.com and .net are the drag factor on domain industry growth

Verisign’s own gTLDs .com and .net slowed overall domain industry volume growth in the second quarter, according to its latest Domain Name Industry Brief.

June ended with 351.5 million registrations across all TLDs, up 1 million sequentially and 10.4 million year-over-year.

Growth would have been slightly better without the drag factor of .com and .net, which were down 200,000 domains each sequentially, as Verisign previously reported in its Q2 financial results. There were 161.1 million names in .com and 13.2 million in .net.

The ccTLD world grew by 700,000 names sequentially and 2.6 million compared to a year earlier, the DNIB states.

New gTLD names were up by the same amount sequentially and 4.1 million year over year, ending the quarter at 27 million.

Verisign to crack down on Chinese domains

Verisign has asked for permission to implement a more stringent regime for denying or suspending .com and .net domain names registered in China, to comply with the country’s strict licensing rules.

The changes appear to mean that customers of Chinese registrars who have not verified their identities, which Verisign says is a “very small percentage”, will be prevented from registering new domains and may lose their existing domains.

The company has filed a Registry Services Evaluation Process request with ICANN, proposing to tweak the registrant verification system it has had in place for the last five years in a few significant ways.

China has a system called Real Name Verification, whereby Chinese citizens have to provide government-issued ID when they register domains. Local, third-party Verification Service Providers such as ZDNS typically carry out the verification function for Verisign and other foreign registries.

The big change is that Verisign will no longer allow names to be registered without a valid code.

The RSEP says that attempts by China-based registrars to register domains without the required government verification code will result in the EPP create command failing, meaning the domain will not be registered.

Under the current system, outlined in a 2016 RSEP (pdf), the name is registered and Verisign presumably takes the money, but the domain is placed on serverHold status, meaning it is not published in the zone and will not resolve.

The new system will also allow Verisign to retroactively demand codes for already-registered names, when they come up for renewal or transfer, with the option to suspend or delete the names if the codes are not provided. The RSEP (pdf) states:

With regard existing domain names without the required verification codes, which currently comprise a very small percentage of domain name registrations from registrars licensed to operate in the People’s Republic of China, Verisign intends to address compliance issues with these domain names directly with registrars. Verisign reserves the right to deny, cancel, redirect or transfer any domain name registration or transaction, or place any domain name(s) on registry lock, hold or similar status

It’s not clear what a “very small percentage” means in hard numbers. A small slice of a big pie is still a mouthful.

Verisign has substantial exposure to the Chinese market. On the odd occasion when .com shrinks, it’s largely due to speculative registrations from China not being renewed, such as in the second quarter this year.

The RSEP names the service the Domain Name Registration Validation Per Applicable Law service. While it’s in theory applicable to any jurisdiction’s laws, in practice it’s all about addressing the demands of the Chinese government.

Verisign announces ANOTHER price increase as regs slide

Verisign posted a rare decrease in its .com/.net registered name base in the second quarter, but said it is going to raise its .net prices next year anyway.

The company also massively slashed its growth outlook for domain sales this year.

The annual cost of a .net name will go up 10%, the maximum permissible under its contract with ICANN, to $9.92 from February 1 next year, the registry said

Registrants will as usual be able to lock-in the current renewal fee of $9.02 for up to 10 years if they renew before the hike kicks in.

It’s the first .net price increase since 2018. The TLD has been stagnating in volume terms for several years, due no doubt in part to behavioral changes following the introduction of new gTLDs starting in late 2013.

The news came as Verisign reported that its domain base shrunk during Q2.

The company ended June with 174.3 million names under management, up 2.2% over a year earlier but down 350,000 domains compared to the end of Q1.

The split was 161.1 million for .com and 13.2 million for .net — that’s a sequential decrease of 200,000 for .com and a decrease of 200,000 for .net. Both rounded, of course.

CEO Jim Bidzos told analysts tonight that renewals were affected by a great many first-time registrations from China not renewing. General post-pandemic and macro-economic factors also played a role, he said.

