Name Collisions Briefing for Clients of Valideus 4 March 2014
4 March 2014 1. Foreword This report was produced by Valideus Limited to highlight how JAS Global Advisors name collision recommendations will affect registries in the new gtld process. The draft recommendations (PDF), commissioned by ICANN and carried out by JAS Global Advisors, are available at: https://www.icann.org/en/about/staff/security/ssr/name-collision-mitigation-26feb14-en.pdf Public comment is open until 21 April 2014. Any requests for further information concerning this document should be addressed to: Nick Wood, Valideus Limited, Managing Director Email: nick.wood@valideus.com Direct line: +44 20 7421 8262 Lorna Gradden, Valideus Limited, Operations Director Email: lorna.gradden@valideus.com Direct line: +44 20 7421 8263 Your client manager, Valideus Limited Email: firstname.lastname@valideus.com Phone: +44 20 7421 8299 Valideus Limited 2nd Floor, 28-30 Little Russell Street London, WC1A 2HN, United Kingdom Telephone: +44 20 7421 8250 www.valideus.com Valideus Limited is registered in England under company number 06181291. 2014 Valideus Limited Private and Confidential Page 1
Contents 1. Foreword... 1 2. Background... 3 3. Summary... 3 4. Impact on new TLD operators... 4 4.1 TLDs not yet delegated... 4 4.2 Delegated TLDs... 4 4.3 Reporting mechanism for all TLDs... 4 4.4 Prohibited TLDs... 5 5. Unanswered questions... 5 6. Public comment period... 5 7. Annex - JAS report recommendations... 6 2014 Valideus Limited Private and Confidential Page 2
2. Background A Name Collision occurs when Internet users unknowingly access a domain name that has been delegated (registered) in the public Domain Name System (DNS) when the user s intent was to access a resource identified by the same name in a private (e.g. workplace) network. These collisions might result in unexpected network behaviour or even present security risks to users. ICANN commissioned JAS Global Advisors to prepare a report on ways to mitigate these risks. This paper captures the main points of that report relevant to you both as a TLD operator and as a trademark owner. (The recommendations have not yet been adopted by ICANN.) Overall, JAS says: We do not find that the addition of new TLDs fundamentally or significantly increases or changes the risks associated with [existing] DNS namespace collisions. JAS found no evidence to suggest that the security and stability of the global Internet DNS itself is at risk. This finding confirms the results of the DNS Stability String Review performed on each string during Initial Evaluation pursuant to [ICANN s] Applicant Guidebook. 3. Summary The JAS report [PDF] produced 11 different recommendations to mitigate the possible risks caused by Name Collisions (see Annex). Five out of those 11 recommendations have a direct impact on you as a TLD operator who has not yet launched, and as a trademark owner (in terms of brand monitoring in other TLDs that have already launched). Other recommendations are targeted towards ICANN and making its role clearer in the Name Collision risk mitigation plan. The most significant recommendations for TLD operators in the JAS report suggest introducing a new process called a controlled interruption period during which TLD operators must publish a special Zone File entry in their DNS for a 120 day trial period to catch potential Name Collisions before the TLD goes live on the public Internet. After this trial period no further restrictions would be imposed on domain name registrations, except for potentially problematic names that were identified during the trial period. In this respect, JAS says: We believe the introduction of new TLDs offers an opportunity to educate operators regarding DNS namespace collisions and help find and remedy potential collision-related issues that may be present in their systems. As such, we recommend implementation of a 120-day controlled interruption period for all approved new TLDs [we believe this] period offers a conservative buffer between potential legacy usage of a TLD and the new usage. Another recommendation deals with any potentially problematic Name Collisions detected after the controlled interruption period. The report recommends that only the Name Collisions which present a clear and present danger to human life should result in domain name takedowns. The report recommends that ICANN provide a reporting mechanism for handling any reports of postcontrolled interruption collisions. In extreme cases where a TLD operator fails to comply with a related domain takedown request, ICANN could switch TLD operations over to an emergency backend provider. The report also recommends permanently barring three TLDs from delegation:.corp,.home, and.mail. 2014 Valideus Limited Private and Confidential Page 3
4. Impact on new TLD operators The JAS recommendations are more relaxed than ICANN s previous Name Collision mitigation measures. The recommendations are split into (i) TLDs not yet delegated, and (ii) delegated TLDs: 4.1 TLDs not yet delegated JAS proposes that Registry operators run a controlled interruption period in their DNS for 120 days after delegation to identify possible Name Collisions before the TLD goes live on the public Internet and allows domain name registrations. No domain names can be registered during this 120 day trial period A wildcard Zone File entry for all possible names across your entire TLD returns a specific response (such as: "Your DNS configuration needs immediate attention see [URL] ) to colliding queries from private networks - This response notifies the operator of the colliding private network to create a solution within their network configuration to avoid future collisions After 120 days the wildcard entry is removed and no further Name Collision related restrictions are proposed Domain names can then be registered without restriction (the block list no longer applies), except for any names flagged as life threatening in the controlled interruption period 4.2 Delegated TLDs Already delegated TLDs that