Survey: more people know about new gTLDs but fewer trust them

People are becoming more aware that new gTLDs exist, but there’s less trust in them that there was a year ago, according to an ICANN-sponsored survey.
The second annual Global Consumer Survey, which was published late last week, shows that 16% of respondents had heard of specific new gTLDs, on average.
That’s up 2% on last year’s survey.
The number for TLDs added in the last year was 20%, with .news leading the pack with 33% awareness.
However, fewer people were actually visiting these sites: 12% on average, compared to 15% a year ago. For TLDs added in the last year, visitation averaged 15%.
And the amount of trust placed on new gTLDs added prior to the 2015 survey was down from 49% to 45% — half the level of .com, .org and .net.
For TLDs added since last year’s survey, trust was at 52% on average.
The 2015 survey looked only at .email, .photography, .link, .guru, .realtor, .club and .xyz. For this year’s survey, respondents were also asked about .news, .online, .website, .site, .space, .pics, .top, .bank, .pharmacy, and .builder.
The number of registered domains did not seem to have an impact on how aware respondents were on individual extensions.
.xyz, for example, had the lowest awareness of those used in the survey — 9% versus 5% in 2015 — despite being the runaway volume market leader and having scored PR coups such as Google’s adoption of abc.xyz for its new parent company, Alphabet.
Likewise, .top, second only to .xyz in the size league table, could only muster up 11% awareness.
.news, .email and .online topped the awareness list — with 33%, 32% and 30% respectively — despite having only about 500,000 names between them.
I’m not sure I buy much of this data to be honest. There’s some weirdness.
For example, the survey found that 28% of respondents claim to have visited a .email web site.
That’s a gTLD at least partially if not primarily designed for non-web use, with roughly 20,000 names that are not parked.
If over a quarter of the population were visiting .email sites, you might expect some of those sites to show up prominently in Alexa rankings, but they don’t.
But perhaps, if we take this survey as a measure of consumers perceptions, it doesn’t matter so much whether it reflects the reality of internet use.
The survey, conducted by Nielsen for ICANN, covered dozens of other aspects of internet use, including feelings on cybersecurity, navigation and such, and weighs in at 160 pages. Read it all over here.

ICANN Ombudsman let go as role comes up for review

ICANN’s Ombudsman, Chris LaHatte, has been told his services are no longer needed.
His current contract expires July 27, but he’s been informed that it will not be renewed.
No reason has been given for the move.
Herb Waye, who took the role on an interim basis in 2011 after the departure of former Ombusdman Frank Fowlie, will step in again while ICANN looks for a permanent replacement.
LaHatte will continue on as an adviser during the transition.
The decision to replace LaHatte comes as the ICANN community begins on so-called Work Stream 2 of the IANA transition process, which includes a review of the role of the Ombudsman in ICANN’s power structure.
The Ombudsman’s job is currently to adjudicate on matters of fairness in ICANN’s activities.
He or she reports to the board and any advice given is non-binding.

Judge hands DotConnectAfrica another bizarre win

A California judge just handed ICANN another upset in the interminable legal battle waged against it by unsuccessful .africa applicant DotConnectAfrica.
Gary Klausner yesterday admitted he made a mistake when he earlier slapped ICANN with a preliminary injunction preventing .africa being delegated to DCA rival ZA Central Registry, but said his error did not have a huge bearing on that decision.
More remarkably, he’s now suggesting that ICANN may have been wrong to make DCA undergo the same Geographic Names Review as every other new gTLD applicant.
Both DCA and ZACR applied for .africa and had to go through the same evaluation processes, one of which was the Geographic Names Review.
Both had to show that they had support from 60% of the governments in Africa, and no more than one governmental objection.
ZACR had that support — though there’s legitimate dispute over whether its paperwork was all in order — while DCA did not. DCA also had over a dozen objections from African governments.
ZACR passed its geographic review, but DCA’s application was tossed out based on Governmental Advisory Committee advice before the review could be completed.
DCA took ICANN to an Independent Review Process panel, which ruled that ICANN had failed to live up to its bylaws and that DCA’s application should be returned to the evaluation process.
ICANN returned DCA’s application to the process at the point it had left it — before the geographic review was complete.
DCA then failed the review, because it has no support.
But when he granted the injunction against ICANN back in April, Klausner thought that DCA had actually passed the geographic review on the first pass. Not even DCA had claimed that; it was just a brain fart on his behalf.
He’s now admitted the mistake, but says the April ruling was not dependent on that misunderstanding.

The Court finds that the error in its factual finding was not determinative to its ultimate conclusion that there are serious questions going toward Plaintiff’s likelihood of success on the merits.

