Two world wars and one dot-brand? Americans beat Germans in long-running gTLD fight, kinda

A chemicals company called Merck has beaten another chemicals company called Merck for the right to run .merck as a dot-brand gTLD.

But it looks like we may be looking at an unprecedented case of a shared dot-brand.

US-based Merck Registry Holdings and Germany-based Merck KGaA appear to have resolved their long-running battle over the string, with the German company recently withdrawing its application, enabling its rival to sign a contract with ICANN and go live on the internet.

But it’s not as straightforward as one applicant emerging victorious over the other. Recent changes to the American company’s winning gTLD application strongly suggest that the two companies intend to share the space.

The application was substantially rewritten in March to make it clear that American Merck plans to allow unaffiliated third parties to register .merck names, and that it may substantially change its eligibility policies not long after launch.

Whereas its original 2012 application was pretty much boilerplate dot-brand territory, the March 2021 version is more nuanced. It now talks about extending eligibility to “other registrants” rather than merely “licensees”, for example.

The application now says it “reserves the right to consider allowing third party registrants outside of current affiliate or subsidiary relationships to own .MERCK domains at a future date.”

But, more importantly, it now also says that it intends to transfer its .merck Registry Agreement to a new shell company, London-based MM Domain Holdco Ltd, shortly after ICANN signs it off.

Company records show that MM Domain Holdco has directors — trademark lawyers — from both the American and German companies.

So we’re looking at some kind of shared dot-brand, it seems. If you don’t count Amazon’s uneasy deal with South American governments, that’s pretty much unprecedented for new gTLDs.

The US applicant is a subsidiary of Merck & Co Inc, a New York-listed company with a market cap of $197 billion. The German company is listed in Frankfurt with a market cap of €17 billion.

The German firm is 350 years old and was the parent of the American company until it was seized, and eventually re-privatized as a separate entity, by the US government during World War I.

Both have trademark rights to the term “Merck” and a decades-old cooperation agreement, but have nevertheless been in legal disputes over the mark in recent years.

It will be interesting to see whether the two Mercks ultimately share and actively use .merck, or like so many other dot-brands merely own a defensive, inactive gTLD.

The resolution of the contention set comes after the better part of a decade and many years of negotiations and legal tussles with ICANN.

ICANN had been bent on forcing the companies to a last-resort auction of which it would be the financial beneficiary. Whether this was because it wanted to force the Mercks to the negotiating table to resolve their differences amicably, or because it saw dollar signs… you decide. Maybe both.

The Mercks have in recent years repeatedly delayed the auction, using different ICANN appeals mechanisms. The contention set had been in a Cooperative Engagement Process since late last year, but had been slated to go to auction yesterday, May 12.

The settlement occurred before that date, however, so ICANN won’t be getting any auction money this time.

ICANN CEO is first to get paid over $1,000,000 a year

ICANN CEO Göran Marby was paid over a million bucks out of the domain-buying public’s pocket in the org’s fiscal 2020, newly released tax documents show.

He’s now, I believe, the best-paid CEO ICANN’s ever had and the first to make more than $1 million per year in the role.

ICANN’s FY20 tax return, which covers the year to June 30, 2020, discloses Marby’s total reportable compensation as $991,557, with another $67,665 in estimated additional compensation, making a total of $1,059,222.

That’s an increase of $193,652 over the $865,570 he received in FY19.

Marby’s been making more than immediate predecessor Fadi Chehadé for a few years, but now he’s also overtaken Rod Beckstrom, who made $961,672 in 2012, his last full year on the job.

Neither Beckstrom nor his predecessor Paul Twomey ever quite made it into seven figures.

This February, ICANN’s board of directors voted to give Marby another 5% pay raise, though a few directors voted against the package.

ICANN’s form 990 tax releases also disclose salaries for another 36 senior staff and board members, showing 19 of them get paid more than $300,000 a year.

Five, including Marby, made over half a million, though a few of those are no longer with the organization.

General counsel John Jeffrey, the second-biggest earner, now has total compensation of $709,784, compared to the $314,628 he was getting 10 years ago when he was in exactly the same job.

PDR wins beauty contest to take over Net4’s stranded customers

PublicDomainRegistry.com, part of the new Newfold Digital registrar group, has been picked to take over thousands of domain names from disgraced and defunct Net 4 India.

ICANN seems to have used the beauty contest method of picking Net4’s successor, saying that PDR was picked in part because it already operates in the region. It’s based in Mumbai.

