|
||
|
||
Over the past several weeks, there has been significant discussion about Verisign and its management of the .com top-level domain (TLD) registry. Much of this discussion has been distorted by factual inaccuracies, a misunderstanding of core technical concepts, and misinterpretations regarding pricing, competition, and market dynamics in the domain name industry.
Billions of internet users and trillions of dollars in global commerce rely on the continuing security, stability, and resiliency of the .com TLD and the technical infrastructure that powers it, so it is vital that discussions about this topic be rooted in fact.
To set the record straight, we have collected and addressed the most common myths currently circulating about the .com TLD.
Myth: The technology that powers the .com TLD is not sophisticated.
Fact: Verisign has invested continuously for decades to build and evolve the infrastructure that powers the .com TLD, which is the most technically sophisticated of its kind. This infrastructure includes an advanced registration system, which reliably updates and maintains an accurate record of all registered .com domain names on a continuous basis, ensuring that millions of registry transactions are processed correctly, and millions of daily changes—including cryptographic updates to support Domain Name System Security Extensions (DNSSEC)—are distributed to a highly resilient global resolution constellation within seconds. This system ensures that users around the world maintain continuous, round-the-clock access to .com domain names and all the resources and services they support. Verisign has also played a vital role in the development and deployment of DNSSEC technology which uses cryptographic protections to ensure those connections are delivered with reliability and trust.
Verisign’s infrastructure processes an average of 329 billion Domain Name System (DNS) transactions each day, operating at a peak of more than six million transactions per second so far this year. Verisign’s resolution infrastructure is engineered to handle peak query loads significantly greater than the highest ever observed, to ensure continuous operation regardless of demand. This infrastructure has delivered 100 percent DNS availability for .com for more than 27 years without interruption. Verisign accomplishes this by operating a large, globally distributed registry operation, made up of hundreds of technical sites spread across 60+ nations on six continents. These sites run purpose-built technology invented by Verisign technologists for the unique demands of the .com TLD. Verisign engineers have developed specialized technologies and protocols that are designed to achieve higher availability and resiliency to prevent disruption. Examples of this design include employing network, system, and application-level diversification approaches such as using hardware from multiple vendors for network and data center operations and using multiple operating system providers to better withstand localized failures or single-threaded supplier issues. Using in-house purpose-built systems, as opposed to leveraging public cloud operations, lowers the risks of circular dependencies as most public cloud providers also rely on .com and the root infrastructure operated by Verisign. These approaches ensure diversity and redundancy for every component of .com operations.
Verisign is also tasked with defending against highly sophisticated and massive volumetric cyberattacks while managing ever-increasing global demand. Trillions of dollars in global commerce and billions of internet users depend on the availability of Verisign infrastructure 24/7. To defend .com against cyberattacks, including by highly sophisticated nation-state actors, Verisign employs a comprehensive enterprise risk management program and threat-driven defensive practices that drive continuous improvements to Verisign’s systems and programs. Verisign has operationalized the National Institute of Standards and Technology’s (NIST) Cybersecurity Framework and the Center for Internet Security’s (CIS) Critical Security Controls in the ongoing design and evolution of its infrastructure, with a security-first mindset. In addition, Verisign employs advanced information security measures such as continuous monitoring, real-time threat detection, ongoing vulnerability assessments, bug bounty programs, and rigorous security audits to safeguard its infrastructure.
Verisign’s infrastructure powers more than just .com. In addition to operating other TLDs, Verisign plays a unique role as Root Zone Maintainer and operator of two of the world’s 13 root servers, a critical function necessary for internet navigation. Hundreds of Verisign employees have developed highly specialized skills, honed over decades, to develop, maintain, and operate this unique global infrastructure. Verisign holds more than 500 patents for DNS and related technologies, and its innovations are deployed globally by other critical internet infrastructure operators. Verisign has made many of its critical DNS patents available on a royalty-free basis to the global DNS community and those technologies have been deployed around the world.
Myth: The annual wholesale price for .com domain names – $10.26 as of Sept. 1 – is much higher than market value and is harming consumers.