Now, he says that there may be some merit in DCA’s claim that it should have been allowed to skip the GNR due to the IRP’s recommendation that ICANN “permit DCA Trust’s application to proceed through the remainder of the new gTLD application process.”
Klausner wrote yesterday:

At this stage of litigation, it is reasonable to infer that the IRP Panel found that ICANN’s rejection of Plaintiff’s application at the geographic names evaluation phase was improper, and that the application should proceed to the delegation phase.

The problem with this thinking is that it was not the geographic panel that flunked DCA on the first pass, it was the GAC.
DCA got this document (pdf) from the geographic panel. It just says “Incomplete”.
If DCA succeeds in persuading a jury that it should have skipped the geographic panel, Africa could wind up with a .africa gTLD operator that none of its governments support and in circumvention of ICANN’s rules.
Yesterday’s ruling isn’t a killer blow against ICANN, but it does make me wonder whether Klausner — who is also hearing the much higher-profile Stairway to Heaven case right now — is really paying attention.
Anyway, he’s thrown out the ZACR/ICANN motion to reconsider the injunction, so the case is carrying on as before. Read the ruling here (pdf).

DI implicated in .sucks “gag order” fight

Vox Populi, the .sucks registry, terminated Com Laude’s accreditation last week due to its belief that the brand protection registrar had leaked a “confidential” document to Domain Incite.
Vox Pop CEO John Berard tonight denied that the company he works for was carrying out a “grudge” against Com Laude, which in January led a charge against a Vox “gag order” on registrars.
As we reported on Friday, Vox terminated Com Laude‘s ability to sell .sucks domains directly, due to a then-unspecified alleged breach of the Registry-Registrar Agreement that binds all .sucks domain registrars.
It now turns out the “breach” was of the part of the .sucks RRA that states that Vox registrars “shall make no disclosures whatsoever” of “confidential informational”, where such confidential information is marked as such.
Berard told DI of the termination: “It was a specific act, violating a specific clause of the contract that had to do with breaching confidentiality, and that’s why the action was taken.”
The specific act was Com Laude allegedly sending DI — me, for avoidance of doubt — a confidential document.
“They have not said they didn’t do it,” Berard said.
He said that, given the amount of scrutiny Vox is under (due to the controversy it has created with its pricing and policies), “it would be crazy of us to ignore a contract breach”.
He declined to identify the document in question.
He said that Vox Pop deployed “forensic research” to discover the identity of the alleged leak.
“It was clear that something that was confidential was distributed, we wanted to know who distributed it,” he said. “We wanted to know who breached confidentiality.”
DI has only published one third-party document related to .sucks this year.
This is it (pdf). It’s a letter drafted by the Registrars Stakeholder Group and sent to ICANN. Here it is (pdf) as published on the ICANN web site.
DI has received other documents related to Vox Pop and .sucks from various parties that I have not published, but I’ve been unable to find any that contained the word “confidential” or that were marked as “confidential”.
According to the .sucks RRA (pdf), “confidential information” is documentation marked or identified “confidential”.
Everything I’ve ever written about .sucks can be found with this search.

.sucks terminates Com Laude as “gag order” row escalates

Vox Populi, the .sucks gTLD registry, has terminated the accreditation of brand protection registrar Com Laude as part of an ongoing dispute between the two companies.
Com Laude won’t be able to sell defensive .sucks registrations to its clients any more, at least not on its own accreditation, in other words.
The London-based registrar is transferring all of its .sucks domains to EnCirca as a result of the termination and says it is considering its options in how to proceed.
The shock move, which I believe to be unprecedented, is being linked to Com Laude’s long-time criticisms of Vox Populi’s pricing and policies.
The registrar today had some rather stern words for Vox Pop. Managing director Nick Wood said in a statement:

We have always been critical of this registry and particularly its sunrise pricing model which we regard as predatory. We have advised clients where possible to consider not registering such names. We hope that all brand owners will think twice before buying or renewing a .sucks domain. After all, it is not possible to block out every variation of a trademark under .sucks. In our view, fair criticism is preferable to dealing with Vox Populi.

