DNSSEC claims another registry victim

DNSSEC is widely touted as a crucial security upgrade for the domain name system, but as so often is the case with security measures, it can also cause serious problems.

DENIC, the registry operator for Germany’s .de, became the latest victim of a DNSSEC screw-up earlier this week, when a botched key rollover led to the entire ccTLD being flagged as bogus by many ISPs.

That’s no small issue — .de is the internet’s third-largest TLD after .com and .cn, with some 17.9 million domains under management.

The company said that the outage began at 2157 UTC on Tuesday night, caused by “incorrect DNSSEC signatures” being deployed during a “routine, scheduled key rollover”, and was fixed by 0115 the following day.

Bad sigs means that any attempt to resolve a .de domain would fail, but only on networks where the DNS resolvers strictly enforce DNSSEC validation. That includes major free resolver networks such as those run by Google and Cloudflare.

The workaround is to temporarily stop enforcing DNSSEC validation, which can be done using a mechanism baked into the IETF standard. Cloudflare has a fairly comprehensive technical description of how it responded here.

DENIC said it has temporarily suspended is key rollover schedule while it figures out what went wrong.

The registry is far from alone when it comes to DNSSEC snafus. Literally dozens of ccTLDs and gTLDs have experiences outages related to the protocol since it was added to the DNS root in 2010.

GlobalBlock signs the two best deals it will ever get

Trademark-blocking service GlobalBlock has added the world’s second and third-largest TLDs to its roster.

China’s .cn and Germany’s .de are now among the hundreds of TLDs, pseudo-TLDs and blockchain namespaces that are covered by the service, which is run by the GoDaddy-managed Brand Safety Alliance.

.cn usually has north of 20 million domains in its zone and .de is currently at around 17.8 million, making them second only to .com in terms of pure domain volume.

These deals are probably the best GlobalBlock will ever get — I can’t see a compelling business case for Verisign to voluntarily sign up .com to the system any time soon.

The next obvious targets would be .uk, .ru, and .nl, the next-largest in the ccTLD space. Several of the larger portfolio gTLD registries such as Radix and XYZ have also yet to join the program.

Nevertheless, GlobalBlock said that it’s recently added 70 “extensions” to the platform, bringing its total to 780.

The outfit says it has blocked five million domains from being registered and recovered over 10,000 domains via Priority AutoCatch, which prevents brand-match names dropping after they expire.

.de worst TLD for CSAM — report

Germany’s ccTLD, .de, was the worst in the world for hosting child sexual abuse material last year, according to the latest data from the Internet Watch Foundation, which many registries rely on for helping take down such material.

IWF said it found 802 unique .de domains hosting CSAM in 2023, a 1,995% increase compared to 2022. The second and third worst were .com and .ru, with 744 and 691 domains respectively. IWF noted that CSAM domains in .com were down 10% in the year.

Other TLDs in the top 10 were .cc, the non-DNS .onion, .top, .xyz, .pw, .ws and .net. The fastest-grower was Samoa’s .ws, managed by Global Domains International, which saw an increase to 2,966% to 184 unique domains.

.de was also the worst for commercial CSAM operations, IWF said. It found 783 such sites in 2023, all of which “openly displayed images and videos of child sexual abuse on the homepage”. That number in 2022 was zero, the report says.

DENIC gets approved for registry escrow

DENIC is now able to offer data escrow services to gTLD registries, in addition to registrars.
The non-profit company, which runs Germany’s .de, said it gained ICANN approval for the registry escrow function June 6.
Back in March, ICANN approved it for the registrar escrow services.
All ICANN-accredited registries and registrars are contractually obliged to deposit their registrant data with escrow agents in case they go out of business, go rogue, suffer catastrophic data loss, or otherwise screw up.
Nine companies have been approved by ICANN for registry data escrow so far.
Two of others are based in Europe, but DENIC claims to be the only one that offers full compliance with the more stringent German and European Union data protection regulations.

Kredit.com sells for a fraction of Kredit.de

Kredit.com, which means “credit.com” in German, has been sold via Sedo for a fraction of the price that Kredit.de sold for about 18 months ago.
Sedo reported today that the domain changed hands recently for €220,000, which works out to $271,000 at today’s exchange rates.
For comparison, the German ccTLD equivalent, kredit.de, went for €892,500 in December 2008, also via Sedo. At the time, that amount translated to $1.25 million.
A generic ccTLD selling for roughly 5x the .com is a fairly uncommon occurrence, perhaps demonstrating how strong the .de namespace is locally. I can’t imagine such a wide discrepancy in valuations between a generic .com and .co.uk.
Kredit.com was originally registered in 1996. It’s currently parked, with an Irish address listed in the Whois.

German domains see severe downtime

Many domains ending in .de, Germany’s country-code TLD, have seen downtime today, after something went wrong at Denic, the registry manager.
Details are sketchy at the moment, but it appears from chatter on the DNS-Ops mailing list that several instances of the .de zone stopped serving addresses this morning.
It appears that the affected servers were responsible for .de domains beginning with F through Z, so facebook.de would have worked, but heise.de would not.
The German slice of Twitter has been going a bit nuts with comments, and the German press is already on the case.
This is obviously a huge headache if you’re German or do business in Germany — I hate to think how many transactions could have been disrupted by the downtime — and I expect Denic will take a lot of flack at home over the coming days and weeks.
The problem, however, does appear to have been fixed. SANS estimates the outage as a little over an hour.

Google Translate turns ccTLDs into .com

I’ve found Google Translate an invaluable tool for researching overseas news stories, but it’s a pain in the neck for reading about domain names in foreign languages.
The service seems to have developed the habit of turning all freestanding ccTLDs into “.com”.
For an example, head over to Norid and turn on Norwegian-to-English translation (or, if you don’t have the Google Toolbar, use Google Translate on the web).
Every instance of “.no”, Norway’s country-code domain, is translated into a .com, more specifically “. Com”.
Ditto for German. Translate this story about Denic’s troubles today to see all instances of “.de” translated into “. Com”.
However, the front page of Afnic sees .fr translated to “. Com”, leaving .re, for the Reuinion Islands, untouched.
I should point out that the service leaves domain names alone, so nic.fr is still nic.fr. But you’ve still got to wonder what Google’s designers were thinking.