Fact: While other generic TLDs (gTLDs) do not share .com’s pricing transparency, the annual wholesale renewal price of a .com domain name is lower than 87 percent of the 448 gTLDs for which such data is available from registrars. Based on that data, some of the largest original gTLDs, which have been in the market for over 20 years, have renewal pricing of $9.93 (.org), $15.00 (.biz), and $17.50 (.info). Some of the largest new gTLDs, which have been in the market for over 10 years, have renewal pricing of $10 (.xyz – increasing to $11 by the end of September), $25.00 (.online), and $40.00 (.store). The available market data makes it clear that .com domain names are priced at or below market value. It is notable that competing TLDs have continued to grow market share while pricing their domain names over twice as high as .com domain names.
Customers of .com domain names are more likely to be affected by two factors outside of Verisign’s control: 1) the rising cost of retail registrations that are outpacing wholesale prices, with some registrars now charging more than double the wholesale price to renew a .com domain name; and 2) the unregulated secondary market, which accumulates large inventories of domain names and charges markups that are—in some cases—thousands of times higher than the regulated wholesale price.
Myth: Verisign spends an unusual amount on share repurchases and dividends at the expense of infrastructure investment.
Fact: Verisign’s technological infrastructure is unmatched in the DNS industry for its scale, technical diversity, security, and resiliency. Verisign has invested for years to evolve and harden that technology, a fact illustrated by the company’s 27-year DNS uptime record. During the 2000s, Verisign offered a number of DNS-related services, including distributed denial-of-service (DDoS) attack mitigation and managed DNS. Significant capacity was added during that period. In 2018, when Verisign divested the last of its non-core businesses to focus on .com and other DNS operations, the company not only maintained, but increased capacity in order to meet growing DNS demand as well as to address growing DDoS volumetric attacks.
Verisign is certainly a profitable company and is proud of its operational success and history of sound financial management, which are important factors in maintaining the security, stability, and resiliency of the DNS. Some critics have singled out Verisign’s methods of increasing shareholder value, a duty of all public companies. Verisign has fulfilled this duty in part through share repurchases and dividends, which benefit a large and diverse group of shareholders including individuals, public employee retirement systems, index funds, and mutual funds (benefiting their millions of investors). Less than one percent of Verisign’s shares are held by company officers and directors.
Verisign’s return of capital practices are well in line with those of other successful public companies. In 2023, more than 90 percent of S&P 500 companies returned capital to shareholders and Verisign ranked 216th out of the S&P 500 in terms of cash returned to shareholders as a percentage of market capitalization. In terms of profitability, market expectation of Verisign’s earnings per share (a reliable measure of profitability) is $8.36 for the next 12 months, which places it 198th in the S&P 500.
Verisign’s sound and transparent financial management underpins its successful management of the .com TLD and other key internet infrastructure. Verisign has been a public company for 26 years and an S&P 500 company for 18 years. As a publicly listed company operating critical internet infrastructure, the public and the DNS ecosystem benefit from Verisign’s transparency in its operating and financial results, which must comply with the SEC’s disclosure rules and regulations for public companies. Verisign’s financial statements must also undergo an independent audit each year. By contrast, many other registries, registrars, and resellers, including some who focus on the secondary market, serve only the narrow interests of their private owners and do so with no obligations surrounding public disclosure or transparency of their ownership, profitability, operations, or otherwise. Adding obligations for these entities to report ownership, profitability, and other metrics to The Internet Corporation for Assigned Names and Numbers (ICANN) and the public would benefit the entire DNS ecosystem.
Myth: Contracts to operate gTLD registries should be routinely rebid, and a presumptive right of renewal for such contracts is bad for consumers and the internet.
Fact: The National Telecommunications and Information Administration (NTIA) recently opined that “The security, stability, and resilience of the Internet’s unique identifier systems is of paramount importance…” This position is shared by Verisign and the majority of participants in the global multistakeholder system of internet governance. ICANN has supported and clarified this priority and the role it plays in registry contracts. The contracts for .com and all other gTLDs reflect this priority (i.e., that stability and predictability in registry operations leads to long-term investments by operators). Verisign’s right to renew its .com Registry Agreement is conditioned on meeting rigorous technical and operational requirements to ensure .com’s continued security, stability, and continuous availability to billions of internet users. This contractual approach encourages gTLD operators to invest in infrastructure to support rising demand and defend against cyberattacks. Due to its investments, Verisign has operated .com with 100 percent DNS uptime for over 27 years.
