New gTLDs slip again in Q1

The number of domains registered in new gTLDs slipped again in the first quarter, but it was not as bad as it could have been.
Verisign’s latest Domain Name Industry Brief, out today, reports that new gTLD domains dropped by 800,000 sequentially to end March at a round 23.0 million.
It could have been worse.
New gTLD regs in Q1 were actually up compared to the same period last year, by 2.8 million.
That’s despite the fact that GRS Domains, the old Famous Four portfolio, has lost about three million domains since last August.
Verisign’s own .com was up sequentially by two million domains and at 141 million, up by 7.1 million compared to Q1 2018. But .net’s decline continued. It was down from 14 million in December to 13.8 million in March.
Here’s a chart (click to enlarge) that may help visualize the respective growth of new gTLDs and .com over the last three years. The Y axes are in the millions of domains.

New gTLDs have shrunk sequentially in six of the last 12 quarters, while .com has grown in all but two.
The ccTLD world, despite the woes reported by many European registries, was the strongest growth segment. It was up by 2.5 million sequentially and 10 million compared to a year ago to finish the period with 156.8 million.
But once you factor out .tk, the free TLD that does not delete expired or abusive names, ccTLDs were up by 1.4 million sequentially and 7.8 million on last year.

Major registries posting “fabricated” Whois data

One or more of the major gTLD registries are publishing Whois query data that may be “fabricated”, according to some of ICANN’s top security minds.
The Security and Stability Advisory Committee recently wrote to ICANN’s top brass to complain about inconsistent and possibly outright bogus reporting of Whois port 43 query volumes.
SSAC said (pdf):

it appears that the WHOIS query statistics provided to ICANN by registry operators as part of their monthly reporting obligations are generally not reliable. Some operators are using different methods to count queries, some are interpreting the registry contract differently, and some may be reporting numbers that are fabricated or otherwise not reflective of reality. Reliable reporting is essential to the ICANN community, especially to inform policy-making.

SSAC says that the inconsistency of the data makes it very difficult to make informed decisions about the future of Whois access and to determine the impact of GPDR.
While the letter does not name names, I’ve replicated some of SSAC’s research and I think I’m in a position to point fingers.
In my opinion, Google, Verisign, Afilias and Donuts appear to be the causes of the greatest concern for SSAC, but several others exhibit behavior SSAC is not happy about.
I reached out to these four registries on Wednesday and have published their responses, if I received any, below.
SSAC’s concerns relate to the monthly data dumps that gTLD registries new and old are contractually obliged to provide ICANN, which publishes the data three months later.
Some of these stats concern billable transactions such as registrations and renewals. Others are used to measure uptime obligations. Others are largely of academic interest.
One such stat is “Whois port 43 queries”, defined in gTLD contracts as “number of WHOIS (port-43) queries responded during the reporting period”.
According to SSAC, and confirmed by my look at the data, there appears to be a wide divergence in how registries and back-end registry services providers calculate this number.
The most obvious example of bogosity is that some registries are reporting identical numbers for each of their TLDs. SSAC chair Rod Rasmussen told DI:

The largest issue we saw at various registries was the reporting of the exact or near exact same number of queries for many or all of their supported TLDs, regardless of how many registered domain names are in those zones. That result is a statistical improbability so vanishingly small that it seems clear that they were reporting some sort of aggregate number for all their TLDs, either as a whole or divided amongst them.

