VeriSign takes over .gov

VeriSign has taken over registry functions at .gov, the top-level domain for the US government.
IANA records show that VeriSign Global Registry Services was named technical contact for .gov possibly as recently as this Monday.
The TLD is still administratively delegated to the US General Services Administration. Google’s cache of the IANA site shows the GSA was the technical contact for .gov as recently as October 29.
VeriSign certainly kept this contract win quiet.
At least, the first I heard about it was tonight, in an email VeriSign sent to the dns-ops mailing list, asking DNS administrators to reconfigure their DNSSEC set-up to reflect the change.

A KSK [Key Signing Key] roll for the .gov zone will occur at the end of January, 2011. This key change is necessitated by a registry operator transition: VeriSign has been selected by the U.S. General Services Administration (GSA) to operate the domain name registry for .gov.

The email expresses the urgency of making the changes, which are apparently needed in part because .gov was signed with DNSSEC before the root zone was signed, and some resolvers may be configured to use .gov as a “trust anchor” instead of the root.
The .gov TLD is reserved for the exclusive use of US federal and state government departments and agencies.
It’s certainly a prestige contract for VeriSign.
This appears to be the GSA page awarding the contract to VeriSign, in September, following an RFP. It’s valued at $3,325,000.

Go Daddy plans Premium DNS service

Go Daddy is to launch a Premium DNS service that will include managed DNSSEC security, the company revealed during sessions at the ICANN meeting in Cartagena last week.
Go Daddy customers can currently get a brief overview of the forthcoming service by logging into their domain manager and finding the Premium DNS “Coming Soon” link, or looking here.
During a session on DNSSEC in Colombia last week, Go Daddy’s James Bladel laid out more detail on the service in a presentation (PDF) which contains screenshots of the interface.
The company started supporting DNSSEC for free on certain TLDs in the summer – it currently supports .net, .biz, .eu, org and .us – but it requires users to manually generate and manage cryptographic keys.
That’s beyond the ken of most domain name owners, so the registrar is adding a premium “set it and forget it” service which will see Go Daddy manage the complexities of DNSSEC.
Bladel said of the service:

it’s as simple as having a DNSSEC on/off switch. So customers who have no particular interest in the behind- the-scenes technology of DNSSEC can simply flip that switch and then enjoy the benefits of a secured domain name.

The DNSSEC standard helps prevent domains being hijacked through cache poisoning attacks by signing each domain’s zone with a validatable cryptographic key. The technology will be available for .com domains early next year.
It’s by no means free or easy for registrars to implement, and there’s been little demand for the technology among registrants, so I’ve been wondering how registrars planned to monetize it.
Now we know how Go Daddy at least plans to do so – the Premium DNS service will have other benefits beyond DNSSEC, which could spur adoption through osmosis.
The service will also include DNS up-time guarantees of 99.999%, vanity name servers, log tracking, and several other perks.
The company has not officially announced the service to customers yet, so I expect we’ll find out more details in due course.

VeriSign launches free cloud domain security service

VeriSign is to offer registrars a hosted DNSSEC signing service that will be free for names in .com and the company’s other top-level domains.
The inventively named VeriSign DNSSEC Signing Service offloads the tasks associated with managing signed domains and is being offered for an “evaluation period” that runs until the end of 2011.
DNSSEC is an extension to DNS that allows domains to be cryptographically signed and validated. It was designed to prevent cache poisoning attacks such as the Kaminsky Bug.
It’s also quite complex, requiring ongoing secure key management and rollover, so I expect the VeriSign service, and competing services, will be quite popular among registrars reluctant to plough money into the technology.
While some gTLDs, including .org, and dozens of ccTLDs, are already DNSSEC-enabled, VeriSign doesn’t plan on bringing the technology online in .com and .net until early next year.
The ultimate industry plan is for all domain names to use DNSSEC before too many years.
One question I’ve never been entirely clear on was whether the added costs of implementing DNSSEC would translate into premium-priced services or price increases at the registrar checkout.
A VeriSign spokesperson told me:

The evaluation period is free for VeriSign-managed TLDs and other TLDs. After that period, the VeriSign-managed TLDs will remain free, but other TLDs will have $2 per zone annual fee.

