the vulnerability:

Our methods show a low-resource adversary can fully attack a DNS resolver with a Denial-of-Service (DoS) for up to 16 hours with a single DNS request. Members from the 31-participant task force of major operators, vendors, and developers of DNS/DNSSEC, to which we disclosed our research, dubbed our attack ‘the most devastating vulnerability ever found in DNSSEC’.

DNSSEC is designed to mitigate the risk of DNS cache-poisoning and man-in-the-middle attacks, but because its default behavior when the crypto fails is to refuse to resolve the affected domains, it can also lead to availability problems.

It’s not uncommon for entire TLDs to fail for hours when the registry screws up a DNSSEC key rollover. The web site you’re reading right now suffered downtime a few years ago due to a DNSSEC fail at the registrar level.

The KeyTrap researchers believe about 31% of web client devices currently use DNSSEC resolvers.

1 Comment Tagged: athene, DNSSEC, keytrap, vulnerability

Freenom settles $500 million Meta lawsuit and will exit domain business

Facebook has claimed another domain industry scalp. Freenom said this week it has settled the cybersquatting lawsuit filed against it by Meta last year, and that it is getting out of the domain name business.

The registry/registrar said in a brief February 12 statement (pdf) that it will pay Meta an undisclosed sum and has “independently decided to exit the domain name business”.

Just how “independent” that decision was is debatable. The company lost its ICANN registrar accreditation last year and is believed to have lost its government contracts to run the ccTLDs for Equatorial Guinea, Central African Republic, Mali, Gabon, and possibly also Tokelau, its flagship .tk domain.

Meta had claimed in its complaint that Freenom had typosquatted its trademarks thousands of times, including domains such as faceb00k.ga. It sued for 5,000 counts under US anti-cybersquatting law, seeking $100,000 for each infringement, for a cool half-billion bucks in total.

Freenom and its network of co-defendant affiliates said in their defense that Meta had access to an abuse API that allowed it to turn off such domains, but had never used it. It also claimed many of the cited typosquats had already been shut down by the time the suit was filed.

It seems the names in question were likely those registered by abusive third-parties that were reclaimed and monetized by Freenom under its widely criticized free-domains business model, which made its TLDs some of the world’s most-abused.

But the claims on both sides evidently will not be tested at trial. The last court filing, dated late December, showed the two parties were to enter mediation, and Freenom put out the following statement this week:

Freenom today announced it has resolved the lawsuit brought by Meta Platforms, Inc. on confidential monetary and business Terms. Freenom recognizes Meta’s legitimate interest in enforcing its intellectual property rights and protecting its users from fraud and abuse.

Freenom and its related companies have also independently decided to exit the domain name business, including the operation of registries. While Freenom winds down its domain name business, Freenom will treat the Meta family of companies as a trusted notifier and will also implement a block list to address future phishing, DNS abuse, and cybersquatting.

Meta said in its Q4 Adversarial Threat Report this week that the settlement showed its approach to tackling DNS abuse is working.

Freenom’s gTLD domains have been transferred to Gandi. It’s less clear what’s happening to its ccTLD names, though social media chatter this week suggests the company has been giving registrants in affected ccTLDs nine-year renewals at no cost.

1 Comment Tagged: cybersquatting, facebook, freenom, lawsuit, meta, opentld

New gTLD lottery to return in 2026

Remember The Draw? It was the mechanism ICANN used to figure out which new gTLDs from the 2012 application round would get a first-mover advantage, and it’s coming back in 2026.

The Org is currently considering draft Applicant Guidebook language setting out the rules for how to pick which order to process applications in the next round.

There’s no mention of Digital Archery this time. ICANN is sticking to the tried-and-tested Prioritization Draw, a lottery method in which applicants buy a paper ticket for a nominal sum ($100 last time) and ICANN pulls them out of a big bucket to see who goes first.

Applicants for internationalized domain names will have an advantage again, but it’s arguably not as strong as in the 2012 round, when all the IDN applicants that had bought tickets were processed first.

This time, the draw will take place in batches of 500 applications, according to the latest version of the draft AGB language.

The first batch will contain at least 125 IDN applications — assuming there are 125 — and they will be drawn first, before any Latin-script strings get a look. In subsequent batches, the first 10% of tickets drawn will belong exclusively to IDN applicants.

In the 2012 round, the first 108 applications selected were IDNs. The Vatican won the lucky #1 spot with .天主教, the Chinese term for the Catholic Church, while Amazon was the first Latin-script application with .play (which Google eventually won but still hasn’t launched, over 11 years later).

Due to California’s gambling laws, applicants will have to show up to buy a ticket in person. If they can’t make it, they can select an Angeleno proxy from a list provided by ICANN to pick it up on their behalf.

Last time around, The Draw took over nine hours to sort all 1,930 applications and was the social highlight of the community’s calendar. Santa Claus even showed up.

5 Comments Tagged: ICANN, idns, new gTLDs, the draw

First GlobalBlock prices revealed — they ain’t cheap

Trademarks owners, organizations and celebrities could find themselves paying the thick end of ten grand for the “peace of mind” offered by the new GoDaddy-led GlobalBlock trademark protection service.

101domain, which often has some of the least-expensive pricing, has become the first registrar to publish its prices for the domain-blocking service, which entered beta this week.

The base GlobalBlock service, which offers single-string blocking in 560 gTLDs and ccTLDs, is going for $5,999 per year, according to the 101domain storefront. The GlobalBlock+ version, which covers potentially tens of thousands of variants and typos, starts at $8,999 a year.

None of the other 20 approved GlobalBlock resellers I checked are currently publishing prices.

Some simple division shows us that the basic service works out to roughly $10.71 per domain per year — a bit more than Verisign will charge for a wholesale .com when its prices go up later this year — but the average per-domain cost should go down as more registries sign up to GlobalBlock.

With the GlobalBlock+ service offering to block 50,000 domains or more, the per-domain price obviously shrinks to pennies.

GlobalBlock is offered by the Brand Safety Alliance, a GoDaddy initiative, but it has support from the likes of Identity Digital, which has hundreds of gTLDs in its stable. Dozens of gTLD registry operators have recently asked ICANN’s permission to offer GlobalBlock and rival offering NameBlock.

The BSA has previously said it expects to launch with over 650 TLDs on board. A calculator on its web site suggests 511 are currently operational, but it has not yet named the participating TLDs.

Comment Tagged: 101domain, cybersquatting, globalblock, godaddy, trademarks

Domain universe grows on new gTLDs despite .com shrinkage

The number of domain names on the internet grew by about 600,000 during the fourth quarter of 2023, despite the drag caused by shrinkage in .com and .net, according to Verisign’s latest Domain Name Industry Brief.

There were 359.8 million registered domains at the end of the year across all TLDs, a 0.2% increase over September, the latest DNIB says.

The growth was hampered by declines in Verisign’s own flagship gTLDs, which were down by 1.2 million names over Q3 and a million names year-over year. Verisign blamed softness in China for the declines during its Q4 earnings call last week.

New gTLD reg volume picked up most of the slack, growing by 1.6 million or 5.3% over Q3, and 4.4 million or 15.9% over 2022. This seems to have been largely driven by six-figure increases at a handful of low-cost gTLDs coupled with smaller increases across the board.

ccTLDs grew more modestly, up about 200,000 names or 0.2% quarter over quarter and 5.3 million names, 4%, year over year. There were 138.3 million ccTLD domains at the end of the year. Growth seems to have been tempered by six-figure declines in the likes of .uk and .ru.

Comment Tagged: dnib, verisign