On Multiple DNS Roots

One of the recurring debates on the Internet is whether multiple DNS roots are a good idea, and whether they could be a mechanism for getting rid of ICANN.

I am generally in agreement with the position taken in RFC 2826. Basically, it's important that the result of DNS queries be consistent from one location to another. A sufficient and almost necessary condition for this consistency is that any given zone in the DNS is delegated to a single party at any time, who defines the resource records associated with the names defined within that zone. This applies no less to the root zone than to any other DNS zone. Actually since all DNS names are delegated from the root, consistency of the root zone is more important than consistency of any other zone.

Both users and applications depend on DNS consistency to work well.

Some of the so-called "alternate roots" claim that they can achieve consistency without a central organization, and that several alternate roots have demonstrated the ability to do this. That argument conveniently ignores the conflicts between these organizations that have existed in the past. It also ignores the existence of other self-appointed roots who do not cooperate with the other set.Also, even if there has been a minimum of conflict between some set of alternate roots, it is not at all clear that this level of harmony would continue to exist if alternate roots were widely used, and businesses relied on the stability of names with new TLDs, etc.

I also do not believe that an arbitrary number of TLDs is a good idea. This leads to a flat namespace (and with it central control, and single point-of-failure); it also has implications for the effectiveness of DNS caches. So I believe that some discipline will always be needed to restrict creation of arbitrary numbers of TLDs.

I am well aware of the difficulties with ICANN, and I have many problems with the way ICANN has been run since its inception. However I do not see a way to keep the root consistent without some sort of ICANN-like organization. Any new organization replacing ICANN would have to deal with a similar set of problems, and would have to cope with widely divergent views about how the DNS root should be run.

So, some discipline will always be necessary to maintain an effective root, and that implies that somebody (whether ICANN or some organization) will need to define the rules for its operation. It should eventually be possible to make the rules more visible, and to distribute their implementation more widely, and to automate the implementation in code. But I don't see how it would be wise to carve those rules in stone. So for the foreseeable future you can't get rid of the rules and the human organization needed to define and refine those rules. In addition, some means will always be needed to pay for operation of the root servers, and the most obvious means is to collect money from domain registries.

Furthermore, there will always be the potential for those rules to be controversial, because those rules will inevitably have an effect on various parties' ability to achieve wealth and power.

It certainly appears to be the case that the DNS root could be run more efficiently, and more fairly. I am hopeful that the technical measures will be implemented to allow more efficient operation, and that ICANN will be reformed to act more fairly. I have more faith in the technical and operations communities than in the political forces that play games with (and within) ICANN. I wish I could be confident that meaningful reform will happen with ICANN. Still, I have even less confidence that the DNS root would be run well in the absence of, or with a replacement for, ICANN.

Change history