VeriSign

VeriSign Inc is, among other things, the operator of the .com and .net top-level domains, and a certificate authority for X.500 certificates.

Table of contents

1 Verisign wildcard DNS controversy 2 Workarounds for Sitefinder 3 SiteFinder withdrawn 4 External links

Verisign wildcard DNS controversy

On September 15 2003 VeriSign Inc introduced a wildcard DNS record for all .com and .net domain names not yet registered by others. Internet users who try to access these domains are redirected to a VeriSign web portal with information about VeriSign products and purchased links to "partner" sites. This has the advantage to VeriSign of receiving greater revenue from users wishing to register these domain names, however this action has not been lauded within the community.

Such behavior has the effect of "capturing" the web traffic for several million mis-typed or experimental web accesses per day, and means that Verisign effectively now "owns" all possible .com and .net domains that have not been bought by others as an advertising platform, over a googol new domain names suddenly "belonged" to VeriSign.

Verisign has described this change as an attempt to improve the Web browsing experience for the naive user. Verisign's critics see this as disingenuous. Certainly the change has led to a dramatic increase in the amount of internet traffic arriving at verisign.com. According to the web traffic measurement company Alexa, in the year prior to the change verisign.com was around the 2,500th most popular website. In the weeks following the change, the site has been around the 20th most popular site, and reached the top 10 in the immediate aftermath of the change and surrounding controvesy. (Source: Alexa.com)

There has been a storm of controversy among network operators and competing domain registrars, particularly on the influential NANOG and ICANN mailing lists, some of whom have asserted:

• that this is contrary to the proper operation of the DNS, ICANN policy and the Internet architecture in general
• that Verisign has breached its trust with the Internet community by using technical architecture for marketing purposes
• that doing this breaks various RFCs and disrupts existing Internet services, such as E-mail relay and filtering. One example of this is spam checking; a computer program may check to see whether mail originates from a valid domain - such wildcard resolving makes all domains appear to be valid.
• that this behavior amounts to typosquatting where the unregistered domain being resolved is a spelling mistake for a famous registered domain
• that Verisign is abusing its technical control over the .com and .net domains by doing this to exert de facto monopoly control
• that Verisign may be in breach of its contracts for running the .com and .net domains

Other people and organizations have asserted:

• That the new sitefinder service is written entirely in English and therefore is not accessible by people who read other languages. Its grammatical style is specific to the United States of America.

Workarounds for Sitefinder

A number of workarounds were developed to locally disable the effects of SiteFinder on a per-network basis.

Most notably, the Internet Software Consortium announced that it had produced a version of the BIND DNS software that could be configured by Internet service providers to filter out wildcard DNS from certain domains; this software was deployed by a number of ISPs.

SiteFinder withdrawn

At the beginning of October, 2003, as a result of a strong letter from ICANN, VeriSign disabled SiteFinder. However, VeriSign has made public statements that suggest that they may be considering whether they will change this decision in the future.

---

To be written:

• Verisign history
• acquistion of Thawte

See also:

• gTLD

External links

• VeriSign web site
• Verisign's announcement to NANOG of their wildcard DNS changes
• Slashdot discussion regarding SiteFinder
• Internet Software Consortium announcement of "delegation-only" feature that can be used to ignore gTLD wildcards
• VeriSign to revive redirect service CNET article written October 15, 2003