New and Different: New IDN and DNSSEC-signed gTLDs

The Internet Corporation for Assigned Names and Numbers (ICANN) announced last week that the first set of approved generic top level (gTLDs) has now been activated on the Internet by virtue of their delegations in the root zone of the global DNS system. According to the announcement, the first four delegations are:
  • شبكة (xn--ngbc5azd) – Arabic for "web/network". The domain registry responsible for managing subdelegations from this new TLD is International Domain Registry Pty. Ltd.
  • онлайн (xn--80asehdb) – Cyrillic for "online". The domain registry for this new TLD is  CORE Association
  • сайт (xn--80aswg) – Cyrillic for "site". The registry for this TLD also is  CORE Association
  • 游戏(xn--unup4y) – Chinese for "game(s)" and the domain registry is Spring Fields, LLC.
Notice that all of these are internationalized domain names (IDNs), with each TLD listed first in its native character set, followed in parenthesis with its equivalent ASCII (IDN) representation. Once the corresponding domain registries for these TLDs complete a post-delegation process to protect any trademark holders, the registries may begin delegating their own subdomains beneath these TLDs. When complete, for the first time, web users will be able to enter domains names in fully Cyrillic, Arabic or Chinese characters (though many country code TLDs are already internationalized).

 As suggested in a prior post, organizations seeking to communicate or conduct business with web users of such "native" languages may desire to register and operate a subdomain in one or more of these new IDN gTLDs. Providing full native language support is expected to improve Internet usability and increase penetration.

 IDN gTLDs are certainly new and different, as is the requirement that all new gTLDs under this program be secured via DNSSEC. That is each gTLD zone will be signed, which facilitates the signing of subdomains beneath these TLDs. Based on registry policies, registered subdomains may or may not require DNSSEC signing, though we recommend it to retain namespace integrity!

 These successful delegations represent the first set of new gTLDs having been vetted through ICANN's "new gTLD" program, begun about twenty months ago, one of the major goals of which was to add support for "DNSSEC from the start" and  IDN gTLDs, With over 1400 gTLD candidates still working through the approval process, expect many more delegations coming soon!

Comments

Post a Comment

Popular posts from this blog

Handy AAAA filter in BIND 9.8

The ISC introduced a pair of new configuration file options in BIND 9.8 to enable administrators to easily filter who may receive AAAA record type responses even if valid responses exist. For example, clients on subnets that do not have IPv6 network access can be excluded from receiving affirmative answers for AAAA queries. This feature provides simpler administration than the alternative mechanism using views. The first option, filter-aaaa-on-v4,defines whether the server will return AAAA records to certain clients. Such clients are defined by the address match list parameter of the second option, filter-aaaa. Note that BIND must be compiled with the --enable-filter-aaaa option on the configure command line to enable AAAA filtering. The syntax of these options is as follows: filter-aaaa-on-v4 (yes | no | break-dnssec) ; filter-aaaa {addr_match_list;} ; The filter-aaaa option identifies the address match list for which the filter-aaaa-on-v4 option is to be applied as described ...
Read more

Inglorious DDI

We all know how critical DHCP/DNS/IPAM (DDI) services are. Your network cannot function without them. But like most foundational elements of anything, they are certainly not glamorous...like good luck finding a home designer who specializes in home foundations. I would not be shocked should HGTV pass on my brilliant concept for a foundation building show. I suppose most people would find a show detailing footing depths and concrete pouring techniques rather boring.  Nevertheless, there are countless shows for redesigning and remodeling homes. On most episodes the foundation is out of sight, out of mind. If it's stable, no one wants to pay it attention, they just expect it to keep doing its job, supporting the structure. Once in a while a foundational issue is brought up that unexpectedly threatens to raise the budget to heighten the drama. All work stops until the issue is addressed. And you'll notice that the owner never denies paying the extra amount to fix the issue. ...
Read more

BIND 9.8.0 Adds DNS64 Support - Part 2 - How is it configured?

BIND 9.8.0 introduced a new dns64 option statement that can be configured within the server named.conf options block or within a view options block. Recall from a prior post that DNS64 configures a recursive DNS server to issue A record queries on behalf of a client requesting AAAA records, then appends the returned IPv4 address to a defined IPv6 prefix. This manufactured IPv6 address enables the querying host to connect to a NAT64 gateway which will terminate the IPv6 connection from the client and map it to an outbound IPv4 connection to the appended IPv4 address, completing the connection! Whew! BIND offers a number of useful parameters within the dns64 statement to control this process. The statement syntax is: dns64 IPv6_prefix { [clients {address_match_list };] [mapped {address_match_list };] [exclude {address_match_list };] [suffix IPv6_addr;] [recursive-only (yes|no);] [break-dnssec (yes|no);] }; The IPv6_prefix parameter is the prefix to which returned...
Read more