ICANN expects PDR to start reaching out to its new customers next week with instructions on how to get access to their domains at their new registrar.

It goes without saying that Net4 customers should be wary of possible scams, which sometimes accompany this kind of event.

Customers won’t be charged for the transfers, and they won’t have to deal with transfer authorization codes, ICANN said.

PDR was part of the Endurance group until its recent merger with the Web.com group, which created Newfold.

It’s the second-largest registrar group and undoubtedly a safer set of hands than Net4, which has left thousands of customers struggling to renew, manage and transfer their domains for several months.

The bulk transfer to PDR comes after ICANN terminated Net4’s contract for multiple breaches.

ICANN throws out another challenge to the Donuts-Afilias deal

ICANN is set to reject a plea for it to reconsider its decision to allow Donuts to buy Afilias last December.

Its Board Accountability Mechanisms Committee recently threw out a Request for Reconsideration filed by Dot Hotel and Domain Venture Partners, part of a multi-pronged assault on the outcome of the .hotel gTLD contention set.

The RfR was “summarily dismissed”, an infrequently used way of disposing of such requests without considering their merits. BAMC concluded that the requestors had failed to sufficiently state how they’d been harmed by ICANN’s decision, and therefore lacked standing.

The requestors, both applicants for .hotel, had said that they were harmed by the fact that Donuts now owns two applications for .hotel — its own open, commercial one and Afilias’ successful community-based one.

It also said that ICANN’s seemingly deliberate opacity when it came to approving the deal broke its bylaws and sowed confusion and risk in the registry industry.

At some point before the December 17 board meeting that approved the acquisition, ICANN staff briefed the board on its decision to approve the deal, but no formal resolution was passed.

By exploiting this loophole, it’s not clear whether the board actually voted on the deal, and ICANN was not obliged by its bylaws to publish a rationale for the decision.

But BAMC, acting on the advice of ICANN’s lawyers, decided (pdf) that the statements of alleged harm were too vague or seemed to rely on potential future harms.

DVP and Dot Hotel are also party to a lawsuit and an Independent Review Process case against ICANN related to .hotel.

A Documentary Information Disclosure Request related to the Afilias acquisition was also thrown out in March.

BAMC’s dismissal will be rubber-stamped by ICANN’s full board at a later date.

$40 million UNR auction brings fresh blood to domain industry

Six entities are entering the domain registry business for the first time following UNR’s auction last month, which saw over 20 new gTLDs sold off for a total of over $40 million, according to UNR.

While playing its cards close to its chest and revealing the auction results in rather general terms, UNR disclosed last week that there were 17 bidders at the three-day event, which ran in late April.

It said “between 10 and 20 bidders came away as winners”, which I assume we have to interpret as “between 10 and 17”.

Anyone predicting a bulk purchase by a rival portfolio registry was dead wrong, it appears.

UNR said that, while it will not disclose their identities, “established registries, investment firms, blockchain companies, and high net-worth individuals” were among the winners.

None of the ICANN Registry Agreements have yet changed hands, according to ICANN records.

While existing registries and investment firms (presumably the kind of private equity interests that have shown high levels of interest in the domain industry in recent years) will come as no surprise as buyers, blockchain companies and high net-worth individuals will perhaps raise more eyebrows.

ICANN won’t, to the best of my knowledge, sign an RA with an individual, so we’ll no doubt be seeing a corporate vehicle or two established to take over contracts on behalf of those buyers.

The idea of a blockchain company taking over a TLD in the internet’s official root zone is particularly interesting.

The closest we’ve had to that scenario to date is MMX’s experiments integrating .luxe into the Ethereum blockchain, which has been described as genuinely innovative.

But most forays by blockchain outfits into “domain names” have been strictly alt-root moves, such as Unstoppable Domains’ use of .crypto addresses, which do not use the ICANN root and instead require browser plug-ins to function.

These kinds of services usually have their ability to avoid centralized oversight and control as a USP, which makes an attempt from this sector to suck on the ICANN teat especially intriguing.

And which of UNR’s TLDs would be most suited to blockchain applications? .link? .click? .lol?

UNR has not broken down how much was paid for each TLD, and we’ll likely never know, but the $40 million top-line is far above the $11.65 million minimum opening bids it had established for the no-reserve auction.

But it still works out as under $2 million on average across each of the 23 gTLDs on offer, many of which had been on the market for six or seven years, begging the question of whether UNR CEO Frank Schilling’s big bet on new gTLDs back in 2012 was ultimately a success.