Ouch!
The termination is believed to be linked to controversial changes to the .sucks Registry-Registrar Agreement, which Vox Pop managed to sneak past ICANN over Christmas.
One of the changes, some registrars believed, would prevent brand protection registrars from openly criticizing .sucks pricing and policies. They called it a “gag order”.
Com Laude SVP Jeff Neuman was one of the strongest critics. I believe he was a key influence on a Registrar Stakeholder Group letter (pdf) in January which essentially said registrars would boycott the new RRA.
That letter said:

It’s ironic for a Registry whose slogan is “Foster debate, Share opinions” has now essentially proposed implementing a gag order on the registrars that sell the .sucks TLD by preventing them from doing just that

While the RRA dispute was resolved more or less amicably following ICANN mediation, with Vox Pop backpedaling somewhat on its proposed changes, Com Laude now believes the registry has held a grudge.
Its statement does not say what part of the .sucks RRA it is alleged to have breached.
Vox Pop has not yet returned a request for comment. I’ll provide an update should I receive further information.
Com Laude said in a statement today:

Jeff Neuman, our SVP of our North American business, Com Laude USA, led the effort in the Registrar Stakeholder Group to quash proposed changes to Vox Populi’s registry-registrar agreement, in order to protect the interests of brand owners and the registrars who work with them. Since then, Vox Populi has accused Com Laude of breaching the terms of the registry-registrar agreement, a claim we take seriously and refute in its entirety. We are now considering our further options.

Wood added:

We have informed our clients of the action being taken and all have expressed their support for the manner in which we have handled it. We are pleased to have received messages of support from across the ICANN community including other registry operators. Clearly there is strong distaste at the practices of Vox Populi.

Strong stuff.

Judge throws out DotConnectAfrica’s case against ZACR

South African registry ZACR did not engage in a fraudulent conspiracy with ICANN to get its .africa gTLD application approved, a court ruled yesterday.
The California judge in the case of DotConnectAfrica vs ICANN and ZACR threw out all of DCA’s claims against ZACR, approving ZACR’s motion to dismiss.
The judge said DCA had failed to make claims for fraud, contract intereference and unfair competition.
He also threw out DCA’s demand for ZACR’s .africa Registry Agreement to be scrapped.
The case is not over, however.
DCA’s claims against ICANN still stand and ICANN, perhaps regrettably, withdrew its own motion to dismiss the case weeks ago. The case still looks like heading to trial.
DCA reckons ICANN, ZACR, independent evaluator InterConnect Communications, and the Governmental Advisory Committee improperly ganged up on it, in breach of its new gTLD application contract.
The judge has already ruled that the litigation waiver DCA signed when it applied for .dotafrica .africa may be unenforceable.
He also based a decision to give DCA’s claims the benefit of the doubt on a huge misunderstanding of the facts, which he has yet to address publicly.
You can read the judge’s latest order here (pdf).
Under an injunction DCA won, .africa cannot be delegated until the case is resolved.

At least one in 10 new gTLDs are shrinking

While the universe of new gTLDs is growing at a rapid clip, DI research shows that at least one in 10 individual new gTLDs are shrinking.
Using zone file data, I’ve also established that almost a third of new gTLDs were smaller June 1 than they were 90 days earlier, and that more than one in five shrunk over a 12-month period.
There’s been a lot written recently, here and elsewhere, about the volume boom at the top-end of the new gTLD league tables, driven by the inexplicable hunger in China for worthless domain names, so I thought I’d try to balance it out by looking at those not benefiting from the budget land-grab madness.
It’s been about two and a half years since the first new gTLDs of the 2012 round were delegated. A few hundred were in general availability by the end of 2014.
These are the ones I chose to look at for this article.
Taking the full list of delegated 2012-round gTLDs, I first disregarded any dot-brands. For me, that’s any gTLD that has Specifications 9 or 13 in its ICANN Registry Agreement.
Volume is not a measure of success for dot-brands in general, where only the registry can own names, so we’re not interested in their growth rates.
Then I disregarded any gTLD that had a general availability date after March 14, 2015.
That date was selected because it’s 445 days before June 1, 2016 — enough time for a gTLD to go through its first renewal/deletion cycle.
There’s no point looking at TLDs less than a year old as they can only be growing.
This whittling process left me with 334 gTLDs.
Counting the domains in those gTLDs’ zone files, I found that:

• 96 (28.7%) were smaller June 1 than they were 30 days earlier.
• 104 (31.1%) were smaller June 1 than they were 90 days earlier.
• 76 (22.7%) were smaller June 1 than they were 366 days earlier.
• 35 (10.4%) were smaller on a monthly, quarterly and annual basis.

