Primary Domain
Infrastructure
Within the Primary Domain facet, Infrastructure intelligence groups reporting by primary domain so readers can follow a focused area of internet infrastructure, governance, connectivity markets, or digital capital. The page brings together related articles, public evidence, institutions, companies, people, regional exposure, operating dependencies, and market context that may otherwise sit across separate category pages. It explains the domain, the likely actor class, the market or governance context, and the source material readers should use when comparing signals. Operators, analysts, and governance readers can see how the same domain appears across events, profiles, market shifts, public-source evidence, regional dependencies, and longer-cycle infrastructure decisions over time.
Story
LACNIC's Four-Vendor BGP Claim Needs the Configuration Column
One malformed Prefix-SID attribute reportedly met three different actions as it crossed the Internet: discard, propagation and session reset. LACNIC's new routing-security article makes the divergence visible. To make it reproducible, the comparison now needs to name the release…
CASE FILE
The Error Returned as a New Question: DNS Report-Channel and the Authority of Feedback
An authoritative server can announce where it wants to hear about failures it cannot see. It cannot make a resolver diagnose, report or believe anything. DNS Error Reporting turns one local validation failure into a second DNS query, then leaves transport, caching and human…
Story
At ARIN, Resource-Level Tech Authority Stops Before the ROA
ARIN's records can give a Technical Point of Contact authority over one network resource while routing-security actions remain organized around the containing organization. A newly confirmed suggestion asks ARIN to bridge that gap. The hard part is not adding another permission…
CASE FILE
The Packet Hid Its Exact Length. The Pattern Still Spoke: EDNS Padding and the Limits of DNS Privacy
An encrypted DNS message can conceal its names and answers while leaving a surprisingly useful silhouette. EDNS Padding changes that silhouette by adding bytes. The difficult question is not whether the packet became larger, but whether client, server, transport and path made…
Story
One Source IP Accounted for 38.76% of APNIC's WHOIS Queries in an Hour
One Source IP Accounted for 38.76% of APNIC's WHOIS Queries in an Hour intelligence summary explains the development, the public evidence available to readers, the organisations involved, the regional context, market exposure, and the infrastructure consequences that may follow.…
CASE FILE
The Record Bound the Options. The Client Still Chose the Connection: DNS SVCB, HTTPS and Service Authority
A domain owner can authenticate a list of preferred endpoints, protocols and connection parameters before the first application exchange. That does not make the first preference a command, turn a routing target into the origin, or prove which path a real client can securely…
CASE FILE
The Counter Hit Its Ceiling. The Filename Opened a New Epoch: RPKI Manifests and Recovery Authority
A correctly signed RPKI manifest can become unusable because a relying party remembers an impossible predecessor. RFC 9981 gives the issuer a narrow way out: change the manifest filename, start a new comparison epoch and preserve every other freshness, location and integrity…
CASE FILE
The Feed Was Valid. The Answer Was Local: DNS Response Policy Zones and the Authority to Rewrite Resolution
An authenticated threat feed can tell a resolver what a publisher recommends. It cannot decide which users lose a name, whether the answer should disappear or be replaced, or who owns the damage when a correct transfer produces the wrong operational result.
Story
AFRINIC's Validator Counted One Fewer Duplicate. The Final Set Stayed at 30,847
Two consecutive validation records moved in an oddly disciplined way. AFRINIC's public Routinator first counted 39,059 valid input VRPs and 8,212 duplicates, then 39,058 inputs and 8,211 duplicates. The final set offered to routers remained 30,847. That unchanged number is not…
CASE FILE
The Digest Matched. The Zone Was Still Wrong: ZONEMD and the Limits of Cryptographic Integrity
A whole-zone checksum can expose truncation, corruption and substitution. It can also authenticate a mistake with perfect precision. The decision for infrastructure leaders is not whether to trust cryptography, but how narrowly to interpret what it has proved.
Story
RIPE Marked the Upgrade Complete. Retrieval Failed Twice Afterward
At 17:56 CEST on 22 August, RIPE NCC marked its Alfresco maintenance complete. On Monday afternoon, document creation still worked but some files could not be viewed or downloaded. On Wednesday, a second incident began; RIPE NCC later changed the document system’s configuration…
CASE FILE
The Signal Was Signed. The Delegation Was Not Yet Secure: CDS/CDNSKEY and the Authority to Publish DS
A child zone can publish a perfectly signed request for a new DNSSEC secure entry point and still lack the one chain that would validate it. CDS/CDNSKEY makes parent coordination machine-readable; it does not collapse operational control, registrant authority, parent admission…
CASE FILE
The Catalog Was Valid. The Deletion Was Not: DNS Catalog Zones and the Authority to Provision
An authenticated DNS transfer can deliver a perfectly formed catalog whose operational consequence is to remove every zone from a secondary fleet. The transport may be trustworthy and the syntax impeccable while the decision encoded inside it is still wrong. DNS Catalog Zones…
IETF
David Meyer and the Address That Had to Ask Where It Lived
LISP lets an endpoint keep one identifier while its network attachment is described separately. That does not make location disappear. It moves forwarding into a chain of registered, resolved, cached, selected and reachable EID-to-RLOC state—and turns each link in that chain into…
CASE FILE
The Answer Had Expired. The Failure Had Not: DNS Serve-Stale and the Authority Beyond TTL
A DNS answer can outlive its ordinary freshness without becoming current again. Serve-stale is the resolver's narrow authority to prefer a known old answer over a fresh failure, but only after the source has been consulted, the failure has been bounded and the age of the…
IETF
Alan DeKok and the RADIUS Variant That Moved Trust into TLS
RFC 9765 is unusual not because it promises a clean break, but because it records a protocol author revisiting a choice he helped make: Alan DeKok's RADIUS/1.1 removes old packet-security machinery only where two peers explicitly negotiate a protected transport profile. The…
History
Mark Andrews and the DNS Server That Outlived Its Replacement
A replacement can be announced years before it becomes a migration. Mark Andrews's stewardship of BIND 9 during the BIND 10 programme shows why running infrastructure keeps imposing duties—security fixes, releases, tests and operator support—even while an institution invests in…
IETF
Joe Abley and the Trust Anchor That Had to Declare Where Trust Began
DNSSEC can prove a chain only after a resolver has decided where the chain starts. Joe Abley's work on the root trust-anchor publication format makes that first decision unusually legible: a signed file can prove where data came from, but it cannot order an operator to believe…
APRICOT
Anurag Bhatia and the Routing Difference That Could Not Explain Itself
A missing route is an observation before it is a diagnosis. At APRICOT 2020, Anurag Bhatia compared selected BGP views and found tens of thousands of prefixes that were not equally visible. The valuable result was not a blacklist. It was a test of whether an operator can keep the…
IETF
Vint Cerf and the Nine Exceptions Hidden Inside “Everyone”
Vint Cerf’s 2002 declaration that the Internet is for everyone is often remembered as a promise. Its more useful architecture lies in the next words: “but it won’t be.” Repeated nine times, that qualification turns universality from applause into unfinished work.