The preliminary renewal rate was 75.9% compared to 76.0% a year earlier, but the number of new regs was down to 10.1 million from 11.7 million over the same period.

Verisign reported Q2 revenue up 6.8% on a year ago at $352 million, with net income of $167 million compared to $148 million. Its operating margin swelled to 67.1% percent from 64.7%.

Bidzos told analysts that the company is cutting its registered name growth prediction for the year to between 0.5% and 1.5%, a huge decrease from the already-downgraded estimate of 1.75% and 3.5% it made after the first quarter.

He said that he expects Q3 and Q4 to go much the same way as Q2.

Bidzos said he thinks the current factors affecting regs are a bump in the road and he expects things to stabilize over time.

UPDATE 2148 UTC — The article was updated to correct the comparison of the decrease in .com/.net regs.

Verisign to mandate 2FA for .com registrars

Over 2,000 registrars are likely to be affected by a new Verisign policy making two-factor authentication mandatory when logging into the company’s registrar portal.

ICANN has given the preliminary nod to a Verisign proposal to make 2FA, which has been available on an optional basis for over a decade, mandatory.

Voluntary adoption of the security feature has been light since it was first introduced in 2009. According to Verisign’s Registry Services Evaluation Process request (pdf) only around 200 registrars currently use it.

There were 2,446 active .com registrars at the last count. The RSEP also applies to .net and .name.

The 2FA system requires registrars to enter a one-time password, in addition to their usual credentials, whenever they log in to their accounts.

The change only applies to registrars logging into Verisign’s web site to manage their accounts, not to registrants who have .com domains. It does not apply to under-the-hood EPP transactions.

The company is hoping to implement the change pretty damn quick — its June 30 RSEP states that it will start to give registrars a 30-day noticed period the following day, before ICANN had even formally approved the change.

ICANN approval (pdf) came yesterday, so presumably 2FA will become mandatory in a matter of days.

Surprising nobody, Verisign to raise .com prices again

Verisign has announced its second consecutive annual price increase for .com domain names.

The wholesale registry fee for .com names will rise from $8.39 to $8.97 on September 1 this year, an extra $0.58 for every new or renewing domain, of which there are currently over 160 million.

Verisign announced the move, which was expected, as it announced a 2021 profit of $785 million and a 65.3% operating margin.

CEO Jim Bidzos, speaking to analysts, played down the impact of the increases on .com registrants, pointing out that .com prices were frozen under the Obama administration and have only gone up once before, last year, since 2012.

“This is the second wholesale price increase for COM since January of 2012,” he said. “So, if you look back over the last 10 years, that translates into a cost increase of only 1.3% CAGR over the last ten and a half years actually.”

The current .com contract, signed off by the Trump administration and ICANN, allows for two more 7% annual price increases, excluding the just-announced one, but Bidzos would not say whether Verisign plans to exercise those options.

If it does (and it almost certainly will) it would raise the price to $10.26, where it would stay until at least October 2026, he said.

“We believe .com continues to be positioned competitively,” he said.

It’s still basically free money for Verisign, which saw strong fourth-quarter and full-year 2021 results.

The company yesterday reported revenue of $1.33 billion for 2021, up 4.9%, with net income of $785 million, down from $815 million. The operating margin was 65.3%, compared to 65.2%.

For the fourth quarter, revenue was up 6.3% to $340 million, with net income of $330 million compared to $157 million. Operating margin was 65.3%, compared to 63.9%.

For 2022, the company is guiding for revenue of between $1.42 billion and $1.44 billion, based on the price increases and predicted unit growth of between 2.5% and 4.5%. The operating margin is expected to be between 64.5% and 65.5%.

Bidzos also addressed the controversial .web gTLD, which it won at auction but has been unable to launch due to legal action pursued by rival bidder Afilias/Altanovo.