While Rasmussen would not name the registries concerned, my research shows that the main culprit here appears to be Google.
In its December data dumps, it reported exactly 68,031,882 port 43 queries for each of its 45 gTLDs.
If these numbers are to be believed, .app with its 385,000 domains received precisely the same amount of port 43 interest as .gbiz, which has no registrations.
As SSAC points out, this is simply not plausible.
A Google spokesperson has not yet responded to DI’s request for comment.
Similarly, Afilias appears to have reported identical data for a subset of its dot-brand clients’ gTLDs, 16 of which purportedly had exactly 1,071,939 port 43 lookups in December.
Afilias has many more TLDs that did not report identical data.
An Afilias spokesperson told DI: “Afilias has submitted data to ICANN that addresses the anomaly and the update should be posted shortly.”
SSAC’s second beef is that one particular operator may have reported numbers that “were altered or synthesized”. SSAC said in its letter:

In a given month, the number of reported WHOIS queries for each of the operator’s TLDs is different. While some of the TLDs are much larger than others, the WHOIS query totals for them are close to each other. Further statistical analysis on the number of WHOIS queries per TLD revealed that an abnormal distribution. For one month of data for one of the registries, the WHOIS query counts per TLD differed from the mean by about +/- 1%, nearly linearly. This appeared to be highly unusual, especially with TLDs that have different usage patterns and domain counts. There is a chance that the numbers were altered or synthesized.

I think SSAC could be either referring here to Donuts or Verisign
Looking again at December’s data, all but one of Donuts’ gTLDs reported port 43 queries between 99.3% and 100.7% of the mean average of 458,658,327 queries.
Is it plausible that .gripe, with 1,200 registrations, is getting almost as much Whois traffic as .live, with 343,000? Seems unlikely.
Donuts has yet to provide DI with its comments on the SSAC letter. I’ll update this post and tweet the link if I receive any new information.
All of the gTLDs Verisign manages on behalf of dot-brand clients, and some of its own non-.com gTLDs, exhibit the same pattern as Donuts in terms of all queries falling within +/- 1% of the mean, which is around 431 million per month.
So, as I put to Verisign, .realtor (~40k regs) purportedly has roughly the same number of port 43 queries as .comsec (which hasn’t launched).
Verisign explained this by saying that almost all of the port 43 queries it reports come from its own systems. A spokesperson told DI:

The .realtor and .comsec query responses are almost all responses to our own monitoring tools. After explaining to SSAC how Verisign continuously monitors its systems and services (which may be active in tens or even hundreds of locations at any given time) we are confident that the accuracy of the data Verisign reports is not in question. The reporting requirement calls for all query responses to be counted and does not draw a distinction between responses to monitoring and non-monitoring queries. If ICANN would prefer that all registries distinguish between the two, then it is up to ICANN to discuss that with registry operators.

It appears from the reported numbers that Verisign polls its own Whois servers more than 160 times per second. Donuts’ numbers are even larger.
I would guess, based on the huge volumes of queries being reported by other registries, that this is common (but not universal) practice.
SSAC said that it approves of the practice of monitoring port 43 responses, but it does not think that registries should aggregate their own internal queries with those that come from real Whois consumers when reporting traffic to ICANN.
Either way, it thinks that all registries should calculate their totals in the same way, to make apples-to-apples comparisons possible.
Afilias’ spokesperson said: “Afilias agrees that everyone should report the data the same way.”
As far as ICANN goes, its standard registry contract is open to interpretation. It doesn’t really say why registries are expected to collect and supply this data, merely that they are obliged to do so.
The contracts do not specify whether registries are supposed to report these numbers to show off the load their servers are bearing, or to quantify demand for Whois services.
SSAC thinks it should be the latter.
You may be thinking that the fact that it’s taken a decade or more for anyone to notice that the data is basically useless means that it’s probably not all that important.
But SSAC thinks the poor data quality interferes with research on important policy and practical issues.
It’s rendered SSAC’s attempt to figure out whether GDPR and ICANN’s Temp Spec have had an effect on Whois queries pretty much futile, for example.
The meaningful research in question also includes work leading to the replacement of Whois with RDAP, the Registration Data Access Protocol.
Finally, there’s the looming possibility that ICANN may before long start acting as a clearinghouse for access to unredacted Whois records. If it has no idea how often Whois is actually used, that’s going to make planning its infrastructure very difficult, which in turn could lead to downtime.
Rasmussen told DI: “Our impression is that all involved want to get the numbers right, but there are inconsistent approaches to reporting between registry operators that lead to data that cannot be utilized for meaningful research.”