Zone files don’t include all registered domains, of course, but the proportion of those excluded tends to be broadly similar between gTLDs. Apples-to-apples comparisons are, I believe, fair.
And I think it’s fair to say that if a gTLD has gotten smaller over the previous month, quarter and year, that gTLD is “shrinking”.
There are the TLDs.
[table id=42 /]
Concerning those 35 shrinking gTLDs:

• The average size of the zones, as of June 1, was 17,299 domains.
• Combined, they accounted for 605,472 domains, down 34,412 on the year. That’s a small portion of the gTLD universe, which is currently over 20 million.
• The smallest was .wed, with 144 domains and annual shrinkage of 12. The largest was .网址 (Chinese for “.website”) which had 330,554 domains and annual shrinkage of 7,487.
• The mean shrinkage over the year was 983 domains per gTLD. Over the quarter it was 1,025. Over the month it was 400.

Sixteen of the 35 domains belong to Donuts, which is perhaps to be expected given that it has the largest stable and was the most aggressive early mover.
Of its first batch of seven domains to go to GA, way back in February 2014, only three — .guru, .singles, and .plumbing — are on our list of shrinkers.
A Donuts spokesperson told DI today that its overall number of registrations is on the increase and that “too much focus on individual TLDs doesn’t accurately indicate the overall health of the TLD program in general and of our portfolio specifically.”
He pointed out that Donuts has not pursued the domainer market with aggressive promotions, targeting instead small and medium businesses that are more likely to actually use their domains.
“As initial domainer investors shake out, you’re likely to see some degradation in the size of the zone,” he said.
He added that Donuts has seen second-year renewal rates of 72%, which were higher than the first year.
“That indicates that there’s more steadiness in the registration base today than there was when first-year renewals were due,” he said.

NTIA gives nod to IANA transition

The US National Telecommunications and Information Administration has formally thrown its weight behind the community-led proposal that would remove the US government, itself in effect, from DNS root oversight.
Assistant secretary Larry Strickling held a press conference this afternoon to confirm the hardly surprising development, but dodged questions about a Republican move to scupper the plan in Congress.
The IANA transition plan, which was developed by the ICANN community over about two years, meets all the criteria NTIA had set out in its surprise 2014 announcement, Strickling confirmed.
Namely, NTIA said in a press release that the the plan would:

• Support and enhance the multistakeholder model;
• Maintain the security, stability, and resiliency of the Internet DNS;
• Meet the needs and expectations of the global customers and partners of the IANA services; and
• Maintain the openness of the Internet.

Probably more importantly, NTIA agrees with everyone else that the plan does not replace NTIA’s role with more government meddling.
US Sen. Ted Cruz and Rep. Sean Duffy see things differently. They yesterday introduced the Protecting Internet Freedom Act, which would stop the transition going ahead.
Strickling said that NTIA has been talking to Congress members about the transition, but declined to “speculate” about the new bill’s likelihood of success.
“We’ve been up on the Hill doing briefings and will continue to do so with any member that wants to talk to us,” he said.
Currently, NTIA is forbidden by law from spending any money on the transition, but that prohibition expires (unless it is renewed) at the end of the current federal budget cycle.
The plan is to carry out the transition after that, Strickling said.
The current IANA contract expires September 30. It may be extended, depending on how quickly ICANN and Verisign proceed on their implementation tasks.

ICANN slaps first deadbeat dot-brand with breach notice

The world’s third-largest mobile phone company, worth some $14 billion a year, is the first new gTLD registry operator to refuse to pay ICANN fees.
That’s according to ICANN’s compliance department, which last night slapped Bharti Airtel with the new gTLD program’s first public contract breach notices.
The notices, which apply to .bharti and .airtel, claim that the Indian company has been ignoring demands to pay past due fees since February.
The ICANN quarterly fee for registries is $6,250. Given .airtel and .bharti were delegated 11 months ago, the company, which has assets of $33 billion, can’t owe any more than $37,500.
Bharti Airtel is, according to Wikipedia, the third largest mobile network operator in the world and the largest in India, with 325 million subscribers.
Yet ICANN also claims it has had terrible difficulty getting in touch with staff there, saying:

ICANN notes that Bharti Airtel exhibits a pattern of non-response to ICANN Contractual Compliance matters and, when responses are provided to ICANN, they are often untimely and incomplete.

The compliance notices show that ICANN has also communicated with Verisign, the registry back-end operator for both gTLDs, to try to get the matters resolved.
According to ICANN, the registry is also in breach of terms that require it to publish links to its Whois service, abuse contacts and DNSSEC practice statements on its web site.
The sites nic.airtel and nic.bharti don’t resolve (for me at least) with or without a www., but the Whois services at whois.nic.airtel and whois.nic.bharti appear to work.
These are the first two registries of any flavor emerging from the 2012 application round to receive public breach notices. Only one pre-2012 gTLD, .jobs, has the same honor.
ICANN has given Bharti Airtel 30 days from yesterday to come back into compliance or risk losing its Registry Agreements.
Given that both gTLDS are almost a year old and the nic. sites still don’t resolve, one wonders if the company will bother.

