It might be time to undertake the creation of a global architecture similar to that undertaken for the global vulnerabilities and exposures infrastructure and enabling multiple trusted roots.  The US as a global trust singularity clearly has ended.

I’ve not been tracking this ... but I have questions:

1. What is the legal relationship, if any, between ICANN and the various root server (cluster) operators?  I am not aware of any, but I’m not up to date.  I am unclear what chain ICANN has to yank in this matter apart from restricting dissemination of the root zone file, a matter that I suspect would be met with resentment, if not overt legal actions.

I would remind everyone that ICANN doesn’t have the best record of overseeing the 13 operators.  I am thinking of what was perhaps the most important single step in improving DNS root-layer reliability - a step that was done by the root server operators, without telling ICANN and without ICANN’s consent.  This step was to deploy anycast technology so that rather than 13 server machines we have 13 clusters (each extensively geographically distributed) of root servers.

There ought to be no end of praise for the quality of the work done by those thirteen operational groups.

However, a large percentage of those groups are under the control (actually, they are part of ) the US government.  I can understand why this is seen by many as a scent of US hegemony over the internet. (Oh boy, that is an awful mixed metaphor!)

I am also wondering about the old question “why thirteen?”  It used to be based on the size of a 512 byte DNS UDP packet.  But with eDNS extensions, not to mention the increased deployment of DNS over HTTP or TLS I wonder if anyone has done research about what would happen if we moved to more than 13 (especially with those long IPv6 address supporting NS resource records, and also with the erosion of the ability to do DNS compression because server names may not be as well structured as they have been.)

In a different dimension, I am wondering about the erosion of the root servers when many people are aiming their machines at the DNS resolver clusters offered by Google, Cloudflare, Comcast/Xfinity, and others (e.g. 8.8.8.8 and 1.1.1.1) - those have the potential of being effectively root+everything else resolvers.  (And, of course, I wonder how long those for-profit companies can resist the temptation to data mine the DNS query stream - it can be a very rich vein of data ore.)

Back in the day several of us explored the concept of competing systems of DNS roots - with the proviso that those systems all contain a core of the most common TLDs and that for any TLD that is carried, that the contents be consistent between the competing systems.

Basically competing root systems - as long as those provisos are met - do work (even with DNSSEC, although maybe not with DNS over HTTPS or over TLS if TLS full walk-back-to-a-trusted-authority certificate validation is performed by both ends.)

In other words, we may be entering a world in which anyone can set up - without ICANN or any other permission - root server systems and users (or their proxies) get to choose.  The key to avoiding user frustration and surprise would be to assure that the contents of the preferred TLDs are consistent.

Good points, Karl.  Indeed, Google and Cloudflare root servers have consistently provide considerably better resolution performance as well as offering diversity, equity and inclusion of a greater array of end-points.  Arguably, between the two of them, they offer greater trust than the ICANN cartel.

Michael’s hostility to the independence of ICANN from the U.S. government is well known. But trying to use DNS Root Server System governance reform as a cudgel to re-impose “America First” Internet governance takes it to a new low. It’s particularly amusing now that the Trump administration’s ICE raids, illegal tariffs and unilateral military attacks have discredited the administration among virtually everyone outside the MAGA fold. Really, Mike, should the global Internet community be looking to Stephen Miller, an acknowledged neo-fascist, as a guide to policy?
Calling a root server “critical [U.S.] national infrastructure” is absurd. It’s a global infrastructure and, like the DNS, it is supposed to operate neutrally for all organizations in the world. Three of the 13 root servers (E, G, and H) are managed by U.S. government agencies: NASA (E), DOD/NIC (G), and U.S. Army/Research Lab (H). Two of them are military. These are just legacy arrangements and do not reflect current needs. What’s the problem with considering reducing the U.S. share by one or two? The performance of root servers run by the U.S. military is known to be among the worst of the whole system.
The governance gap around root servers has been well known for years. We have no institutionalized method to award or withdraw root server status. That needs to be fixed. We have other governments claiming - equally irrationally - that a RS is a “critical national infrastructure” and so they want one in their territory. Statements like Palage’s simply encourage the further politicization of a function that needs to be nonpolitical, technical, and multistakeholder in nature.
RSS governance was supposed to be reformed in the original 1999ish agreements between the U.S. Commerce Department and the fledgling ICANN. It took 20 years to finally get around to it. It’s sad to see divisive nationalistic politics interfering with that process.

Karl:
You are correct that “the most important single step in improving DNS root-layer reliability ...was to deploy anycast technology so that rather than 13 server machines we have 13 clusters (each extensively geographically distributed) of root servers.” You are also correct that this was done independently of ICANN - a testimony to the resilience and benefits of Internet self-governance; no central authority was needed.
What you may not realize is that national governments - and you can guess who, but China, India and Russia come to mind - are not satisfied with anycast. They want “their own” root server. They - like Mr Palage - mistakenly think of it as “critical national infrastructure” when it’s not, it’s a globally shared infrastructure rooted in civil society and the private sector. Palage doesn’t realize (or maybe does) that casting RS governance in these terms only encourages other powerful nation-states to insist on “digital sovereignty” in ways that encourage fragmentation of the infrastructure along geopolitical lines.
So yes, we can now have more than 13 RSs. That raises the question: who gets them, who runs the new ones? How do we answer this question? Either we answer it in a cooperative, institutionalized manner - and ICANN is the best place to do that - or we move to the kind of intergovernmental contention that we saw in WCIT 2012, WSIS 2003, etc. We should all hope that ICANN’s RSS reform process takes the lead, but if that fails then bottom-up measures, such as the local root initiatives coming out of the IETF, may be necessary.

The points you are underscoring have continuing historical roots going back to the 1850 Dresden international telecommunications treaty instrument.  Network traffic identifiers and resolution are under the sovereign jurisdiction and control national jurisdictions, and their global instantiations are established through treaty arrangements. 

The EU reminded the U.S. of these fundamental legal norms in the mid-1990s.  The U.S. subsequently hosted the ITU Plenipotentiary Conference at Minneapolis in 1998 - at which the U.S. crafted Res. 102 was adopted and effectively applied the long-standing norms to TCP/IP network domain names and addresses.  The U.S. and most nations are a party to the provisions.  Although the current U.S. administration ignores most law, the rest of the world still follows it.  Any attempts to ignore these norms will simply result in more ICT infrastructure resources and institutions moving to other stable national jurisdictions. 

It is surprising that ICANN itself is still incorporated in the U.S. rather than Switzerland.  It can join DONA there. :-)

Read “Declaring Independence in Cyberspace, my friend.
https://mitpress.mit.edu/9780262552585/declaring-independence-in-cyberspace/
Reasserting treaties from 1850 - ones that you yourself discarded in the early days of the Internet’s evolution - doesn’t change facts on the ground.
Hey, the Dresden treaty, written for the telegraph, says that no messages should exceed 100 words. Why don’t we apply that, eh?

The irony passed over my head.

Nice to see so many old timers still involved:-)