Part 2 of 4 – DITL Data Isn’t Statistically Valid for This Purpose
For several years, DNS-OARC has been collecting DNS query data “from busy and interesting DNS name servers” as part of an annual “Day-in-the-Life” (DITL) effort (an effort originated by CAIDA in 2002) that I discussed in the first blog post in this series. DNS-OARC currently offers eight such data sets, covering the queries to many but not all of the 13 DNS root servers (and some non-root data) over a two-day period or longer each year from 2006 to present. With tens of billions of queries, the data sets provide researchers with a broad base of information about how the world is interacting with the global DNS as seen from the perspective of root and other name server operators.
In order for second-level domain (SLD) blocking to mitigate the risk of name collisions for a given gTLD, it must be the case that the SLDs associated with at-risk queries occur with sufficient frequency and geographical distribution to be captured in the DITL data sets with high probability. Because it is a purely quantitative countermeasure, based only on the occurrence of a query, not the context around it, SLD blocking does not offer a model for distinguishing at-risk queries from queries that are not at risk. Consequently, SLD blocking must make a stronger assumption to be effective: that any queries involving a given SLD occur with sufficient frequency and geographical distribution to be captured with high probability.
Put another way, the DITL data set – limited in time to an annual two-day period and in space to the name servers that participate in the DITL study – offers only a sample of the queries from installed systems, not statistically significant evidence of their behavior and of which at-risk queries are actually occurring.
Verisign Delegates Four New gTLDs to the Root Zone
Guest post from Pat Kane, Senior Vice President, Naming and Directory Services
On Oct. 23, 2013, at approximately 11:00 a.m. EDT, Verisign received authorization instructions from the U.S. Department of Commerce National Telecommunications and Information Administration (NTIA) to delegate four new gTLDs into the root zone, which we are responsible for maintaining per the Cooperative Agreement between Verisign and NTIA. Verisign acted in accordance with our contractual obligation and delegated these TLDs into the root zone at 2:33 p.m. EDT the same day.
Verisign Launches Verisign DomainScope: Take the Guesswork Out of Finding the Right Domain Name
Today Verisign announced the launch of Verisign DomainScope, a new domain name discovery tool designed to enhance the search for unique, relevant domain name choices in the .com, .net, .tv and .cc top-level domains. Incorporating the same functionality found in our DomainFinder, DomainScore and DomainCountdown tools, DomainScope replaces these tools and allows users to focus their domain search and uncover new domain name registration opportunities in one place.*
Diversity, Openness and vBSDcon 2013
“There never were in the world two opinions alike, no more than two hairs or two grains; the most universal quality is diversity”
–Michel Eyquem, seigneur de Montaigne (1533–1592)
Diversity is a central design principle of the Domain Name System. With respect to the DNS root, it’s the reason that there are 13 separately managed root servers with 12 independent operators. It’s the reason Verisign operates the two root servers we’re responsible for – the A and J roots – as well as other name servers – at multiple locations around the world. It’s also the reason that within these locations operated by Verisign, multiple physical servers handle the incoming traffic. And it’s the reason that among these multiple servers, we use multiple hardware and software platforms, as well as multiple network providers.
In other words, diversity is one reason the DNS industry in general, and Verisign in particular, doesn’t do everything the same way and in the same place.
New gTLD Queries at the Root & Heisenberg’s Uncertainty Principle
Since we published our second SSR report a few weeks back, recently updated with revision 1.1, we’ve been taking a deeper look at queries to the root servers that elicit “Name Error,” or NXDomain responses and figured we’d share some preliminary results.
15 Facts About .net to Celebrate 15 Million Registrations
Recently, .net hit a major milestone when its zone surpassed 15 million .net domains registered globally, making it one of the most popular domain extensions on the Internet today. Supported by the same infrastructure and expertise that has powered .com for more than 15 years, .net is recognized around the world as an established and credible place to interact online. To mark this momentous occasion, we pulled together 15 facts about .net. How many .net facts do you already know?
Part 5 of 5; New gTLD SSR-2: Exploratory Consumer Impact Analysis
Throughout this series of blog posts we’ve discussed a number of issues related to security, stability and resilience of the DNS ecosystem, particularly as we approach the rollout of new gTLDs. Additionally, we highlighted a number of issues that we believe are outstanding and need to be resolved before the safe introduction of new gTLDs can occur – and we tried to provide some context as to why, all the while continuously highlighting that nearly all of these unresolved recommendations came from parties in addition to Verisign over the last several years. We received a good bit of flack from a small number of folks asking why we’re making such a stink about this, and we’ve attempted to meter our tone while increasing our volume on these matters. Of course, we’re not alone in this, as a growing list of others have illustrated, e.g., SSAC SAC059’s Conclusion, published just a little over 90 days ago, illustrates this in part:
The SSAC believes that the community would benefit from further inquiry into lingering issues related to expansion of the root zone as a consequence of the new gTLD program. Specifically, the SSAC recommends those issues that previous public comment periods have suggested were inadequately explored as well as issues related to cross-functional interactions of the changes brought about by root zone growth should be examined. The SSAC believes the use of experts with experience outside of the fields on which the previous studies relied would provide useful additional perspective regarding stubbornly unresolved concerns about the longer-term management of the expanded root zone and related systems.
Part 4 of 5; NXDOMAINS, SSAC’s SAC045, and new gTLDs
In 2010, ICANN’s Security and Stability Advisory Committee (SSAC) published SAC045, a report calling attention to particular problems that may arise should a new gTLD applicant use a string that has been seen with measurable (and meaningful) frequency in queries for resolution by the root system. The queries to which they referred involved invalid top-level domain (TLD) queries (i.e., non-delegated strings) at the root level of the domain name system (DNS), queries which elicit responses commonly referred to as Name Error, or NXDomain, responses from root name servers.
Update on Verisign’s IDN Implementation Plans
The composition of the internet’s population has seen a dramatic shift over the last two decades. In 1996, the majority of end users were based in the U.S.; according to a 2012 Comscore report, the non-English speaking internet population has grown to 87 percent, with more than 40 percent based in the Asia-Pacific region. In order to embrace this population shift, we believe the internet must become multilingual so it can be accessible and relevant to the majority of end users today.
Part 3 of 5: Name Collisions, Why Every Enterprise Should Care
Do you recall when you were a kid and you experienced for the first time an unnatural event where some other kid “stole” your name and their parents were now calling their child by your name, causing much confusion for all on the playground? And how this all made things even more complicated – or at least unnecessarily complex when you and that kid shared a classroom and teacher, or street, or coach and team, and just perhaps that kid even had the same surname as you, amplifying the issue! What you were experiencing was a naming collision (in meatspace).