Primary Domain
DNS
Within the Primary Domain facet, DNS intelligence groups reporting by primary domain so readers can follow a focused area of internet infrastructure, governance, connectivity markets, or digital capital. The page brings together related articles, public evidence, institutions, companies, people, regional exposure, operating dependencies, and market context that may otherwise sit across separate category pages. It explains the domain, the likely actor class, the market or governance context, and the source material readers should use when comparing signals. Operators, analysts, and governance readers can see how the same domain appears across events, profiles, market shifts, public-source evidence, regional dependencies, and longer-cycle infrastructure decisions over time.
Leaders
Dean Pemberton Tried to Make a Poisoned IPv4 Block a DNS Address. APNIC Said Yes, Then No.
APNIC had set 1.2.3.0/24 aside because unwanted traffic made ordinary distribution a bad bet. Pemberton proposed a local anycast resolver address instead. The Policy SIG agreed on Thursday; the Member Meeting did not on Friday. The dirty traffic was both his raw material and the…
Academics
Giovane Moura Wants Comparable DNS Data. .nl’s IPv6 History Is Lost.
SIDN’s public DNS archive puts top-level-domain traffic into a common format. Its own README also records a missing day and an IPv6 measure whose earlier history cannot be recovered.
IETF
Joe Abley’s DNSSEC Test: 1 ms at the Median, 1.405 Seconds at p99
The middle of Cloudflare’s early quantum-safe DNSSEC test barely moved. The slowest one per cent did: the dual-signed path logged 1,405 ms more elapsed time than the classical control at p99, while the validating-resolver chart labeled aggregate net breakage at 6.0%. The…
ICANN
Carlos Gañán Split the DNS-Abuse Score: More Months, Smaller Campaigns
Across 1,106 gTLDs, Category 1 namespaces had a 3.1-percentage-point higher monthly probability of abuse, while expected campaign scale was 38% lower once abuse appeared. Combined, the model estimated 37% fewer maliciously registered domains per gTLD-month.
Academics
Ginevra Fabrizio’s Falcon Test Saved 11 Bytes. NXDOMAIN Still Blew Past the Limit
At RIPE 93, the University of Twente researcher compared padded and unpadded Falcon-512 against a replay of one day of `.nl` queries. The unpadded signature median was 655 bytes against 666; every tested NXDOMAIN reply still exceeded both studied packet-size thresholds.
IETF
Algorithm 18 Got a Number. Joe Abley Found the EPP Gate.
IANA lists ML-DSA-44 as DNSSEC algorithm 18. At RIPE 93, Joe Abley described a different obstacle: a registry can still reject the DS data that an operator needs to submit through EPP. His October draft proposes making those acceptance rules follow the IANA registries.
Academics
Martine Sophie Lenders found the tell encrypted DNS left in the packet
Her constrained-IoT study did not read the query. It measured how packet shape could still identify DNS traffic—and how CoAP block transfer and header compression narrowed that signal.
Global Institutional
Five fixed builds and one vague word: reading CVE-2025-40778
A dated report on a cache-poisoning flaw in BIND 9 lists exactly which builds carry the fix and leaves the affected side at "various". That asymmetry decides what the record can prove to whoever signs off the upgrade — and what it quietly cannot.
CASE FILE
Dyn kept resolving. No instrument gave resolution a duty.
A shared naming provider absorbed botnet traffic in October 2016 and has lived in the record ever since as an outage story. The documents that followed are stranger than the story: a federal warning about the devices that launched the traffic, then a statute about the federal…
Leaders
Ray Bellis and the Line Between a Published Document and a Running Network
Two documents carry Ray Bellis's name in the IETF record. One is a single-author advice note that spends its mandatory language telling implementers what not to break. The other creates shared state, takes numbers in a public registry and bears six signatures. Read side by side…
ICANN
The .org refusal: a consent gate without a published test
In November 2019 the Internet Society agreed to sell Public Interest Registry, the operator of the .org top-level domain, to the private equity firm Ethos Capital. On 30 April 2020 the ICANN Board declined its consent to the change of control of the .org registry agreement, and…
IETF
The algorithm has a number. The resolver may still say no
RFC 9563 gives SM2 signatures and SM3 digests stable DNSSEC identifiers. That solves an addressing problem. It does not establish IETF consensus, cryptographic suitability, implementation support, an authenticated delegation or a successful DNS answer.
IETF
The Backup Nameserver Answered. The Cached Key Did Not Fit: RFC 8901
A second authoritative DNS provider can keep answering after the first one fails and still leave validating resolvers without an acceptable answer. RFC 8901 shows why DNSSEC redundancy is a synchronization contract across signers, not a count of nameservers.
History
Gihan Dias and the Two Names Sri Lanka Added to the Root
The smallest-looking part of a national network can expose its largest unfinished business. For Sri Lanka, two names in the DNS root showed that connecting a country and letting it recognise itself online were separate engineering tasks.
CASE FILE
When a BIND Fix Is Not Yet a Repair
A resolver vulnerability becomes an institutional accountability test when the patch is available but the evidence of recovery is not. ISC’s public record establishes how two BIND failures can turn hostile DNS input into an availability risk—and identifies a remediation…
IETF
James Gould and the Redaction Signal That Is Not Policy Proof
An empty place in an RDAP response can mean that no value exists, that a value was withheld, or that the question exposed a shape the server chose not to acknowledge. RFC 9537 gives one of those absences a machine-readable explanation. James Gould’s work on the specification…
CASE FILE
A Public Sponsor for a Private Namespace
An enterprise can need outside confirmation of an internal DNS arrangement without wanting to publish its internal directory. RFC 9704 offers a way to separate those disclosures. The difficult decisions concern what remains visible, how much authority one approval covers, and who…
IETF
Suzanne Woolf and the Server Label That Is Not a Machine Identity
A DNS reply can carry a label for the server that produced it. That sounds like identity until anycast, operator-defined bytes and hop-by-hop scope are allowed back into the picture. Suzanne Woolf’s work on the requirements behind NSID offers a more useful interpretation: the…
IETF
Sara Dickinson and the Resolver Promise Encryption Cannot Prove
The padlock beside a DNS resolver name is reassuring because it proves something useful: the client has protected its conversation on the way to a particular service. It is also dangerously easy to ask that icon to prove the rest. Sara Dickinson’s co-authored RFC 8932 follows the…
ICANN
Allison Mankin and the Name-Collision Sample That Could Not Prove Its Cause
A root server can record a query for a private-looking name with great precision. The record still cannot say which application produced it, who owns the broken dependency, how many users rely on it or what a future delegation would harm. Allison Mankin’s work on RFC 8023 helps…