ICANN adds new gTLDs

The Internet Corporation for Assigned Names and Numbers (ICANN) is committed to launching a slew of new generic top level domains (gTLDs; i.e., those that are not country-code TLDs), and the first assortment of proposals has been published. ICANN's process has attracted no shortage of criticism, but there are also concerns over how the availability of hundreds of unrestricted TLDs will impact security.

In 2000, ICANN approved the first new gTLDs since the dawn of the DNS system in the 1980's. That set of seven domains (.aero, .biz, .coop, .info, .museum, .name, and .pro) was selected by ICANN's board out of roughly 40 applications, in one of its first official acts. ICANN policy dictates that the "sponsored" gTLDs — .aero, .coop, and .museum — be used only by particular industries or groups, and that the "restricted" gTLDs — .biz, .name, and .pro — be used only for specific purposes. Those requirements sound similar, with the main difference being that sponsored gTLDs are proposed by and subsequently managed by private entities. Eight more gTLDs were approved in 2003: .asia, .cat, .jobs, .mobi, .tel, .travel., .post, and .xxx, all of which are sponsored.

The current round of new gTLD selection is supposed to usher in unlimited numbers of new domains. The application period started on January 12 and ended on April 12, during which time ICANN took in 1,930 applications from 1,268 separate applicants. ICANN charged a $185,000 application fee for each domain, with the understanding that a $25,000 annual fee would accompany any domain eventually approved. ICANN published a one-page overview [PDF] of the applications, noting that there were 230 domains that had more than one applicant vying for control.

The list reads much like you would expect; there are plenty of companies seeking control of the .app, .secure, and .web gTLDs, many more out to create a brand-specific gTLD (such as .google and .bmw), and a few community- or geographically-oriented applications (such as .africa, .catholic, or .ieee). Up next comes the objection and dispute resolution process, which is tentatively slated to last seven months. Each objection to a gTLD application must meet one of ICANN's four grounds for objection (which are listed on the page), be brought by someone who meets the "standing" criteria, and include the appropriate fee (which varies depending on the objection). Those without deep pockets can also leave a comment at no charge, although comments that do not meet the formal objection grounds will not be forwarded to the evaluation panels.

Disputes between multiple organizations after the same domain will be handled by an ICANN review committee. If a consensus cannot be reached, the disputed domain will be auctioned off. The review process divides the entire set of applications into batches, with the first batch scheduled to land on reviewers' desks in July. ICANN has devised a mechanism for sorting applications into batches that is, shall we say, novel. Each applicant logs in to the ICANN site and competes to click on a timestamp-generating button; the applicants that come closest to hitting the target time are in batch one. Applicants (although perhaps "players" is more descriptive) get to select their own target time, and are allowed to practice before generating their timestamp for real.

Divide and conquer

The timestamp-generating process (which ICANN itself refers to as "digital archery") has attracted plenty of criticism and even mockery. But there are more substantial objections to the batching process, too. Rohan Pearce at Computerworld quotes one domain registrar as saying that applicants in later batches could find themselves waiting a number of years before their applications reach the examination stage.

The size of the fees associated with the process has also generated criticism. There is not much data with which to impartially compare ICANN's fee structure — apart from the fact that $185,000 is a substantial hike from 2000 and 2003's $50,000 sticker price. ICANN contends that running a gTLD is an expensive process not to be undertaken casually, so the fees are meant in part to discourage throngs of cybersquatters or mischief-makers from bogging down the process. NPR says that many see the high stakes as a "land grab" unfairly blocking out non-profit and community groups in favor of well-heeled businesses. It also notes that domain speculators shelled out a lot of capital for gTLDs of common words, including one company that filed 307 separate applications. The National Association of Advertisers even started a public petition to protest the policy, arguing that it forces business to spend money defensively acquiring domain names just to protect their brands.

Finally, there have long been critics who contend that ICANN and its processes are too US-centric. SiliconValley.com reports that China, Russia, and Brazil have lobbied to have ICANN's functions transferred to the United Nations or another international body. 911 of the 1,930 gTLD applications came from North America, which is not a majority, but may be enough to bolster such complaints.

Security implications

A radically-expanded set of valid gTLDs may also impact security. For starters, with 2,000 TLDs in the wild, it will be more difficult for legitimate businesses to police all of the possible variations on their name and product brand — or expensive to register them all. That will make it easier for domain phishing attackers to slip a phony site past users' eyes. E.g., in the heat of the moment, are you sure that your bank's actual URL was MyBank.finance and not MyBank.financial, or that you typed zork.games instead of zork.game? ICANN received applications for all four of those gTLDs.

It is also possible that the massive influx of new top-level registrars will make it more likely for a nefarious player of some sort to get into the gTLD game. A phisher running a domain registrar is a little far-fetched, but there are other possibilities. Some have suggested that the expansion plan will overload the root DNS zone, and that it would be better to partition the root. China has proposed a plan to the IETF that implements multiple autonomous roots. Under the plan, China would control its own country code TLD (.cn) and other national domain names, but still call out to peer DNS networks to resolve other domain names. Computerworld quotes Patrik Wallström of OpenDNSSEC as saying that the proposal instead amounts to "a way to severely segment the Internet", and notes China's reputation for blocking access to Internet content.

Then again, ICANN has had its own in-house security problems plague the gTLD process. It accidentally posted the mailing addresses and other personal information of applicants on the public web site (information which was supposed to remain confidential). That leak followed May's incident, in which the organization had to shut down the gTLD application system because it inadvertently exposed personal information to other applicants.

Whatever the long-term impact is on security, one can rest assured that increasing the number of TLDs by a factor of 100 will cause considerable extra work for administrators and developers, on every task from email address verification to traffic analysis. The fifteen new gTLDs ICANN has already introduced still account for only a fraction of the registrations in the original TLDs, and while none of the newly-proposed TLDs are likely to unseat .com either, rewriting the rules of what constitutes a valid domain will have far-reaching impacts.