Myth: Verisign’s operation of .com constitutes a “monopoly.”
Fact: There are nearly 1,200 gTLDs, and more than 250 country-code TLDs (ccTLDs), operating today. Each of these TLDs offer the same core functionality, allowing users to establish and maintain an online presence, establish websites, and create email addresses. Globally, there are over 362 million registered domain names—the majority of which are registered in TLDs not operated by Verisign. The number of domain names registered in non-Verisign operated gTLDs and ccTLDs has grown consistently as those TLDs have grown their share of the marketplace. In addition to this competition at the wholesale level, there are more than 2,800 ICANN-accredited registrars, and thousands more resellers, offering domain names at a range of prices and in a range of packages to consumers.
Further, from a practical perspective, the technical nature of TLD registries requires that they each be run by a single operator, but with so many operators in the marketplace, consumers have a broad and diverse array of choices at a range of prices. Other TLDs like .org, .shop, .ai, and .uk are not “monopolies” and neither is .com.
Myth: Verisign sets .com domain name prices for consumers.
Fact: Domain name registrars set unregulated retail prices for .com domain names, and those prices vary widely among the 2,800 ICANN-accredited registrars and associated resellers. Some registrars charge more than double the annual wholesale price for .com domain name renewals, and, in many cases, those price increases have outpaced Verisign’s tightly regulated .com wholesale price increases. In analyzing registrar pricing, it is important to distinguish introductory offers—which are often set lower to attract new customers—from renewal prices, which is what registrars charge existing customers to maintain their domain name registrations.
In addition to the retail registrar market, there is also a multibillion-dollar secondary market for domain names, in which domain investors, or “domainers,” accumulate millions of desirable domain names in order to resell them at markups that can be thousands of times higher than Verisign’s regulated wholesale prices. The gap between wholesale prices and secondary market prices makes it possible for domainers to hold names for years—making them prohibitively expensive to the general public. The profitability of the secondary market has also attracted successful retail registrars to expand into it, acquiring large portfolios of .com domain names and creating auction sites where they are sold well above retail prices. A blog that reports on high-profile domain name sales reported that just one reselling site handled $90 million in secondary sales in the second quarter of 2024 alone. Although the secondary marketplace may serve a function within the DNS ecosystem, it is completely unregulated.
Myth: The U.S. Government lifted price caps on .com domain names in 2018.
Fact: Amendment 35 to the Cooperative Agreement retained wholesale price restrictions in the .com TLD, while also retaining legacy regulations prohibiting Verisign from operating as a registrar in the .com TLD. Of the nearly 1,200 gTLDs overseen by ICANN and the global multistakeholder community, .com, .net, and .name (also operated by Verisign) remain the only three that are governed by maximum price restrictions. Those restrictions remain in place today and will remain in place after the .com Registry Agreement is renewed later this year.
Sponsored byVerisign
Sponsored byVerisign
Sponsored byCSC
Sponsored byIPv4.Global
Sponsored byDNIB.com
Sponsored byWhoisXML API
Sponsored byRadix
A World-Renowned Source for Internet Developments. Serving Since 2002.
Pat, I welcome having a factual as opposed to emotional discussion regarding the .COM registry agreement.
Myth/Fact #1—We agree that Verisign operates sophisticated infrastructure, which has enabled it to provide critical global infrastructure in a secure and stable manner for the past several decades. Kudos to you and your team, especially the great work of Scott Hollenbeck. Give that man a raise.