Verisign says new gTLDs put millions at risk

Verisign has revived its old name collisions security scare story, publishing this week a weighty research paper claiming millions are at risk of man-in-the-middle attacks.
It’s actually a study into how a well-known type of attack, first documented in the 1990s, might become easier due to the expansion of the DNS at the top level.
According to the paper there might be as many as 238,000 instances per day of query traffic intended for private networks leaking to the public DNS, where attackers could potentially exploit it to all manner of genuinely nasty things.
But Verisign has seen no evidence of the vulnerability being used by bad guys yet and it might not be as scary as it first appears.
You can read the paper here (pdf), but I’ll attempt to summarize.
The problem concerns a virtually ubiquitous protocol called WPAD, for Web Proxy Auto-Discovery.
It’s used by mostly by Windows clients to automatically download a web proxy configuration file that tells their browser how to connect to the web.
Organizations host these files on their local networks. The WPAD protocol tries to find the file using DHCP first, but fails over to DNS.
So, your browser might look for a wpad.dat file on wpad.example.com, depending on what domain your computer belongs to, using DNS.
The vulnerability arises because companies often use previously undelegated TLDs — such as .prod or .global — on their internal networks. Their PCs could belong to domains ending in .corp, even though .corp isn’t real TLD in the DNS root.
When these devices are roaming outside of their local network, they will still attempt to use the DNS to find their WPAD file. And if the TLD their company uses internally has actually been delegated by ICANN, their WPAD requests “leak” to registry or registrant.
A malicious attacker could register a domain name in a TLD that matches the domain the target company uses internally, allowing him to intercept and respond to the WPAD request and setting himself up as the roaming laptop’s web proxy.
That would basically allow the attacker to do pretty much whatever he wanted to the victim’s browsing experience.
Verisign says it saw 20 million WPAD leaks hit its two root servers every single day when it collected its data, and estimates that 6.6 million users are affected.
The paper says that of the 738 new gTLDs it looked at, 65.7% of them saw some degree of WPAD query leakage.
The ones with the most leaks, in order, were .global, .ads, .group, .network, .dev, .office, .prod, .hsbc, .win, .world, .one, .sap and .site.
It’s potentially quite scary, but there are some mitigating factors.
First, the problem is not limited to new gTLDs.
Yesterday I talked to Matt Larson, ICANN’s new vice president of research (who held the same post at Verisign’s until a few years ago).
He said ICANN has seen the same problem with .int, which was delegated in 1988. ICANN runs one of .int’s authoritative name servers.
“We did a really quick look at 24 hours of traffic and saw a million and a half queries for domain names of the form wpad.something.int, and that’s just one name server out of several in a 24-hour period,” he said.
“This is not a new problem, and it’s not a problem that’s specific to new gTLDs,” he said.
According to Verisign’s paper, only 2.3% of the WPAD query leaks hitting its root servers were related to new gTLDs. That’s about 238,000 queries every day.
With such a small percentage, you might wonder why new gTLDs are being highlighted as a problem.
I think it’s because organizations typically won’t own the new gTLD domain name that matches their internal domain, something that would eliminate the risk of an attacker exploiting a leak.
Verisign’s report also has limited visibility into the actual degree of risk organizations are experiencing today.
Its research methodology by necessity was limited to observing leaked WPAD queries hitting its two root servers before the new gTLDs in question were delegated.
The company only collected relevant NXDOMAIN traffic to its two root servers — DNS queries with answers typically get resolved closer to the user in the DNS hierarchy — so it has no visibility to whether the same level of leaks happen post-delegation.
Well aware of the name collisions problem, largely due to Verisign’s 11th-hour epiphany on the subject, ICANN forces all new gTLD registries to wildcard their zones for 90 days after they go live.
All collision names are pointed to 127.0.53.53, a reserved IP address picked in order to catch the attention of network administrators (DNS uses TCP/IP port 53).
Potentially, at-risk organizations could have fixed their collision problems shortly after the colliding gTLD was delegated, reducing the global impact of the vulnerability.
There’s no good data showing how many networks were reconfigured due to name collisions in the new gTLD program, but some anecdotal evidence of admins telling Google to go fuck itself when .prod got delegated.
A December 2015 report from JAS Advisors, which came up with the 127.0.53.53 idea, said the effects of name collisions have been rather limited.
ICANN’s Larson echoed the advice put out by security watchdog US-CERT this week, which among other things urges admins to use proper domain names that they actually control on their internal networks.