have chosen the alternate path to delegation (i.e. they have blocked a list of names flagged by ICANN) may continue to register second level domain names not appearing on the ICANN block list during the 120 day trial period. These registries also need to apply the special zone file entry (in fact, they only need to apply some of the DNS records, but the effect is very similar) used for not-yet-delegated TLDs for a 120 day period, but it should only be applied to the terms on their blocked list, rather than to all possible terms in the TLD. This will allow domains already in use to continue, while targeting the most potentially problematic names (namely, those on the blocked list) for the controlled interruption. After the 120 day trial period, these TLDs may accept registrations for all names (including those previously blocked), subject to any names flagged during the 120 day period as life threatening ). 4.3 Reporting mechanism for all TLDs ICANN will provide a mechanism for reporting Name Collisions that present a clear and present danger to human life. In the event of such a report, ICANN will issue a request to the TLD operator to take down the relevant domain name. As a measure of last resort, ICANN can transfer TLD operations to an emergency backend provider if the TLD fails to comply with the takedown request. The report doesn t recommend de-delegation of a TLD under any circumstances. 2014 Valideus Limited Private and Confidential Page 4
4.4 Prohibited TLDs The JAS report recommends that the.home,.corp and.mail applied-for TLDs be permanently blocked from the public Internet root as those names are widely used in private networks. 5. Unanswered questions While the JAS report covers risk mitigation measures for future TLD launches in detail, it gives considerably less attention to those TLDs that have already been delegated and launched. 1. The manner of releasing blocked names (including Sunrise and Claims requirements) for registration in not-yet delegated TLDs remains unclear, i.e. can TLD operators accept registration requests (but not release them for use) during the 120 day trial period? 2. Can a registry still reserve (and use) 100 names for promotion of the TLD or will all names be included in the controlled interruption period without exception for not-yet-delegated TLDs? 3. If already-live TLDs are not selling blocked names currently, will these be subject to Sunrise and Trademark Claims once the 120 day trial period ends? (We think there is some precedent for this in ICANN s RPM Requirements rules, but it is currently unclear.) 6. Public comment period The JAS report (and recommendations) has been published for public comment as follows: Comment open date Comment close date Reply open date Reply close date 26 February 2014 31 March 2014 1 April 2014 21 April 2014 23:59 UTC 23:59 UTC We intend to submit a public comment on this proposal, but you may also wish to submit your own public comment. If you would like to discuss this report in more detail, please reach out to your client manager. 2014 Valideus Limited Private and Confidential Page 5
7. Annex - JAS report recommendations Recommendation 1: The TLDs.corp,.home, and.mail be permanently reserved for internal use and receive RFC 1918-like protection/treatment, potentially via RFC 6761. Recommendation 2: ICANN continue efforts to make technical information available in fora frequented by system operators (e.g. network operations groups, system administration-related conferences, etc.) regarding the introduction of new gtlds and the issues surrounding DNS namespace collisions. Recommendation 3: Emergency response options are limited to situations where there is a reasonable belief that the DNS namespace collision presents a clear and present danger to human life. Recommendation 4: Root-level de-delegation of a production TLD is not considered as an emergency response mechanism under any circumstances. Recommendation 5: ICANN leverage the EBERO mechanisms and functionality to respond to DNS namespace-related issues. ICANN must have the following capabilities on a 24x7x365, emergency basis: 1). Analyse a specific report/incident to confirm a reasonable clear and present danger to human life; 2). Direct the registry on an emergency basis to alter, revert, or suspend the problematic registrations as required by the specific situation; 3). Ensure that the registry complies in a timely manner; and 4). Evaluate and monitor the specific situation for additional required actions. Furthermore, we recommend that ICANN develop policies and procedures for emergency transition to an EBERO provider and/or emergency root-level de-delegation in the event the registry is unable and/or unwilling to comply. We recommend ICANN maintain this capability indefinitely. Recommendation 6: ICANN require new TLD registries to publish the controlled interruption zone immediately upon delegation in the root zone. After the 120-day period, there shall be no further collision-related restrictions on the registry. Recommendation 7: ICANN require registries that have elected the alternative path to delegation, rather than a wildcard, instead publish appropriate A and SRV resource records for the labels in the ICANN 2LD Block List to the TLD s zone with the 127.0.53.53 address for a period of 120 days. After the 120-day period, there shall be no further collision-related restrictions on the registry. Recommendation 8: ICANN relieve the prohibition on wildcard records during the controlled interruption period. Recommendation 9: ICANN monitor the implementation of controlled interruption by each registry to ensure proper implementation and compliance. Recommendation 10: ICANN, DNS-OARC, and the root operators explore a medium-latency, aggregated summary feed describing queries reaching the DNS root. Recommendation 11: ICANN, DNS-OARC, and the root operators explore establishment of a single, authoritative, and publicly available archive for historical data related to the root. 2014 Valideus Limited Private and Confidential Page 6