Myth/Fact #2 – Regarding Verisign’s current market pricing for a .COM domain. We agree that Verisign has been more transparent in its wholesale pricing than other gTLDs. However, I believe that there are several missing data points in your analysis that need to be analyzed before making any definitive statement on .COM pricing. First, Verisign’s refusal to include provisions in its .NET and .COM Registry Agreement has likely impeded ICANN’s ability to conduct a broader economic study. Consistent with the commitment in the exchange of letters between NTIA and Verisign, let’s have a comprehensive analysis regarding the health of the entire DNS ecosystem, and not just .COM. Second, your choice of select TLDs and their respective price increases is problematic on a couple of points. First, as a result of growing consolidation within the industry, GoDaddy and Identity Digital have a disproportionate impact on pricing based on the hundreds of TLDs under their management. Second, a more comprehensive study involving the health of the entire DNS ecosystem would take into account ccTLDs, which appear to have had markedly slower price increases over the past decade. While gTLDs and ccTLD serve the same technical function, the growing price disparity between these prices is concerning. Moreover, with this broader economic analysis, it is easier to identify if a select group of companies are distorting the price market. Finally, I think it would be interesting to look at the profit margins for the services that Verisign was providing as a Registry Service Provider for other TLDs before it exited that market because much of those services were utilizing shared infrastructure.
Myth/Fact #3 – Regarding Verisign’s share repurchase and dividends over infrastructure investment. As a for-profit company, Verisign’s job is to maximize the value of its stock for its shareholder benefit. As a lifelong entrepreneur, I am not opposed to a company being rewarded for its investment and doing a good job. However, I think we can both agree that .COM is critical global infrastructure, and with great power comes great responsibilities. While Verisign’s technical infrastructure is probably second to none, respectfully I think there is room for improvement in the area of “governance” within the .COM ecosystem. For example, I am disappointed that Verisign has not made substantial progress in the area of trusted notifier programs as originally referenced in Amendment 35 to the Cooperative Agreement. While Verisign worked to comply with the Chinese government in connection with the Real Name verification requirements, there appears to be no similar effort to embrace similar European requirements in NIS 2.0. I also look forward to Verisign’s future commitment to help refund Registrars who are subjected to fraudulent chargebacks, following ICANN Org’s lead in this area. Simply put as the trustee of the .COM name space, Verisign has a responsibility greater than just maximizing its profits in running a database.
Myth/Fact #4 - Presumptive Renewal and Rebids. Sadly Pat this is a topic in which we cannot have a full and frank discussion, until ICANN’s General Counsel decides to make public the minutes from 8 February 2005 Special Meeting of the ICANN Board. Should that occasion ever arise, I look forward to that full and frank discussion.
Myth/Fact #5: COM is not a monopoly. People tend to use the term monopoly rather carelessly, so I want to be careful. I think the wording in the US Department of Justice letter to NTIA back in 2008 is most insightful when they stated “the creation of additional gTLDs is unlikely to constrain the exercise of market power by existing TLDs, especially the .com registry operated by Verisign.” Personally, it is my professional opinion that there has not been a substantial change in the dynamics since 2008. However, this is where a comprehensive analysis of the DNS ecosystem supply chain by ICANN would be helpful, or some help from NTIA’s “federal government partners” as they have done in the past. Again, consistent with the theme of your post, let’s have a factual discussion on this important issue.
Myth/Fact #6 – Verisign sets .COM pricing for consumers. I think we are in agreement that Verisign does not set .COM pricing for consumers. However, I think you would agree with me that Verisign price increases are almost always passed on to consumers via corresponding price increases from Registrars. Regarding the secondary market, there are other Registry Operators that have innovated in this area. In fact, I am sure we both remember the proposed “wait list service” back in the early 2000s. So perhaps Verisign can innovate in this area. I do share your concerns about the number entities providing domain name registration services that are not regulated, e.g. reseller, privacy/proxy, secondary market, etc. This is where I think the OECD whitepaper of DNS Security is so instructive where it acknowledges, “[t]he relative complexity of the DNS registration supply chain described above (registry, registrar, reseller, registrant, hosts and other DNS providers) provides many opportunities for malicious actors.” Hopefully, with this shared and mutual interest, Verisign and NTIA will commit to working with ICANN and the broader DNS ecosystem to undertake that entire ecosystem analysis which is so sorely needed.
Myth/Fact #7 – I agree with the statement of fact that you provided.