Schilling said in a press release: “All UNR shareholders should be exceptionally pleased with the final outcome of this first-of-its-kind event. We are deeply satisfied to have seen so much new interest and blood enter the arena.”

The TLDs auctioned were: .audio, .blackfriday, .christmas, .click, .country, .diet, .flowers, .game, ,guitars, .help, .hiphop, .hiv, .hosting, .juegos, .link, .llp, .lol, .mom, .photo, .pics, .property, .sexy and .tattoo.

DI will of course reveal the winners over time as their ICANN contracts are updated to reflect the new operators.

ICANN name servers come under attack

ICANN’s primary name servers came under a distributed denial of service attack, the Org said earlier this week.

The incident appears to have gone largely unnoticed outside of ICANN and seems to have been successfully mitigated before causing any significant damage.

ICANN said on its web site:

ICANN was subjected to a Distributed Denial of Service (DDoS) attack targeting NS.ICANN.ORG. This event did not result in harm to the organization. It was mitigated by redirecting traffic flows through a DDoS scrubbing service.

ns.icann.org is the address of ICANN’s name servers, which handle queries to ICANN-owned domains such as icann.org and iana.org.

The servers are also authoritative for Ugandan ccTLD .ug for some reason, and until a few years ago also handled the .int special-purpose TLD and sponsored gTLD .museum.

ICANN did not disclosed the exact date of the attack, nor speculate about whether it was targeted and why it might have happened.

Net4 nightmare almost over as court rules ICANN can shut down chaotic registrar

ICANN is finally moving to shut down Net 4 India’s gTLD domains business, after months of upheaval and thousands of customer complaints.

An Indian insolvency court this week lifted its ban on ICANN terminating Net4’s registrar contract, after ICANN appealed to it with a wealth of evidence showing how critical services such as hospitals and train services were being harmed by registrants being unable to transfer their domains away.

ICANN has now invoked its De-Accredited Registrar Transition Procedure, which will see Net4’s tens of thousands of gTLD domains transferred to a different, more stable registrar, according to head of compliance Jamie Hedlund.

The Org had terminated Net4’s contract in February after hearing from thousands of customers whose names had ceased to work, expired, or were locked-in to Net4 due to its broken transfers function.

But the Delhi court handling the registrar’s insolvency asked ICANN in March to delay the termination at the behest of the resolution professional attempting to extract as much value as possible from Net4 in service of its creditors.

That order was lifted orally after a hearing on Tuesday, according to ICANN.

Under the DARTP, either the dying registrar picks a successor or ICANN picks one, either from a rotation of pre-approved registrars or by rolling out a full registrar application process.

Given the timing crisis, and Net4’s irresponsible behavior to date, it appears most likely that ICANN will hand-pick a gaining registrar from the pre-qualified pool.

Hedlund blogged that ICANN expects to name Net4’s successor within two weeks, after which the gaining registrar will reach out to registrants to inform them how to proceed.

Registrants will not be charged for the bulk transfer.

Net4 had over 70,000 gTLD domains under management at the end of 2020, but this number has likely decreased in the intervening time.

ccTLDs such as India’s .in will not be covered by the bulk transfer. It will be up to local registry NIXI to minimize disruption for Net4’s .in registrants.

Price caps on .org could return, panel rules

ICANN could be forced to reimpose price caps on .org, .biz and .info domains, an Independent Review Process panel has ruled.

The panel handling the IRP case filed by Namecheap against ICANN in February 2020 has decided to allow the registrar to continue to pursue its claims that ICANN broke its own bylaws by removing price controls from the three gTLD contracts.

Conversely, in a win for ICANN, the panel also threw out Namecheap’s demand that the IRP scrutinize ICANN’s conduct during the attempted takeover of .org’s Public Interest Registry by Ethos Capital in 2019.

The split ruling (pdf) on ICANN’s motion to dismiss Namecheap’s case came March 10 and was revealed in documents recently published by ICANN. The case will now proceed on the pricing issue alone.

The three-person panel decided that the fact that ICANN ultimately decided to block Ethos’ acquisition of PIR meant that Namecheap lacked sufficient standing to pursue that element of its case.

Namecheap had argued that ICANN’s opaque processing of PIR’s change of control request created uncertainty that harmed its business, because ICANN may approve such a request in future.

