DNS

Twitter’s t.co Domain Outage Caused by Human Error

Declan McCullagh reporting in CNET: "Twitter last year began to abbreviate all hyperlinks using its t.co domain name -- which had the side effect of introducing a central point of failure where none existed before. That failure happened last night [Sunday Oct 7] around 11:30 p.m. PT when t.co went offline, meaning millions of Twitter users received 'non-existent domain' errors when trying to follow links." more

New Threats Demand a New Approach to DDoS Protection

In the past 24 months, distributed denial of service (DDoS) attacks have changed profoundly. Gone are the days when attackers worked under the radar, when machines were infected by botnet code unknowingly and attacks were disguised leaving very little to trace the exact origin. ... The other game-changer: It's easier than ever to execute attacks. The tools are so widely available that anyone with basic skills and a high-speed connection can become a "hacktivist." more

Preparing DNSSEC for the Post-Quantum Era

To prepare DNS security for a post-quantum future, Verisign and partners are testing new cryptographic strategies that balance security, performance, and feasibility, especially through the novel Merkle Tree Ladder mode for managing large signatures. more

Building a More Secure Routing System: Verisign’s Path to RPKI

At Verisign, we believe that continuous improvements to the safety and security of the global routing system are critical for the reliability of the internet. As such, we've recently embarked on a path to implement Resource Public Key Infrastructure (RPKI) within our technology ecosystem as a step toward building a more secure routing system. In this blog, we share our ongoing journey toward RPKI adoption and the lessons we've learned as an operator of critical internet infrastructure. more

Multi-Layer Security Architecture - Importance of DNS Firewalls

In today's world with botnets, viruses and other nefarious applications that use DNS to further their harmful activities, outbound DNS security has been largely overlooked. As a part of multi-layer security architecture, a DNS Firewall should not be ignored. After serving as a consultant for multiple organizations, I have encountered many companies that allow all internal devices to send outbound DNS queries to external DNS servers - a practice that can lead to myriad problems. more

Security Experts Urge Shifting from Defense to Offense in Cybersecurity

A report, released today by McAfee, Inc., titled "Security Takes the Offensive," says that traditionally, security technology companies and computer users have taken a defensive posture, putting the cyber equivalent of body armor on computers, networks and in the cloud. The report's authors say it is now time to avoid enemy strikes altogether by taking a more aggressive stance, aligning forces and involving law enforcement. more

ICANN Con Rocas (or ‘ICANN On the Rocks’)

ICANN Meetings can be an intimidating place for first-timers or even those who have only attended for the few years. The acronyms fly fast and furious. The participants, or at least most of them, have been working on the issues for years (even decades). The technical and policy issues are complex. Luckily, however, an attendee can overcome these barriers to entry with a few drinks at the hotel bar. .. more

Domain Name Registrations Reach 215 Million, 5 Million Added in Q2

The latest Domain Name Industry Brief published by Verisign reports more than 5 million domain names were added to the Internet in the second quarter of 2011, bringing the total number of registered domain names to more than 215 million worldwide across all domains. The increase of 5.2 million domain names marks a growth rate of 2.5 percent over the first quarter. Registrations have grown by more than 16.9 million, or 8.6 percent, since the second quarter of 2010. more

How to Place Top-Level Domain Trust Anchors in the Root

The project to sign the DNS root zone with DNSSEC took an additional step toward completion yesterday with the last of the "root server" hosts switching to serving signed DNSSEC data. Now every DNS query to a root server can return DNSSEC-signed data, albeit the "deliberately unvalidatable" data prior to the final launch. Another key piece for a working signed root is the acceptance of trust anchors in the form of DS records from top-level domain operators. These trust anchors are used to form the chain of trust from the root zone to the TLD. more

Ensuring a Strong ICANN Accountability Framework

The U.S. Government's decision to transition its legacy role as the administrator of the IANA functions contract to the global multi-stakeholder community is an important step in the continued evolution of the Internet. While the Motion Picture Association of America (MPAA) supports this transition, we strongly believe that a comprehensive accountability framework, developed, agreed to and approved by the multi-stakeholder community must be in place in advance of finalizing any IANA transition recommendations. more

The .ORG Debate Should be About What Its Users Want

I watch the controversy over the proposed sale of the .ORG domain with a mixture of bemusement and concern. Some in the ICANN community – mostly those who resent that the Internet ever became commercialized – oppose the sale of the Public Interest Registry to the for-profit company Ethos for $1.1 billion. The basis of their concern is that the domain for non-profits should be in the hands of a non-profit and that the new owners might increase the current $9.93 fee PIR charges for a domain. more

Researchers Detail Faster Methods to Defeat Botnets Like Conficker and Kraken

Michael Cooney reporting in NetworkWorld: "Security researchers this week will detail a prototype system they say can better detect so-called Domain Name Generation- (DGA) based botnets such as Conficker and Kraken without the usual labor- and time-intensive reverse-engineering required to find and defeat such malware. The detection system, called Pleiades, monitors traffic below the local DNS server and analyzes streams of unsuccessful DNS resolutions..." more

6th Registration Operations Workshop (ROW), Madrid, Friday May 12th 2017

The Registration Operations Workshop (ROW) was conceived as an informal industry conference that would provide a forum for discussion of the technical aspects of registration operations in the domain name system. The 6th ROW will be held in Madrid, on Friday May 12th 2017 in the afternoon, immediately after the GDD Industry Summit and prior to ICANN DNS Symposium and OARC 26, using the same venue as all above-mentioned events. more

Canadian International Pharmacy Association Calls for Ban of Online Sale of Opioids

The wide availability of dangerous and addictive drugs is ravaging society. Such devastation is bringing ever-increasing attention from legislators, regulators and from families who have lost loved ones. The Canadian International Pharmacy Association (CIPA) believes that the online marketing and sales of such products should be banned immediately. We call on governments, technology platforms, and the ICANN community to act quickly and bring an end to opioid sales online. more

Top Level Domains and a Signed Root

With DNSSEC for the root zone going into production in a couple of weeks, it is now possible for Top Level Domain (TLD) managers to submit their Delegation Signer (DS) information to IANA. But what does this really mean for a TLD? In this post we're going to try to sort that out. more