Thanks for taking the time to read the blog. While we don't agree on everything, I was glad to note the important points on which we are aligned. I appreciate you taking note of the pricing transparency in .com. What I think you -- and others -- miss, is the critical importance of considering retail and secondary market activity in understanding the prices that consumers pay to register .com domain names. Retail and secondary market operators sell to end users, not Verisign, and they have no restrictions on the prices they charge. There's a surprisingly large amount of available data, from published list prices, blog reports and online offers, about these segments. These issues are well expressed in this piece, which I linked to in my post and I'd encourage you to read it if you haven't. Thanks again, Mike.
Myth: The technology that powers the .com TLD is not sophisticated.
Fact: Anyone who states that the technology that powers .com is not sophisticated has no idea of the technological complexity of the domain name system. Verisign has done a good job of managing the TECHNICAL aspects of .com and .net on behalf of the U.S. government, but that is not the question being raised.
The real question is, can any other entity provide better technological management of .com at a lesser cost with more focus on the public good (including implementing the consensus ICANN policy of a “Thick WHOIS” as well as not trying to be carved out of the recently enacted U.S. cybersecurity reporting law) than making Wall Street and its shareholder happy? Obviously, there are entities out there that manage gTLDs and ccTLDs that have comparable technological expertise in managing a domain name. That is what a competitive bid of the cooperative agreement would determine.
Myth: The annual wholesale price for .com domain names – $10.26 as of Sept. 1 – is much higher than market value and is harming consumers.
FACT: Verisign is not getting the wholesale monopoly “market value” renewal price of .com. But that is not the question. Verisign is managing .com and .net on behalf of the U.S. government for the benefit of the Internet as a whole, and the Cooperative Agreement with NTIA is supposed to ensure that .com is managed with a focus on what is in the best interest of the American people, not what Verisign believes is in the best interest of Verisign and its stockholders. That is what a competitive bid of the cooperative agreement would determine.
Myth: Verisign spends an unusual amount on share repurchases and dividends at the expense of infrastructure investment.
Fact: Verisign has performed exceptionally well for its investors with an impressive 60%+ gross profit margins. Warren Buffett and other investors have achieved great results with their investments. But that is not the goal of the Cooperative Agreement. The mission of the Department of Commerce (DoC) is to “create the conditions for economic growth and opportunity.” The DoC mission statement states, “The Department of Commerce promotes job creation and economic growth by ensuring fair trade, providing the data necessary to support commerce and constitutional democracy, and fostering innovation by setting standards and conducting foundational research and development.” Nothing in the DoC mission statement says that it should be providing no bid renewals to help a single company increase its stock price to the benefit of its stockholders. In fact, a 1999 letter from the Department of Commerce to the Chairman of the House Commerce Committee stated the following:
“NSI (now Verisign) has indicated during discussions with the Commerce Department that it believes that the United States Government does not have the authority to terminate Network Solutions’ ability to register domain names. The Commerce Department believes that it does have the legal authority to terminate provision of registrar and/or registry services in the authoritative root by NSI by recompeting the relevant portions of the Cooperative Agreement. These services then would be provided by the winner of the competition (which could be NSI, if it were the winner and were willing to comply with the provisions of the revised Cooperative Agreement). NETWORK SOLUTIONS’ CONTRARY VIEW, OF COURSE, WOULD MEAN THAT NETWORK SOLUTIONS COULD MANAGE THE .COM, .NET, AND .ORG DOMAINS IN PERPETUITY WITHOUT ANY OVERSIGHT OR SUPERVISION BY THE US GOVERNMENT.”
“Of course, NSI’s conduct would be subject to the Federal antitrust laws. But antitrust actions are complex and expensive and offer an uncertain outcome, often after lengthy delay. Here, where the risk of harm to consumers is great, we should not - and we will not - pass up the opportunity to ensure through these negotiations THAT CONSUMERS ARE ABLE TO REAP THE FULL BENEFITS OF ROBUST COMPETITION.”
Myth: Contracts to operate gTLD registries should be routinely rebid, and a presumptive right of renewal for such contracts is bad for consumers and the internet.
Fact: See the above 1999 DoC statement
Myth: Verisign’s operation of .com constitutes a “monopoly.”