In other words, registrars will not have to pay to sign their customers’ .com, .net, .tv etc domains, but they will have to pay if they choose to use the VeriSign service to sign domains in .biz, .info or any other TLD.

Domain universe breaks through 200 million

VeriSign is reporting that the number of registered domain names worldwide broke through the 200 million mark in the third quarter.
There were 202 million domains at the end of September, according to the company’s Domain Name Industry Brief, which was published today.
Over half of those domains, 103 million names in total, can be found in the .com and .net namespaces that VeriSign manages.
In a not-so-subtle plug for VeriSign’s 2011 growth strategy, the company also declared that the next ten years will be “The Decade of the International Internet”.

In the coming decade, the Internet will continue to become a ubiquitous, multi-cultural tool, fueled in part by the adoption of IDNs. By enabling online content and businesses to be represented in local scripts and languages, IDNs help the Internet to expand the power of technology to regions and cultures, and connect the world in new ways. Over the past year, several new IDNs for ccTLDs have been approved. The next step will be approval of IDNs for generic Top Level Domains (gTLDs).

The company, of course, plans to apply to ICANN to operate IDN versions of .com and .net, although it has not to date discussed openly which languages or strings it wants.
The VeriSign report also says that ccTLD registrations grew 2.4%, compared to the same quarter last year, to 79.2 million domains.
I expect this growth would have been tempered had it not been for the relaunch of .co, which occurred during the quarter, but it does not merit a mention in the report.
The report also reveals that .info has overtaken .cn in the biggest-TLD charts, although this is due primarily to the plummeting number of registrations in the Chinese ccTLD.

ICANN had no role in seizing torrent domains

Okay, this is getting a bit silly now.
As you may have read, the US government “seized” a bunch of domain names that were hosting sites allegedly involved in piracy and counterfeit goods over the Thanksgiving weekend.
Over 80 domains, all of them in the .com namespace, had their DNS settings reconfigured to point them to a scary-looking notice from the Department of Homeland Security’s ICE division.
Somehow, in several reports over the last few days, this has been pinned on ICANN, and now some pro-piracy advocates are talking about setting up alternate DNS roots as a result.
Claims that ICANN colluded with the DHS on the seizures seem to have first appeared in TorrentFreak, which broke the news on Friday.
The site quoted the owner of torrent-finder.com:

“I firstly had DNS downtime. While I was contacting GoDaddy I noticed the DNS had changed. Godaddy had no idea what was going on and until now they do not understand the situation and they say it was totally from ICANN.”

For anyone involved in the domain name industry and the ICANN community, this allegation screams bogosity, but just to be on the safe side I checked with ICANN.
A spokesperson told me he’s checked with ICANN’s legal, security and compliance departments and they all had this to say:

ICANN had nothing to do with the ICE investigation… nobody knew anything about this and did not take part in the investigation.

All of the seized domains were .coms, and obviously ICANN has no technical authority or control over second-level .com domains. It’s not in the position to do what the reports allege.
If anybody were to ask ICANN to yank a domain, all it could do would be to politely forward the request to the registrar (in the case of torrent-finder.com, apparently Go Daddy) or the registry operator, which in the case of .com is of course VeriSign.
It would make more sense, save more time, and be less likely to create an international political incident, for the DHS to simply go directly to Go Daddy or VeriSign.
Both are US companies, and the DHS did have legal warrants, after all.
That’s almost certainly what happened here. I have requests for comment in with both companies and will provide updates when I have more clarity.
In the meantime, I suggest that any would-be pirates might be better served by switching their web sites to non-US domains, rather than trying to build an alternate root system from the ground up.
UPDATE: Ben Butler, Go Daddy’s director of network abuse, has just provided me with the following statement, via a spokesperson:

It appears the domain names were locked directly by VeriSign. Go Daddy has not received any law enforcement inquiries or court orders concerning the suspension of the domains in question.
Go Daddy has not been contacted by ICE or DHS on the domain names in question.

