DNS

Censorship: A Threat to the Stability and Security of the DNS?

Censorship practices by governments and other private actors are becoming more increasingly more sophisticated, and their effects are increasingly being felt globally. A case in point, the YouTube incident in Pakistan was a recent example affecting both users and the DNS at a national and global level. Likely other incidents will occur in the near future. As such, I believe censorship should be considered as a threat to the stability and security of the DNS. In the context of Internet governance discussions, I believe the issue should be raised both at ICANN and the Internet Governance forum. Do others agree? more

The Path Toward Increasing the Security of DNSSEC with Elliptic Curve Cryptography

How do we make DNSSEC even more secure through the use of elliptic curve cryptography? What are the advantages of algorithms based on elliptic curves? And what steps need to happen to make this a reality? What challenges lie in the way? Over the past few months we've been discussing these questions within the community of people implementing DNSSEC, with an aim of increasing both the security and performance of DNSSEC. more

Why DNS Is Broken, Part 2: DoS Target

Before we get into what DNSSEC is and the benefits of it, let's talk about some of the other potential pitfalls of DNS. One of the most significant issues we have to deal with are denial-of-service (DoS) attacks. While DoS attacks are not specific to DNS we have seen DNS be a frequent target of these attacks. more

New gTLD Queries at the Root & Heisenberg’s Uncertainty Principle

Since Verisign published its second SSR report a few weeks back, recently updated with revision 1.1, we've been taking a deeper look at queries to the root servers that elicit "Name Error," or NXDomain responses and figured we'd share some preliminary results. Not surprisingly, promptly after publication of the Interisle Consulting Group's Name Collision in the DNS [PDF] report, a small number of the many who are impacted are aiming to discredit the report. more

ICANN Finds Its Voice

I think we are finally getting somewhere: ICANN is no longer fluttering flusteredly whenever a lobbying group sends a nastygram over the transom. Case in point: a Association of National Advertisers (ANA) that arrived a few days ago, full of bombast and muscle-flexing, demanding that ICANN immediately stop the new gTLD program until a long list of demands from the ANA were met, or else the ANA would be forced to take some Very Scary Actions... more

Could DoC Nominee Benefit Internet Governance, Help Globalize ICANN?

Wednesday's announcement by the Obama administration, that former Washington state governor Gary Locke has been nominated as the next Secretary of Commerce could be a good sign for Internet governance, and the continued globalization of the ICANN regime. The Chinese-American Locke brings key political capital and experience to the table. He is well respected within and has access to the most senior levels of the Chinese government... more

Verisign Outreach Program Remediates Billions of Name Collision Queries

A name collision occurs when a user attempts to resolve a domain in one namespace, but it unexpectedly resolves in a different namespace. Name collision issues in the public global Domain Name System (DNS) cause billions of unnecessary and potentially unsafe DNS queries every day. A targeted outreach program that Verisign started in March 2020 has remediated one billion queries per day to the A and J root name servers, via 46 collision strings. more

Identity, ICANN, and Public Meetings

Ok, so I had a day in Wellington that was not busy with other things so I thought I'd wander over to the ICANN venue and sit in on the PUBLIC Forum... I saw friends on the walk over and we entered the venue, chatting about several different things. They pulled out their badges. I didn't have one. They were admitted, I was denied entrance... more

Introduction: New gTLD Security and Stability Considerations (Part 1 of 5 )

Verisign recently published a technical report on new generic top-level domain (gTLD) security and stability considerations. The initial objective of the report was to assess for Verisign's senior management our own operational preparedness for new gTLDs, as both a Registry Service Provider for approximately 200 strings, as well as a direct applicant for 14 new gTLDs... However, in cataloging internal and external risks related to the new gTLD program, we found several far-reaching and long-standing issues that need to be further explored and/or resolved with varying levels of urgency. more

What Does It Take To Repair Trust? What Will It Take ICANN To Win Back “Trust”? (Part I)

Some readers may wonder why I chose to raise the issue of "trust" now or even ask what it will take for ICANN to repair it. After all, the New gTLDs have been launched; applications have started being received, and all ICANN official announcements are that all is good and going according to plan. But many other readers and astute observers of this space, domestic and international, would not confuse the public dead silence we are hearing from ICANN and its insider community or the euphoria of the long awaited application submissions we are seeing to mean that all is perfect. more

Join Live On Sunday - 2nd Registration Operations Workshop (ROW) In Dallas

This Sunday, March 22, 2015, the second Registration Operations Workshop (ROW) will be taking place at the Fairmont Dallas hotel from 12:30 -- 4:30 pm CDT. Discussion will include extensions to EPP, new encryption initiatives and also suggestions for ways to further automate DNS interactions between registries, registrars and DNS operators, including a need to do this for DNSSEC. more

Moving DNSSEC Forward: Help for Registries, Registrars, ISPs/Hosting, Enterprises, and Name Owners

DNSSEC adoption has been slow, but is now picking up speed, thanks to organizations leading the way. ... While some registries have already signed, some have announced plans to sign and others are still trying to figure out their plan. Either way, DNSSEC is here. How can we make DNSSEC adoption quicker and easier not only for the registry but for individual name owners? more

ICANN And The DOC Can’t

The former contract with ICANN and the US Department of Commerce (DOC) was due to expire on September 30, 2002. In the statement announcing the renewal, the DOC acknowledged that ICANN was the subject of many complaints from many sectors of the Internet community. Some of these complaints had been presented to the US Congress during a hearing held in June 2002 by a Senate Subcommittee. At the hearing, a General Accounting Office (GAO) spokesperson, Peter Guerrero, testified, noting not only that ICANN had failed in its mandate, but that the U.S. Department of Commerce was also at fault in failing to properly oversee ICANN activities. He explains... more

Dynamic DNS Customers, Check Your Router Settings!

There have been quite a few news stories released over the last 24 hours regarding a wide-scale compromise of 300,00 Internet gateway devices. Here's the executive summary of what happened, how to check if you are vulnerable, and what you can do to fix it... If you use any of these devices, you should check it to ensure your device has not been compromised. more

Fast Web Performance Starts with DNS…

You wake up, make coffee, sit down by the computer and start reading your favorite web sites. You fire up your favorite browser and type 'www.site.com' on the address bar, hit enter and continue sipping on that coffee. You wait for the page to load, sipping some more coffee - a few seconds later you get the Google search results for 'www.site.com'. You scratch your head, sip some more coffee, and start wondering if you did a typo, but no it is correct - Google is not correcting your spelling. more