.com zone tops 140 million

The .com zone file passed the 140 million domain milestone for the first time today.
According to Verisign’s own count, today there are 140,016,726 .com names in the file. Yesterday, it had 139,979,307 names.
It’s taken since November 2017 to add the last 10 million names.
Adding registered names not in the zone, what Verisign calls its “Domain Name Base”, .com is currently at 141,857,360 domains.
Meanwhile, .net is continuing to shrink.
It has 13,441,748 names in its zone today, down from an October 2016 peak of over 15.8 million.
The .net domain name base is 13,668,548.
Pretty soon, if the slide continues, Verisign won’t be able to round up to 14 million in its quarterly reports any more.

ICANN redacts the secrets of Verisign’s .web deal

Afilias thinks it has found the smoking gun in its fight to wrestle .web out of the hands of rival Verisign, but for now the details are still a closely guarded secret.
The company recently filed an amended complaint in its Independent Review Process case against ICANN, after it managed to get a hold of the deal that Verisign struck with Nu Dot Co, the company that spent $135 million of Verisign’s money to win .web at auction in 2016.
The Domain Acquisition Agreement, which apparently set out the terms under which NDC would bid for .web on Verisign’s behalf, was revealed during disclosure in December.
But in publishing the amended complaint (pdf) (which seems to have happened in the last week or two), ICANN has whited out all references to the contents of this document.
Afilias claims that the DAA proves that NDC broke the rules of the new gTLD program by refusing to disclose to ICANN that it had essentially become a Verisign proxy:
It claims that ICANN should therefore have disqualified NDC from the .web auction.

Based on the terms of the DAA, it is evident that NDC violated the New gTLD Program Rules. ICANN, however, has refused to disqualify NDC from the .WEB contention set, or to disqualify NDC’s bids in the .WEB Auction.

Afilias came second in the 2016 auction, bidding $135 million. NDC/Verisign won with a $142 million bid, committing it to pay the amount Afilias was willing to pay.
While Verisign has said that it plans to market .web, Afilias believes that Verisign’s primary motivation at the auction was to essentially kill off what could have been .com’s biggest competitor. It says in its amended complaint:

ICANN has eviscerated one of the central pillars of the New gTLD Program and one of ICANN’s founding principles: to introduce and promote competition in the Internet namespace in order to break VeriSign’s monopoly

Whether the DAA reveals anything we do not already know is an open question, but Afilias reckons ICANN’s prior failure to disclose its contents represents a failure of its commitment to transparency.
Reading between the lines, it seems Afilias is claiming that ICANN got hold of the DAA some time before it was given to Afilias in discovery last December, but that ICANN “had refused to provide the DAA (or even confirm its existence)”.
By redacting its contents now, ICANN is helplessly playing into the narrative that it’s trying to cover something up.
But ICANN is probably not to blame for the redactions. It was ICANN holding the axe, yes, but it was Verisign that demanded the cuts.
ICANN said in its basis for redactions document (pdf) that it “has an affirmative obligation to redact the information designated as confidential by the third party(ies) unless and until said third party authorizes the public disclosure of such information.”
Afilias has also managed to put George Sadowsky, who for the best part of the last decade until his October departure was one of ICANN’s most independent-minded directors, on the payroll.
In his testimony (pdf), he apparently reveals some details of the ICANN boards private discussions about the .web case.
Guess what? That’s all redacted too, unilaterally this time, by ICANN.