The statement goes on to say that Go Daddy believes that it should be the registrar’s responsibility to handle such takedown notices.

With regard to the registry taking action against the domain names in question, Go Daddy believes the proper process lies with the registrar and not the registry. This gives the registrar the ability to communicate with their customer about what has happened and why. When the registry acts, Go Daddy is unable to provide any information to our customers regarding the seizure of their domain names.
Go Daddy routinely cooperates with government and law enforcement officials to enforce and comply with the law.

I’ll post any statement I receive from VeriSign when I have it.
UPDATE: VeriSign sent this statement:

VeriSign received sealed court orders directing certain actions to be taken with respect to specific domain names, and took appropriate actions. Because the orders are sealed, further questions should be directed to the U.S. Department of Homeland Security.

ICANN drops the bomb – registries can buy registrars

ICANN has just authorized the biggest shake-up of the domain name industry in a decade, lifting all the major cross-ownership restrictions on registrars and registries.
A surprise resolution passed on Friday at the ICANN board’s retreat could enable registries such as VeriSign to acquire registrars such as Go Daddy, and vice-versa.
The new rules will also allow registrars to apply for and run new top-level domains and, subject to additional conditions, may enable existing registries to eventually start selling direct to end users, potentially bypassing the registrar channel.
The implications of these changes could be enormous, and I expect they could be challenged by affected parties.
The board resolved that ICANN “will not restrict cross-ownership between registries and registrars”, subject to certain yet-to-be written Code of Conduct for preventing abuse.
These looser ownership restrictions will be included in the new TLD Applicant Guidebook. Existing registries will be able to transition to the new rules over time through contract changes.
ICANN will develop mechanisms for enforcing anti-abuse rules through contractual compliance programs, and will have the ability to refer cross-ownership deals to competition authorities.

These provisions may be enhanced by additional enforcement mechanisms such as the use of self-auditing requirements, and the use of graduated sanctions up to and including contractual termination and punitive damages.

The decision appears to have been made partly on the grounds that while almost all existing registry contracts include strict cross-ownership restrictions, it has never been a matter of formal policy.
A vertical integration working group which set out to create a bottom-up consensus policy earlier this year managed to find only deadlock.
ICANN chairman Peter Dengate Thrush said:

In the absence of existing policy or new bottom-up policy recommendations, the Board saw no rationale for placing restrictions on cross-ownership. Any possible abuses can be better addressed by properly targeted mechanisms. Co-ownership rules are not an optimal technique in this area.

Most members of the VI working group broadly favored some level of cross-ownership restriction, such as a 15% cap, while a smaller number favored the “free trade” position that ICANN seems to have gone for.
The companies campaigning hardest against cross-ownership being permitted were arguably Afilias and Go Daddy, though the likes of NeuStar and VeriSign also favored some restrictions.
Opponents of integrating registry and registrar functions argued that giving registrars access to registry data would harm consumers; others countered that this was best addressed through compliance programs rather than ownership caps.
The big winners from this announcement are the start-up new TLD registries, which will not be forced to work exclusively within the existing registrar channel in order to sell their domains.

VeriSign to deploy DNSSEC in .com next March

VeriSign is to start rolling out the DNSSEC security protocol in .net today, and will sign .com next March, the company said today.
In an email to the dns-ops mailing list, VeriSign vice president Matt Larson said that .net will get a “deliberately unvalidatable zone”, which uses unusable dummy keys for testing purposes, today.
That test is set to end on December 9, when .net will become fully DNSSEC-compatible.
The .com TLD will get its own unvalidatable zone in March, but registrars will be able to start submitting cryptographic keys for the domains they manage from February.
The .com zone will be validatable later in March.
The DNSSEC standard allows resolvers to confirm that DNS traffic has not been tampered with, reducing the risk of attacks such as cache poisoning.
Signing .com is viewed as the last major registry-level hurdle to jump before adoption kicks off more widely. The root zone was signed in July and a few dozen other TLDs, such as .org, are already signed.