Fact: See the above 1999 DoC statement.
Myth: Verisign sets .com domain name prices for consumers.
Fact: Verisign is correct that it does not set retail domain name prices for consumers. However, it misdirects the question of what a competitive bid could answer to the wholesale price of .com should be.
Myth: The U.S. Government lifted price caps on .com domain names in 2018.
Fact: Verisign’s “Fact” is very misleading. Although the U.S. government did not “lift the price cap,” it allowed for an increase of “UP TO 7%” per year. Over the objections of the ICANN multi-stakeholder community, ICANN claimed that it is not a “price regulator” and allowed for the maximum allowable increase. ICANN also received $20 million as part of the .com price increase deal.
So Amendment 35 not only gave Verisign an automatic, no-bid renewal of .com with an “up to” 7%” automatic price increase with no economic justification but Amendment 35 cannot be changed unless they are mutually agreed to by both DoC and Verisign. So the reality is that DoC has no real leverage to make any substantive changes to the Cooperative Agreement that are in the best interest of the American people but only changes that Verisign believes are in the best interest of Verisign and its stockholders.
This is what Congress needs to look into. The Cooperative Agreement is not for Verisign’s benefit but for the American people’s benefit. Although the price of .com is important, the fundamental relationships between NTIA, Verisign, ICANN, and the other contracted parties like GoDaddy, Namecheap, the Internet Society, and PIR are what many of us find very troubling and need Congress and the House Commerce Committee to investigate. I and many others have been waiting for years and are ready to contribute to this important investigation. I hope that Congress will utilize its oversight powers to help safeguard the ICANN multistakeholder process from being continuously dominated by Internet plumbing monopolies before it is too late and the ICANN multistakeholder experiment fails.
Pat Kane’s discussion of contemporary DNS provider developments induced some reflections on the related history. In the late 80s. there was little interest in TCP/IP internet domains, as they were constrained to use by USG related research networks, and many users were enamored with the old host-name table identifiers. Still, the scaling use of the TCP/IP networks captured the interest of many, and the related domains were a way to evangelize the technology platform. They were also free and simple to use – as opposed to the extremely costly OSI domains. SRI ran the NIC, and just about everything related to network object identifiers and resolvers, out of Palo Alto. John Quarterman began publishing the metrics in his newsletter and I republished them internationally at the ITU in Geneva.
A combination of factors in 1992 landed me on the NSF InterNIC Advisory Committee that was tasked with reviewing the responses to the recompete RFP, and then oversee the contractor implementations. The DNS portion was eclipsed by the much sought after Directory portion that AT&T obtained. Much of the world saw CLNS based services as the lucrative opportunity.
However, TCP/IP started winning the day, and the DNS awardee – Network Solutions – was struggling. SAIC and VeriSign stepped in and undertook a role that on reflection is best described as “a good steward.” That role went far beyond the technology and national security considerations raised by Pat. The role resonated with the legendary SAIC founder and CEO, Bob Beyster, who was personally engaged in the stewardship role that was his trademark.
SAIC/Verisign devoted enormous resources to ensure that the DNS, and derivatively TCP/IP infrastructure as well as its governance ecosystem was stable and could scale globally going forward. They gave away enormous parts of the market sector. Pundits can argue that this was self-serving. But it was carried out in a manner that is probably unusual today – breaking up and enlarging the marketplace with a sense of good stewardship for the benefit of everyone – captured in the slogan “a rising sea raises all ships.”
As to the rejoinder about VeriSign meeting EU NIS2 requirements - it is noteworthy that Kane described use of the CIS Critical Security Controls. That platform is a principal NIS2 implementation mechanism – as described in related ETSI Technical Reports and Specifications in which CIS played a leading role.
NOTE: In the interest of transparency, the author was a senior VeriSign staff member from 2000 to 2008 but has no current financial or other involvement in the company or DNS business sector. He does work for the Center for Internet Security and is the ETSI Rapporteur for NIS2 and other EU regulatory requirements work – which is serendipitous considering VeriSign is using the Controls platform as well as consonant with good stewardship globally.