ICA rallies the troops to defeat .org price hikes. It won’t work

Over 100 letters have been sent to ICANN opposing the proposed lifting of price caps in .org, after the Internet Commerce Association reached out to rally its supporters.
This is an atypically large response to an ICANN public comment period, and there are four days left on the clock for more submissions to be made, but I doubt it will change ICANN’s mind.
Almost all of the 131 comments filed so far this month were submitted in the 24 hours after ICA published its comment submission form earlier this week.
About a third of the comments comprise simply the unedited ICA text. Others appeared to have been inspired by the campaign to write their own complaints about the proposal, which would scrap the 10%-a-year .org price increase cap Public Interest Registry currently has in place.
Zak Muscovitch, ICA’s general counsel, told DI that as of this morning the form generates different template text dynamically. I’ve spotted at least four completely different versions of the letter just by refreshing the page. This may make some comments appear to be the original thoughts of their senders.
This is the original text, as it relates to price caps:

I believe that legacy gTLDs are fundamentally different from for-profit new gTLDs. Legacy TLDs are essentially a public trust, unlike new gTLDs which were created, bought and paid for by private interests. Registrants of legacy TLDs are entitled to price stability and predictability, and should not be subject to price increases with no maximums. Unlike new gTLDs, registrants of legacy TLDs registered their names and made their online presence on legacy TLDs on the basis that price caps would continue to exist.
Unrestrained price increases on the millions of .org registrants who are not-for-profits or non-profits would be unfair to them. Unchecked price increases have the potential to result in hundreds of millions of dollars being transferred from these organizations to one non-profit, the Internet Society, with .org registrants receiving no benefit in return. ICANN should not allow one non-profit nearly unlimited access to the funds of other non-profits.

The gist of the other texts is the same — it’s not fair to lift price caps on domains largely used by non-profits that may have budget struggles and which have built their online presences on the old, predictable pricing rules.
The issues raised are probably fair, to a point.
Should the true “legacy” gTLDs — .com, .net and .org — which date from the 1980s and pose very little commercial risk to their registries, be treated the same as the exceptionally risky gTLD businesses that have been launched since?
Does changing the pricing rules amount to unfairly moving the goal posts for millions of registrants who have built their business on the legacy rules?
These are good, valid questions.
But I think it’s unlikely that the ICA’s campaign will get ICANN to change its mind. The opposition would have to be broader than from a single interest group.
First, the message about non-profits rings a bit hollow coming from an explicitly commercial organization whose members’ business model entails flipping domain names for large multiples.
If a non-profit can’t afford an extra 10 bucks a year for a .org renewal, can it afford the hundreds or thousands of dollars a domainer would charge for a transfer?
Even if PIR goes nuts, abandons its “public interest” mantra, and immediately significantly increases its prices, the retail price of a .org (currently around $20 at GoDaddy, which has about a third of all .orgs) would be unlikely to rise to above the price of PIR-owned .ong and .ngo domains, which sell for $32 to $50 retail.
Such an increase might adversely affect a small number of very low-budget registrants, but the biggest impact will be felt by the big for-profit portfolio owners: domainers.
Second, letter-writing campaigns don’t have a strong track record of persuading ICANN to change course.
The largest such campaign to date was organized by registrars in 2015 in response to proposals, made by members of the Privacy and Proxy Services Accreditation Issues working group, that would have would have essentially banned Whois privacy for commercial web sites.
Over 20,000 people signed petitions or sent semi-automated comments opposing that recommendation, and ICANN ended up not approving that specific proposal.
But the commercial web site privacy ban was a minority position written by IP lawyers, included as an addendum to the group’s recommendations, and it did not receive the consensus of the PPSAI working group.
In other words, ICANN almost certainly would not have implemented it anyway, due to lack of consensus, even if the public comment period had been silent.
The second-largest public comment period concerned the possible approval of .xxx in 2010, which attracted almost 14,000 semi-automated comments from members of American Christian-right groups and pornographers.
.xxx was nevertheless approved less than a year later.
ICANN also has a track record of not acceding to ICA’s demands when it comes to changes in registry agreements for pre-2012 gTLDs.
ICA, under former GC Phil Corwin, has also strongly objected to similar changes in .mobi, .jobs, .cat, .xxx and .travel over the last few years, and had no impact.
ICANN seems hell-bent on normalizing its gTLD contracts to the greatest extent possible. It’s also currently proposing to lift the price caps on .biz and .info.
This, through force of precedent codified in the contracts, could lead to the price caps one day, many years from now, being lifted on .com.
Which, let’s face it, is what most people really care about.
Info on the .org contract renewal public comment period can be found here.