Will ITU object to phone number .tel domains?

Should Telnic be allowed to let people register their phone numbers as .tel domain names?
That’s the question ICANN is currently posing to the internet-using public, after it determined that allowing numeric-only .tel domains does not pose a security and stability threat.
If you can register a phone number in almost every other gTLD (except VeriSign’s .name), then why not in .tel? On the face of it, it’s a no-brainer.
But Telnic’s request represents a huge U-turn, reversing a position it has held for 10 years, that runs the risk of drawing the attention of the International Telecommunications Union.
Telnic originally applied for .tel during ICANN’s very first new gTLD round, back in 2000.
The third-party evaluator ICANN hired to review the new TLD applications clearly assumed that .tel domains would be mainly text-based, noting that Telnic, unlike other .tel bids:

does not make use of phone numbers in the sub-domain name, but instead uses names to designate the intended destination of VoIP calls… the Telnic application appears to have the least impact on PSTN numbering.

The report added, parenthetically: “It should be noted that Telnic’s application does not explicitly renounce the future use of numbers”.
That all changed after November 2000, when the ITU wrote to ICANN to express concerns about the four proposed telephony-related TLDs:

it is the view of ITU that it would be premature for ICANN to grant any E.164-related TLD application as this may jeopardize these cooperative activities or prejudice future DNS IP Telephony addressing requirements.

E.164 is the international telephone numbering plan, which the ITU oversees. It also forms the basis of the ENUM protocol, which stores phone numbers in the DNS under e164.arpa.
ICANN’s board of directors used the ITU letter to reject all four telephony TLDs, which irked Telnic. The would-be registry filed a Reconsideration Request in an attempt to get the decision reversed.
In it, Telnic attempted to persuade ICANN that the ITU had nothing to worry about with its “text-based” and strictly non-numeric TLD. The company wrote (my emphasis):

* All-digit strings will be permanently embargoed.
* Broad terms and conditions and safeguards will be implemented covering any abuses that could possibly lead to any PSTN confusion, conflict or similarity.
* Measured use of numbers might be permissible where there is no direct, marginal, implied or similar confusions/conflicts with PSTN codes or numbers – and where digits form an incidental part of a text string (e.g. johnsmith11.tel).

ICANN’s reconsideration committee denied the request.
In 2004, when ICANN’s sponsored TLD round opened up, Telnic applied for .tel again. This time, it was careful to avoid upsetting the ITU from the very outset.
Indeed, the second paragraph of its application stated clearly:

Digits are to be restricted to maintain the integrity of a letters/words based top-level domain and to avoid interference with established or future national and international telephone numbering plans.

The application referred to the namespace as “text-based” throughout, and even used the need for policies regulating the use of digits to justify the sponsoring organization it intended to create.
The application stated:

The .Tel will not:
…
Allow numeric-only domains to be registered, and therefore will not conflict with any national or international telephone numbering plan.

It also said:

Domain name strings containing only digits with or without a dash (e.g. 08001234567, 0-800-1234567) will be restricted and reserved to maintain the integrity as a letters/words based top-level domain

