PIR supports suspension of VeriSign DNS wildcard service

September 23rd, 2003
By PIR Press Release

The Public Interest Registry (PIR), manager of the .ORG domain, today announced its opposition to VeriSign's deployment of a Domain Name System (DNS) wildcard service in a letter to Dr. Paul Twomey, President & CEO of the Internet Corporation for Assigned Names and Numbers (ICANN). The VeriSign wildcard redirects traffic that would otherwise have resulted in a "no domain" response to a VeriSign-operated website with search results and links to paid advertisements.

In the letter, PIR Board Chairman David W. Maher urged ICANN to take whatever remedial action is needed to remove all wildcard DNS systems, including VeriSign's Site Finder, from the DNS. "Such an action, emphasizing the central responsibility of all service providers, would be an important step in preserving the openness and accessibility of the Internet," he explained.

Maher also promised that PIR would not offer any service that makes such a change in the DNS out of concern for the Internet community as a whole. "We believe that any such efforts to alter the TLD DNS systems, of which the VeriSign Site Finder appears to be the most prominent example, adversely affect the Internet infrastructure and the entire Internet community," said Maher. "Internet services such as the WWW and e-mail rely on DNS to function, and there should be no interference with the established protocols until there is complete assurance of no negative impact on the DNS."

PIR's Letter to ICANN Follows

Dear Paul [ICANN President],

Public Interest Registry (PIR), the operator of the registry of the .ORG domain supports ICANN's call for the voluntary suspension of VeriSign's deployment of a DNS wildcard service. We believe that ICANN (and the entire Internet community) should take steps to prevent all registries from unilaterally implementing changes to DNS that redirect requests for invalid domain names to any other site. PIR will not offer any service that makes such a change in the DNS.

PIR also supports the Internet Architecture Board (IAB) statement on the same subject as set forth at:

iab.org/documents/docs/2003-09-20-dns-wildcards.html

DNS is a critical piece of Internet infrastructure. Internet services such as the WWW and Email rely on DNS to function, and there should be no interference with the established protocols until there is complete assurance of no negative impact on the DNS.

In another context, the Internet Architecture Board (IAB) has commented:

"At the core of all of the IAB's concerns is the architectural principle that the DNS is a lookup service which must behave in an interoperable, predictable way at all levels of the DNS hierarchy. Furthermore, as a lookup service it is such a fundamental part of the Internet's infrastructure that converting it to an application-based search service is not appropriate even in the case where the query presented would not normally map to a registered domain." The architectural principle referred to by the IAB is clearly violated by the changes proposed for the .COM and .NET domains.

On Monday, September 15, VeriSign changed the behavior of the .COM and .NET TLDs by adjusting servers to respond to requests for non-existent domains with a reference to the VeriSign Site Finder web site, (in other words, "wildcarding"). To a requesting user, it appears that non-existent domains are valid, because they are directed to the Site Finder. There is no difference between the responses for valid domains versus invalid domains from VeriSign's TLD servers. Because the VeriSign Site Finder server makes it appear that a non-existent domain exists, the service introduces significant problems to critical Internet infrastructure. Many other important Internet protocols rely heavily on proper DNS behavior. The impact of VeriSign's Site Finder is unclear with respect to security of the DNS. Site Finder unilaterally precludes the use of a prevalent type of anti-spam mail filter that uses DNS to validate the domain of legitimate eMails.

Because VeriSign's servers are authoritative for the .COM and .NET TLDs, the most prevalent of the TLDs, Internet users have little protection against the imposition of this flawed system. VeriSign implemented the Site Finder system with little advance notice or public commentary by the Internet community. We believe such unilateral behavior in changing a critical resource necessary for the world's information systems is inconsistent with the responsibilities of registries under their contracts with ICANN, particularly because of the necessity of DNS for other Internet resources to function properly.

Letter from the Internet Architecture Board to M. Stuart Lynn, 25 January, 2003, "Re: Request for Advice on VGRS IDN Announcement"

We are informed that other domain registries may be exploring services similar to the VeriSign Site Finder. (As noted above, PIR will not be one of them.) If this is the case, our comments concerning Site Finder apply with equal force to those other services. We believe that any such efforts to alter the TLD DNS systems, of which the VeriSign Site Finder appears to be the most prominent example, adversely affect the Internet infrastructure and the entire Internet community.

Therefore, we urge ICANN to take whatever remedial action is needed to remove all "wildcard" DNS systems, including VeriSign's Site Finder, from the DNS. Such action, emphasizing the central responsibility of all service providers, would be an important step in preserving the openness and accessibility of the Internet.

Respectfully submitted,

PUBLIC INTEREST REGISTRY

/S David W. Maher, Chairman