.com outsells new gTLDs by 2:1 in 2018

The number of registered .com domains increased by more than double the growth of all new gTLDs last year, according to figures from Verisign.
The latest Domain Name Industry Brief reports that .com grew by 7.1 million names in 2018, while new gTLDs grew by 3.2 million names.
.com ended the year with 139 million registered names, while the whole new gTLD industry finished with 23.8 million.
It wasn’t all good news for Verisign, however. Its .net gTLD shrunk by 500,000 names over the period, likely due to the ongoing impact of the new gTLD program.
New gTLDs now account for 6.8% of all registered domains, compared to 6.2% at the end of 2017, Verisign’s numbers state.
Country codes fared better than .com in terms of raw regs, growing by 8.2 million domains to finish 2018 with 154.3 million names.
But that’s including .tk, the free ccTLD where dropping or abusive domains are reclaimed and parked by the registry and never expire.
Excluding .tk, ccTLDs were up by 6.6 million names in the year. Verisign estimates .tk as having a modest 21.5 million names.
The latest DNIB, and quarterly archives, can be downloaded from here.

Root servers whacked after crypto change

The DNS root servers came under accidental attack from name servers across the internet following ICANN’s recent changes to their cryptographic master keys, according to Verisign.
The company, which runs the A and J root servers, said it saw requests for DNSSEC data at the root increase from 15 million a day in October to 1.15 billion a day a week ago.
The cause was the October 11 root Key Signing Key rollover, the first change ICANN had made to the “trust anchor” of DNSSEC since it came online at the root in 2010.
The KSK rollover saw ICANN change the cryptographic keys that rest at the very top of the DNSSEC hierarchy.
The move was controversial. ICANN delayed it for a year after learning about possible disruption at internet endpoints. Its Security and Stability Advisory Committee and even its own board were not unanimous that the roll should go ahead.
But the warnings were largely about the impact on internet users, rather than on the root servers themselves, and the impact was minimal.
Verisign is now saying that requests to its roots for DNSSEC key data increased from 15 million per day to 75 million per day, a five-fold increase, almost overnight.
It was not until January, when the old KSK was marked as “revoked”, did the seriously mahooosive traffic growth begin, however. Verisign’s distinguished engineer Duane Wessels wrote:

Everyone involved expected this to be a non-event. However, we instead saw an even bigger increase in DNSKEY queries coming from a population of root server clients. As of March 21, 2019, Verisign’s root name servers receive about 1.15 billion DNSKEY queries per day, which is 75 times higher than pre-rollover levels and nearly 7 percent of our total steady state query traffic.

Worryingly, the traffic only seemed to be increasing, until March 22, when the revoked key was removed from the root entirely.
Wessels wrote that while the root operators are still investigating, “it would seem that the presence of the revoked key in the zone triggered some unexpected behavior in a population of validating resolvers.”
The root operators hope to have answers in the coming weeks, he wrote.
The next KSK rollover is not expected for years, and the root traffic is now returning to normal levels, so there’s no urgency.

The DNS’s former overseer now has its own domain name

The National Telecommunications and Information Administration, which for many years was the instrument of the US government’s oversight of the DNS root zone, has got its first proper domain name.
It’s been operating at ntia.doc.gov forever, but today announced that it’s upgrading to the second-level ntia.gov.
The agency said the switch “will make NTIA’s site consistent with most other Department of Commerce websites”.
Staff there will also get new ntia.gov email addresses, starting from today. Their old addresses will continue to forward.
NTIA was part of the DNS root management triumvirate, along with ICANN/IANA and Verisign, until the IANA transition in 2016.
The agency still has a contractual relationship with Verisign concerning the operation of .com.