Despite these assurances, it was obvious that the ITU’s concerns about numeric .tel domains continued to bother ICANN right up until it finally approved .tel in 2006.
During the board meeting at which Telnic’s contract was approved, director Raimundo Beca pressed for the inclusion of language that addressed the constraints on numeric domains and chair Vint Cerf asked general counsel John Jeffrey to amend the resolution accordingly.
While that amendment appears to have never been made, it was clearly envisaged at the moment of the board vote that .tel was to steer clear of numeric-only domains.
Telnic’s contract now specifically excludes such registrations.
Given all this history, one might now argue that Telnic’s request to lift these restrictions is kind of a Big Deal.
A Telnic spokesperson tells me that, among other things, the current restrictions unfairly exclude companies that brand themselves with their phone numbers, such as 118-118 in the UK.
He added that Telnic request has been made now in part because VeriSign has requested the lifting of similar restrictions in .name, which ICANN has also concluded is not a stability problem.
However, as far as I can tell .name was not subject to the same kinds of ITU-related concerns as .tel when it was approved in 2000.
Telnic proposes one safeguard against conflict with E.164, in that it will not allow the registration of single-digit domains, reducing the potential for confusion with ENUM strings, which separate each digit with a dot.
If the ITU does rear its head in response to the current .tel public comment period, it will come at a awkward time, politically. Some ITU members have said recently they want the ITU to form a committee that would have veto power over ICANN’s decisions.
But Telnic says, in its proposal, that it does not know of anybody who is likely to object to its request.
Perhaps it is correct.

Telnic wants to sell numeric domain names

Telnic, the .tel registry, wants ICANN to allow it to start taking registrations of purely numeric domain names.
While the company has not submitted a formal request, Telnic CEO Khashayar Mahdavi has asked for numbers-only domains in a separate public comment period.
VeriSign has asked ICANN for the ability to start accepting hyphens and numbers in domain names in the .name TLD, including purely numeric strings such as phone numbers.
Mahdavi, who apparently views .name as a key competitor, wrote in a comment submitted on the VeriSign request:

If ICANN decides to remove this restriction from .name then this change in policy should apply to .tel as well. Approving the release of this restriction on one TLD and leaving it in place for another provides the first with a substantial commercial advantage.
In order to avoid such an unjust result, we respectfully request that, if ICANN decides to approve VeriSign’s request to allow all-numeric strings (and strings with combinations of numbers and hyphens) to be registered as domain names in .name, it simultaneously allow Telnic to do the same in .tel.

Telnic’s charter, part of its ICANN registry contract, currently states “The .tel registry will not allow numeric-only domains to be registered at the registry level.”
I believe the restriction was conceived in order to avoid clashes with the international telephone numbering authorities and the ENUM protocol. Mahdavi wrote:

Telnic believes it is important to avoid conflict with ENUM , so it will continue to forbid the registration of single digit domain names in .tel. Such domain names would be necessary for creating an ENUM tree under .tel, so forbidding them makes a .tel-based ENUM system impossible.

When Telnic originally applied for .tel in 2000, one of the reasons it was rejected was the fact that the International Telecommunications Union wasn’t happy with the idea of phone numbers in domain names.

Internet closes in on 200 million domain names

The internet will almost certainly break through the 200 million domain names milestone before the end of the year, judging from VeriSign’s latest Domain Name Industry Brief.
There were about 196.3 million registered domains at the end of June, according to the report, up by 3 million on the first quarter and 12.3 million on the second quarter 2009. That’s 2% and 7% growth, respectively.
The drag factor on the overall market caused by the mass expiry of millions of Chinese .cn domains seems to have levelled off, making the growth a little more encouraging than in the first quarter.
Regardless, VeriSign said that 76.3 million domains were registered in the ccTLDs, basically flat when compared to the March numbers and a 2.5% increase year-on-year.
The ccTLDs may see a growth spurt in the third-quarter DNIB, due to the influence of .co’s launch, assuming another .cn situation does not arise in another TLD.
VeriSign doesn’t say as much, but if the ccTLDs only grew by a net 63,000 names, that means the bulk of the 3 million new domains were in the gTLDs, but it doesn’t break the number down by gTLD.
It doesn’t even say precisely how many .com/.net domains it manages, or what its growth rates were, just that the two TLDs’ combined total now exceeds 100 million.