An Independent Review Process panel recently threw a decision about .web back at ICANN, which is now considering Afilias’ allegations of wrongdoing at the board level.

“ICANN looks to be moving forward with making the decision on the delegation of .web, and we will be monitoring their process,” Bidzos said. He said that Verisign has not budgeted for any revenue or costs from .web in 2022.

That’s probably wise. Afilias recently told us that it has not stopped fighting against Verisign’s .web win.

Verisign saw MASSIVE query spike during Facebook outage

Verisign’s .com and .net name servers saw a huge spike in queries when Facebook went offline for hours last October, Verisign said this week.

Queries for facebook.com, instagram.com, and whatsapp.net peaked at over 900,000 per second during the outage, up from a normal rate of 7,000 per second, a more than 100x increase, the company said in a blog post.

The widely publicized Facebook outage was caused by its IP addresses, including the IP addresses of its DNS servers, being accidentally withdrawn from routing tables. At first it looked to outside observers like a DNS failure.

When computers worldwide failed to find Facebook on their recursive name servers, they went up the hierarchy to Verisign’s .com and .net servers to find out where they’d gone, which led to the spike in traffic to those zones.

Traffic from DNS resolver networks run by Google and Cloudflare grew by 7,000x and 2,000x respectively during the outage, Verisign said.

The company also revealed that the failure of .club and .hsbc TLDs a few days later had a similar effect on the DNS root servers that Verisign operates.

Queries for the two TLDs at the root went up 45x, from 80 to 3,700 queries per second, Verisign said.

While the company said its systems were not overloaded, it subtly criticized DNS resolver networks such as Google and Cloudflare for “unnecessarily aggressive” query-spamming, writing:

We believe it is important for the security, stability and resiliency of the internet’s DNS infrastructure that the implementers of recursive resolvers and public DNS services carefully consider how their systems behave in circumstances where none of a domain name’s authoritative name servers are providing responses, yet the parent zones are providing proper referrals. We feel it is difficult to rationalize the patterns that we are currently observing, such as hundreds of queries per second from individual recursive resolver sources. The global DNS would be better served by more appropriate rate limiting, and algorithms such as exponential backoff, to address these types of cases

Verisign said it is proposing updates to internet standards to address this problem.

.com and NameSilo fingered as “most-abused” after numbers rocket

SpamHaus has revealed the most-abused TLDs and registrars in its second-quarter report on botnets.

The data shows huge growth in abuse at Verisign’s .com and the fast-growing NameSilo, which overtook Namecheap to top the registrar list for the first time.

Botnet command-and-control domains using .com grew by 166%, from 1,549 to 4,113, during the quarter, SpamHaus said.

At number two, .xyz saw 739 C&C domains, up 114%.

In the registrar league table, NameSilo topped the list for the first time, unseating Namecheap for the first time in years.

NameSilo had 1,797 C&C domains on its books, an “enormous” 594% increase. Namecheap’s number was 955 domains, up 52%.

Botnets are one type of “DNS abuse” that even registrars agree should be acted on at the registrar level.

The most-abused lists and lots of other botnet-related data can be found here.

Verisign expects huge domain growth in 2021

Verisign tonight significantly upgraded its estimate of how many .com and .net domains it expects to sell this year, citing an improving economy and increased growth in online commerce.

CEO Jim Bidzos told analysts that it’s now expecting its domain base to increase by 4% to 5.5% this year. Three months ago, it had cautiously predicted growth would be between 2.5% and 4.5%.

That’s a minimum of 6.6 million net new domains this year.

The upgrade was inspired by its first-quarter performance, in which .com and .net base grew by 4.6% when compared to Q1 2020, to 168 million names.

That was an increase of 2.8 million names during the quarter, which compares to 1.83 million net new domains in Q1 2020 and 1.46 million in Q4 2020. A pretty damn good showing, in other words.

For Q1, Verisign tonight reported net income of $150 million, down from $334 million in Q1 last year, when it experienced a one-off tax benefit.