Verisign gets approval to sell O.com for $7.85

ICANN is to grant Verisign the right to sell a single-character .com domain name for the first time in over 25 years.
The organization’s board of directors is due to vote next Thursday to approve a complex proposal that would see Verisign auction off o.com, with almost all of the proceeds going to good causes.
“Approval of Amendment to Implement the Registry Service Request from Verisign to Authorize the Release for Registration of the Single-Character, Second-Level Domain, O.COM” is on the consent agenda for the board’s meeting at the conclusion of ICANN 64, which begins Saturday in Kobe, Japan.
Consent agenda placement means that there will likely be no further discussion — and no public discussion — before the board votes to approve the deal.
Verisign plans to auction the domain to the highest bidder, and then charge premium renewal fees that would essentially double the purchase price over a period of 25 years.
But the registry, already under scrutiny over its money-printing .com machine, would be banned from profiting from the sale.
Instead, Verisign would only receive its base registry fee — currently $7.85 per year — with the rest being held by an independent third party that would distribute the funds to worthy non-profit causes.
ICANN had referred the Verisign proposal, first put forward in December 2016, to the US government, and the Department of Justice gave it the nod in December 2017.
There was also a public comment period last May.
The request almost certainly came about due to Overstock.com’s incessant lobbying. The retailer has been obsessed with obtaining o.com for well over a decade, but was hamstrung by the legacy policy, enshrined in the .com registry agreement, that forbids the sale of single-character domains.
Whoever else wants to buy o.com, they’ll be bidding against Overstock, which has a trademark.
It’s quite possible nobody else will bid.
When Overstock briefly rebranded as O.co several years ago — it paid $350,000 for that domain — it said it saw 61% of its traffic going to o.com instead.
All single-character .com names that had not already been registered were reserved by IANA for technical reasons in 1993, well before ICANN took over DNS policy.
Today, only q.com, z.com and x.com are registered. Billionaire Elon Musk, who used x.com to launch PayPal, reacquired that domain for an undisclosed sum in 2017. GMO Internet bought z.com for $6.8 million in 2014.
With the sale of o.com now a near certainty, it is perhaps only a matter of time before more single-character .com names are also released.
No gTLD approved after 2012 has a restriction on single-character domains.
As a matter of disclosure: several years ago I briefly provided some consulting/writing services to a third party in support of the Verisign and Overstock positions on the release of single-character domain names, but I have no current financial interest in the matter.

New gTLDs continue growth trend, but can it last?

New gTLDs continued to bounce back following a year-long slump in registration volumes, according to Verisign data.
The company’s latest Domain Name Industry Brief, covering the third quarter, shows new gTLDs growing from 21.8 million names to 23.4 million names, a 1.6 million name increase.
New gTLDs also saw a 1.6 million-name sequential increase in the second quarter, which reversed five quarters of declines.
The sector has yet to surpass its peak of 25.6 million, which it reached in the fourth quarter of 2016.
It think it will take some time to get there, and that we’ll may well see a decline in next couple quarters.
The mid-point of the third quarter marked the end of deep discounting across the former Famous Four Media (now GRS Domains) portfolio (.men, .science, .loan, etc), but the expected downward pressure on volumes wasn’t greatly felt by the end of the period.
With GRS’s portfolio generally on the decline so far in Q4, we might expect it to have a tempering effect on gains elsewhere when the next DNIB is published.
Verisign’s data showed also that ccTLDs shrunk for the first time in a couple years, down by half a million names to 149.3 million. Both .uk and .de suffered six-figure losses.
Its own .net was flat at 14.1 million, showing no signs of recovery after several quarters of shrinkage, while .com increased by two million names to finish September with 137.6 under management.