But the panel said it would not prejudge such an eventuality, saying that if another change of control is approved by ICANN in future, Namecheap is welcome to file another IRP complaint at that time.

“Harm or injury flowing from possible future violations by the ICANN Board regarding change of control requests that are not presently pending and that may never occur does not confer standing,” the panel wrote.

On the pricing issue, the panel disagreed with ICANN’s argument that Namecheap has not yet been harmed by a lack of .org price caps because PIR has not yet raised its .org prices.

It said that increased prices in future are a “natural and expected consequence” of the lack of price controls, and that to force Namecheap to wait for such increases to occur before filing an IRP would leave it open to falling foul of the 12-month statute of limitations following ICANN decision-making baked into the IRP rules.

As such, it’s letting those claims go ahead. The panel wrote:

This matter will proceed to consideration of Namecheap’s request for a declaration that ICANN must annul the decision that removed price caps in the .org, .info and .biz registry agreements. The Panel will also consider Namecheap’s request for a declaration that ICANN must ensure that price caps from legacy gTLDs can only be removed following policy development process that takes due account of the interests of the Internet user and with the involvement of different stakeholders. The Panel will consider Namecheap’s request for a declaration that “registry fees… remain as low as feasible consistet with the maintenance of good quality service” within the context of removal of price caps (not in the context of regulating changes of control).

In other words, if Namecheap prevails, future price caps for pre-2012 gTLDs could be decided by the ICANN community, with an assumption that they should remain as low as possible.

That would be bad news for PIR, as well as .info registry Donuts and .biz registry GoDaddy.

But it’s important to note that the IRP panel has not ruled that ICANN has done anything wrong, nor that Namecheap is likely to win its case — the March 10 ruling purely assesses Namecheap’s standing to pursue the IRP.

The panel has also significantly extended the proposed timeline for the case being resolved. There now won’t be a final decision until 2022 at the earliest.

The panel last week delayed its final hearing in the case from August this year to January next year, according to a document published this week.

Other deadlines in the case have also been pushed backed weeks or months.

DNS genius and ICANN key-holder Dan Kaminsky dies at 42

Security researcher Dan Kaminsky, best known for uncovering the so-called “Kaminsky Bug” DNS vulnerability, has reportedly died at the age of 42.

It has been widely reported that Kaminsky’s niece confirmed his death from serious complications from his longstanding diabetes.

On Twitter, she rebutted emerging conspiracy theories that his death was linked to the coronavirus vaccine, which he had received April 12, saying her uncle would “laugh” at such views.

During his career as a white-hat hacker, Kaminsky worked for companies including Cisco, Avaya, and IOActive.

He occasionally spoke at ICANN meetings on security issues, and was since 2010 one of IANA’s seven Recovery Key Share Holders, individuals trusted to hold part of a cryptographic key that would be used to reboot root zone DNSSEC in the case of a massive disaster.

But he was best known for his 2008 discovery of a fundamental flaw in the DNS protocol that allowed cache poisoning, and therefore serious man-in-the middle attacks, across millions of name servers worldwide. He worked with DNS software vendors in private to help them with their patches before the problem was publicly disclosed.

His discoveries led in part to the ongoing push for DNSSEC deployment across the internet.

The vulnerability received widespread attention, even in the mainstream media, and quickly came to bear his name.

For me, my standout memory of Kaminsky is one of his series of annual “Black Ops” talks, at the Defcon 12 conference in Las Vegas in 2004, during which he demonstrated to a rapt audience of hackers how it was possible to stream live radio by caching small chunks of audio data in the TXT fields of DNS records and using DNS queries to quickly retrieve and play them in sequence.

As well as being a bit of a DNS genius, he knew how to work a stage: the crowd went mental and I grabbed him for an interview soon after his talk was over.

His death at such a young age is a big loss for the security community.

.gov TLD quietly changes hands

The .gov TLD used exclusively by governmental entities in the US has quietly changed managers.

On Friday, the IANA records for .gov changed from the General Services Administration to the Cybersecurity and Infrastructure Security Agency.

It was not unexpected. CISA announced the move in March.

But it’s less clear how the change request was handled. The ICANN board of directors certainly didn’t have a formal vote on the matter. IANA has not released a redelegation report as it would with a ccTLD.

CISA intends to make .gov domains more widely available to agencies at the federal, state, city and tribal level, and reduce the price to free or almost free.

Verisign currently manages the technical aspects of the domain, for $400 per domain per year.