Revenue was up 3.6% on last year at $324 million.

Decision on $135 million .web auction expected in weeks

ICANN, Verisign, Donuts, and the other applicants for .web will find out who gets to control the fiercely contested gTLD by the first week of June at the latest, according to Verisign’s CEO.

Jim Bidzos told analysts tonight that the Independent Review Process panel currently handling a complaint filed by Afilias declared its case closed April 7, and said that a decision will come within 60 days.

Afilias, now owned by Donuts, came second in an ICANN “auction of last resort” in which a Verisign-backed company called Nu Dot Co agreed to pay $135 million for the coveted string.

Afilias wants the auction declared invalid because ICANN, it claims, did not sufficiently pursue allegations that NDC was being secretly bankrolled by Verisign, which it says broke ICANN bylaws and new gTLD application rules.

This is denied by ICANN, as well as NDC and Verisign, which have filed legal documents with the IRP panel despite not being parties.

Afilias and others suspect that Verisign wants .web in order to bury it, keeping what could be a strong .com competitor weak, which Verisign also denies.

The IRP panel held a seven-day virtual hearing last August, but has continued to receive briefs from ICANN and Afilias since then.

Domain industry shrank in Q4, but as usual there’s a big BUT

The worldwide domain name count shrank in the fourth quarter, according to newly released Verisign data, but as usual the numbers were hugely impacted by big swings in just a few TLDs.

The latest Domain Name Industry Brief (pdf), which is mainly compiled from zone file counts, shows that 2020 ended with 366.3 million names, down by 4.4 million or 1.2% compared to the end of the third quarter.

It’s the free and almost-free TLDs that swung the math.

Remarkably, industry wild-card .tk actually shrank during the quarter. This is highly unusual, as the registry’s business model is based on giving out names for free, never deleting domains, and monetizing the traffic to expired or suspended names.

It saw domains down by 2.8 million names over the quarter, from 27.5 million to 24.7 million.

Another big dipper was .icu, which sells cheap (usually under $1) and appeals to speculators largely in China.

While it slipped out of the top 10 TLDs, meaning the DNIB no longer breaks out its numbers, DI’s own zone file counts show its zone decline from 5.3 million to 3.4 million during Q4, a 1.9 million decline.

Notably spammy new gTLD .top, which also costs next to nothing and is popular in China, also had a role to play. Its zone count was down by about 900,000 between September 30 and December 31.

Those three TLDs alone account for a loss of 5.6 million names, far more than the 4.4 million industry-wide quarterly drop calculated by Verisign.

The impact of .icu’s continued spiral downwards is likely to be felt in Q1 2021 also. It’s lost another 2.4 million zone file names since the start of the year.

Verisign said the the universe of ccTLD domains contracted by 1.7 million of 1% during the quarter, ending the year with 158.9 million names.

The .tk shrinkage of course more than accounts for this dip. Without it, ccTLDs would be up by 1.1 million names or 1.1%. The major, top-10 ccTLDs mostly showed six-figure growth, the DNIB reflects.

New gTLDs were down 4.2 million names or 13.8% sequentially, ending the quarter with 26 million.

In addition to the aforementioned .top and .icu, this figure appears to have been affected by six-figure losses in some of the highest-volume, lowest-priced new gTLDs, including .club, .site .work and .vip.

In the main legacy gTLDs, Verisign’s own .com grew by 1.5 million names, from 151.8 million to 150.3 million, during the quarter. Its .net was again flat at 13.4 million. Public Interest Registry’s .org gained a (rounded) 100,000 names, ending the year at 10.3 million.

The annual numbers across the industry for 2020 have better optics. The DNIB shows that domain volume was up by 4.0 million or 1.1% year over year.

That breaks down into a 6.3 million increase in .com, a 1.3 million increase across the ccTLDs, and a 3.3 million decrease in new gTLDs, not all of which can be explained away by factoring out .icu and .top.