DNS

Who is Blocking WHOIS?

On April 16 ICANN issued a breach notice to Turkish Registrar Alantron for not consistently providing access to its WHOIS database via Port 43, a command-line query location that all Registrars are required to supply under conditions of their contract with ICANN under section 3.3.1. Four days later they issued a breach to Internet Group do Brazil for the same problem. ... The WHOIS record, as we all know, is a massive fraud with illicit parties filling records with bogus information and hiding behind anonymity. more

Deploying DNSSEC: Lessons from Domain Registrar Implementation

As a registrar at the front end of the DNSSEC deployment effort, our technical team has made a sustained investment in DNSSEC deployment so that our customers don't get overwhelmed by this wave of changes to the core infrastructure of the Domain Name System. Along the way, we've learnt a lot about how to implement DNSSEC which might hold useful lessons for other organizations that plan to deploy DNSSEC in their networks. more

Operational Challenges When Implementing DNSSEC

As a reader of this article, you are probably familiar with the DNS cache poisoning techniques discovered a few years ago. And you have most likely heard that DNSSEC is the long term cure. But you might not know exactly what challenges are involved with DNSSEC and what experience the early adopters have gathered and documented. Perhaps you waited with our own rollout until you could gather more documentation over the operational experience when rolling out DNSSEC. This article summarizes authors' experiences and learnings from implementing the technology in production environments as well as discusses associated operational issues. more

Perspectives on a DNS-CERT

Last week at the ICANN meeting in Nairobi, a plan was announced by ICANN staff to create a "CERT" for DNS. That's a Community Emergency Response Team (CERT) for the global Domain Name System (DNS). There are all kinds of CERTs in the world today, both inside and outside the Internet industry. There isn't one for DNS, and that's basically my fault, and so I have been following the developments in Nairobi this week very closely. more

Are Portable Email Addresses Possible?

News reports say that the Israeli government is close to passing a law that requires portable e-mail addresses, similar to portable phone numbers. Number portability has been a success, making it much easier to switch from one provider to another, and address portability might ease switching among ISPs. But e-mail is not phone calls. Is it even possible? more

DNS, My God It’s Full of Stars…

Since my last post about DNS subversion we have had some good feedback. We had 29 responses, I agree a small sample, but what we found is very interesting. Let's remind ourselves of what we are looking at? Does your ISP redirect DNS queries? Specifically, if you try to make a port 53 UDP or TCP connection to a server outside of your ISP's network does it get there? more

Comcast Unleashes Trial DNS Redirection in Select States

In a post today on Comcast's blog, Chris Griffiths, DNS Engineering Manger, has informed customers that they have begun to role a DNS redirection service -- a controversial service offered by several other ISPs over the years to redirect mistyped URLs to ad-based pages instead of a typical 404 error page. The service called "Domain Name Helper Service" is being launched as a market trial in Arizona, Colorado, New Mexico, Oregon, Texas, Utah, and Washington according to the company. more

Most Popular Invalid TLDs Should Be Reserved

Some of the root server operators post public statistics for their domain name traffic at the top-level. For example, the graph (which can take a bit of time to generate, given ICANN's slow servers) for the L-root server's most popular Top-Level Domain (TLD) queries demonstrates, to no one's surprise, that .com is king. What's more interesting, though, especially given the new generic Top-Level Domain (gTLD) debate, is to look at the most popular invalid (non-existent) TLDs. more

Why DNS Is Broken, Part 2: DoS Target

Before we get into what DNSSEC is and the benefits of it, let's talk about some of the other potential pitfalls of DNS. One of the most significant issues we have to deal with are denial-of-service (DoS) attacks. While DoS attacks are not specific to DNS we have seen DNS be a frequent target of these attacks. more

A “G12” to Oversee ICANN? Not Likely

Viviane Redding, the Information Society and Media Commissioner for the EC posted a video blog this week noting that the JPA between ICANN and the US Department of Commerce ends this September. In it she proposes that ICANN be overseen by a "G-12 for Internet Governance" with 12 geographically balanced government representatives from around the world. That's such a non-starter that I'm baffled that she would even propose it... more

ICANN Con Rocas (or ‘ICANN On the Rocks’)

ICANN Meetings can be an intimidating place for first-timers or even those who have only attended for the few years. The acronyms fly fast and furious. The participants, or at least most of them, have been working on the issues for years (even decades). The technical and policy issues are complex. Luckily, however, an attendee can overcome these barriers to entry with a few drinks at the hotel bar. .. more

Domain Name Registration: Not a Technology Service Any More?

It didn't seem to make any headlines, but it is an interesting sign of the Internet times that, effective January 1, 2009 , the United State Patent and Trademark Office ("USPTO") changed the International Classification of "domain name registration services" to Class 45 (defined below). The reason that the move is interesting is that it is just one more indication that the world of the Internet is becoming less and less about technology and more and more about law and policy. more

HTTPS Web Hijacking Goes From Theory to Practice

I've been privately talking about the theoretical dangers of HTTPS hacking with the developers of a major web browser since 2006 and earlier last month, I published my warnings about HTTPS web hacking along with a proposed solution. A week later, Google partially implemented some of my recommendations in an early Alpha version of their Chrome 2.0 browser... This week at the Black Hat security conference in Washington DC, Moxie Marlinspike released a tool called SSL Strip... more

What is Good Policy for a Domain Name Registry?

Back from the holidays I must admit I was thinking quite a bit on what is good policy for a registry? Of course I have my own personal favorites that I can not walk away from easily, but instead of thinking for too long, I decided to write down now immediately what is in my head. The main reasons for this are two: the decision by ICANN to change the rules for change in policy regarding the Add Grace Periods. more

Is the New “.Tel” Domain More than Just a Pretty Web Interface to DNS?

Is the new ".tel" domain launching today more than just a pretty web interface to DNS? Is it something really unique? Is it a new service that couldn't be easily replicated elsewhere? In case you haven't been following the subject, a company called Telnic has launched a new top-level DNS domain ".tel" today. Today, December 3rd, is the launch of the "Sunrise" period where companies can (for a high price) obtain the ".tel" domain associated with their trademark. more