DNS

What’s in Your DNS Query?

Privacy problems are an area of wide concern for individual users of the Internet -- but what about network operators? Geoff Huston wrote an article earlier this year concerning privacy in DNS and the various attempts to make DNS private on the part of the IETF -- the result can be summarized with this long, but entertaining, quote. more

ccTLDs Might Be Property

The long-running saga of victims who are pursuing 'state sponsors of terrorism' via ICANN has taken yet another turn. Some time back the Plaintiffs in Rubin & ors -v- Islamic Republic of Iran & ors managed to obtain Writs of Attachment in the Federal court district in Washington (D.C.) courts ordering that the ccTLDs of those respective countries be seized in part-payment of the damages they are owed. ICANN, fairly predictably, became involved at this point. more

How to Evaluate Performance of a DNS Resolver

Ten years ago everyone evaluating DNS solutions was always concerned about performance. Broadband networks were getting faster, providers were serving more users, and web pages and applications increasingly stressed the DNS. Viruses were a factor too as they could rapidly become the straw that broke the camel's back of a large ISP's DNS servers. The last thing a provider needed was a bottleneck, so DNS resolution speed became more and more visible, and performance was everything. more

Security Through Obscurity as an Institution

One of my staff members pointed me to an article by Mikko Hyppönen in Foreign Policy. In this article Mikko argues that a new top level domain (TLD) like .bank for some reason would prevent on-line fraud, at least partially. Mikko seems to be arguing that with a dedicated TLD registry for financial institutions and a fee high enough to act as an entry barrier you would have a trustworthy bank domains that would be immune against today's phising attempts... more

DNSSEC Rally

In late August the White House mandated that all of the agencies in the US government have functioning DNSSEC capabilities deployed and operational by December 2009. I am suggesting here that we, as a community, commit to the same timetable. I call upon VeriSign and other registries to bring up DNSSEC support by January 2009. more

Call for Participation – ICANN DNSSEC and Security Workshop for ICANN74 Policy Forum

Do you have information about DNS security or routing security that you would like to share with the global community? Have you developed a new tool or system in this area? Do you have results from a research project that you want to share with a technical community? If so, please consider submitting a proposal to the DNSSEC and Security workshop to be held at ICANN 74 in June 2022. more

Twitter’s t.co Domain Outage Caused by Human Error

Declan McCullagh reporting in CNET: "Twitter last year began to abbreviate all hyperlinks using its t.co domain name -- which had the side effect of introducing a central point of failure where none existed before. That failure happened last night [Sunday Oct 7] around 11:30 p.m. PT when t.co went offline, meaning millions of Twitter users received 'non-existent domain' errors when trying to follow links." more

Minimized DNS Resolution: Into the Penumbra

Over the past several years, domain name queries - a critical element of internet communication - have quietly become more secure, thanks, in large part, to a little-known set of technologies that are having a global impact. Verisign CTO Dr. Burt Kaliski covered these in a recent Internet Protocol Journal article, and I'm excited to share more about the role Verisign has performed in advancing this work and making one particular technology freely available worldwide. more

Schmidt: Handing over Control of Internet, DNS to the UN a Disaster, Will Divide the Internet

During the Mobile World Congress 2012, Google's executive chairman Eric Schmidt, today warned against United Nations' treaty aimed at bringing more Internet regulation. "That would be a disaster... To some, the openness and interoperability is one of the greatest achievements of mankind in our lifetime. Do not give that up easily. You will regret it. You will hate it, because all of a sudden all that freedom, all that flexibility, you'll find it shipped away for one good reason after another." more

New Threats Demand a New Approach to DDoS Protection

In the past 24 months, distributed denial of service (DDoS) attacks have changed profoundly. Gone are the days when attackers worked under the radar, when machines were infected by botnet code unknowingly and attacks were disguised leaving very little to trace the exact origin. ... The other game-changer: It's easier than ever to execute attacks. The tools are so widely available that anyone with basic skills and a high-speed connection can become a "hacktivist." more

Building a More Secure Routing System: Verisign’s Path to RPKI

At Verisign, we believe that continuous improvements to the safety and security of the global routing system are critical for the reliability of the internet. As such, we've recently embarked on a path to implement Resource Public Key Infrastructure (RPKI) within our technology ecosystem as a step toward building a more secure routing system. In this blog, we share our ongoing journey toward RPKI adoption and the lessons we've learned as an operator of critical internet infrastructure. more

Doing More to Address Child Sexual Abuse Materials Online

For all of us at Public Interest Registry, working to remove child sexual abuse content from the Internet isn't just a part of our work; it's our moral duty. As stewards of the .ORG community, addressing the problem head on is the only option compatible with our values. Talking about Child Sexual Abuse Materials (CSAM) is challenging and uncomfortable. It's also far too important, and prevalent, of a problem to ignore. While it's impossible to know exact numbers, online CSAM is a major, rapidly growing crisis. more

Multi-Layer Security Architecture - Importance of DNS Firewalls

In today's world with botnets, viruses and other nefarious applications that use DNS to further their harmful activities, outbound DNS security has been largely overlooked. As a part of multi-layer security architecture, a DNS Firewall should not be ignored. After serving as a consultant for multiple organizations, I have encountered many companies that allow all internal devices to send outbound DNS queries to external DNS servers - a practice that can lead to myriad problems. more

Security Experts Urge Shifting from Defense to Offense in Cybersecurity

A report, released today by McAfee, Inc., titled "Security Takes the Offensive," says that traditionally, security technology companies and computer users have taken a defensive posture, putting the cyber equivalent of body armor on computers, networks and in the cloud. The report's authors say it is now time to avoid enemy strikes altogether by taking a more aggressive stance, aligning forces and involving law enforcement. more

Domain Name Registrations Reach 215 Million, 5 Million Added in Q2

The latest Domain Name Industry Brief published by Verisign reports more than 5 million domain names were added to the Internet in the second quarter of 2011, bringing the total number of registered domain names to more than 215 million worldwide across all domains. The increase of 5.2 million domain names marks a growth rate of 2.5 percent over the first quarter. Registrations have grown by more than 16.9 million, or 8.6 percent, since the second quarter of 2010. more