DNS

Policy Advisory Boards - A Cornerstone PICS (Public Interest Commitment Specification)

Six months following the April 11th issuance of the Beijing Communique by ICANN's Governmental Advisory Committee (GAC), ICANN continues to wrestle with whether to accept the bulk of the GAC's proposed safeguards for new gTLDs as set forth in Annex 1 of that document. On October 1st ICANN Board Chairman Stephen Crocket sent a letter to GAC Chair Heather Dryden summarizing the results of the September 28th meeting of the New gTLD Program Committee (NGPC) that considered the remaining and still undecided advice received from the GAC. more

US Senate Committee Holds Hearing on ICANN’s New TLD Expansion

As previously noted, the U.S. Senate Committee on Commerce, Science, and Transportation today held a full committee hearing on ICANN's expansion of top level domains (TLDs). The hearing was held to examine the merits and implications of the program and ICANN's efforts to address concerns raised. ICANN will begin accepting applications for new TLDs on January 12, 2012. more

DNS Resolvers and DNSSEC: Roll Over and Die?

Security is great when all the green lights are shining brightly and everything validates as intended, but what happens when you encounter failure? In this work we examine the behaviour of the DNS when security, in the form of DNSSEC is added, and we look at what happens when things do not happen as intended. What triggered this examination was a sudden increase in the traffic generated by secondary servers for the in-addr.arpa reverse zones in December 2009. more

ICANN Can’t Take Care of Everything

Bruce Young tells a story of an Internet user who gets into trouble because "his" domain name was registered in the name of a web hosting provider that went bankrupt later on...As far as registrars are concerned, ICANN is currently doing its homework on domain name portability. As far as web hosting companies are concerned, though, these suggestions only look appealing at first sight. Upon closer inspection, they wouldn't be good policy... more

Google Launch of DNS Service and OpenDNS Reply

Earlier today Google announced the launch of their new DNS service. They're pushing it as part of their "better experience" and "speed" drive that Matt Cutts and Co have been harping on about for the last while. OpenDNS, however, has been offering a similar service for quite some time... So it was quite interesting to read OpenDNS' response to the Google service. more

Black Helicopters for the DNS: What Happens In 2025?

When Steve delBianco from NetChoice testified (April 2, 2014) in the Subcommittee on Communications and Technology of the US House of Representatives on "Ensuring the Security, Stability, Resilience, and Freedom of the Global Internet", he proposed a stresstest for new mechanisms which could substitute the role of the NTIA in overseeing the IANA contract with ICANN. Stresstests are good. It is good for cars, it is good for banks and it is good for new mechanisms... more

Information Protection for the Domain Name System: Encryption and Minimization

In previous posts in this series, I've discussed a number of applications of cryptography to the DNS, many of them related to the Domain Name System Security Extensions (DNSSEC). In this final blog post, I'll turn attention to another application that may appear at first to be the most natural, though as it turns out, may not always be the most necessary: DNS encryption. (I've also written about DNS encryption as well as minimization in a separate post on DNS information protection.) more

ICANN’s At-Large Process: Exit, Without Voice

ICANN seems to be out to re-prove Hirschman's theories of exit, voice, and loyalty by driving all of its good people to exit rather than giving them meaningful voices. Thomas Roessler, a long-time advocate of individual users' interests on the interim ALAC now suggests it's Time to Reconsider the structure of ICANN's At-Large, as he feels compelled to promise himself not to get involved with ICANN again... more

Wow! BIND9 9.10 Is out, and What a List of Features!

Today the e-mail faerie brought news of the release of BIND9 9.10.0 which can be downloaded from here. BIND9 is the most popular name server on the Internet and has been ever since taking that title away from BIND8 which had a few years earlier taken it from BIND4. I used to work on BIND, and I founded ISC, the home of BIND, and even though I left ISC in July 2013 to launch a commercial security startup company, I remain a fan of both ISC and BIND. more

Over 75% of All Top-Level Domains (TLDs) Now Signed With DNSSEC

As I was entering in data for the weekly DNSSEC Deployment Maps, I was struck by the fact that we are now at the point where 617 of the 795 top-level domains (TLDs) are now signed with DNSSEC. You can see this easily at Rick Lamb's DNSSEC statistics site...Now, granted, most of that amazing growth in the chart is because all of the "new generic TLDs" (newgTLDs) are required to be signed with DNSSEC, but we are still seeing solid growth around the world. more

Ongoing Internet Emergency and Domain Names

There is a current ongoing Internet emergency: a critical 0day vulnerability currently exploited in the wild threatens numerous desktop systems which are being compromised and turned into bots, and the domain names hosting it are a significant part of the reason why this attack has not yet been mitigated. This incident is currently being handled by several operational groups. This past February, I sent an email to the Reg-Ops (Registrar Operations) mailing list. The email, which is quoted below, states how DNS abuse (not the DNS infrastructure) is the biggest unmitigated current vulnerability in day-to-day Internet security operations, not to mention abuse. more

New Regime for Registration of .fr

Association Francaise pour le Nommage Internet en Cooperation ("AFNIC"), the domain name authority managing the French country code top level domain, is introducing a new regime for registration of .fr domain names. Among the main changes, the new regime abolishes any "right to the name". Until now an applicant for registration of a .fr domain name must prove that the domain name reflects its company name, business name or trade mark that is in force in France. more

Google Announces DNSSEC Support for Public DNS Service

Google today announced that its "Public DNS" service is now performing DNSSEC validation. Yunhong Gu, Team Lead for Google Public DNS, in post today wrote: "We launched Google Public DNS three years ago to help make the Internet faster and more secure.Today, we are taking a major step towards this security goal: we now fully support DNSSEC (Domain Name System Security Extensions) validation on our Google Public DNS resolvers." more

What’s Behind the Secure DNS Controversy and What Should You Do About It?

Anyone that has attended a meeting of the Internet Engineering Task Force (IETF) will know that the somewhat dry topic of internet protocols is often the source of passionate disagreement. But rarely does that debate extend beyond the confines of internet engineers. That has not been the case with a new protocol which aims to make the Internet's underlying domain name system more secure by default. more

Stopping SOPA’s Anti-Circumvention

The House's Stop Online Piracy Act is in Judiciary Committee Markup today. As numerous protests, open letters, and advocacy campaigns across the Web, this is a seriously flawed bill. Sen. Ron Wyden and Rep. Darrell Issa's proposed OPEN Act points out, by contrast, some of the procedural problems. Here, I analyze just one of the problematic provisions of SOPA: a new"anticircumvention" provision more