ICANN Accelerates DNS Protection Against Quantum Attacks and Updates Registry Rules

Internet governance organizations are likely to accelerate efforts to protect the Domain Name System (DNS) from quantum computers. John Crain, Chief Technical Officer of ICANN, stated that such machines theoretically threaten DNSSEC—DNS security extensions that adapt public key infrastructure for record verification. He is aware of forecasts predicting the emergence of such computers "at the turn of the decade" and has therefore revised the timeline.

"If you had asked me a few years ago, I would have said we probably need to be ready in ten years. Now, maybe it's less. I don't know, three years or five, but probably not ten," he said.

One way to protect DNSSEC is larger keys, but this runs into DNS message size limitations: larger zones, packets, and responses are needed, and traffic will have to be transmitted in multiple TCP packets instead of a single UDP message. According to Crain, ICANN, IETF, and other bodies have already begun preliminary work. "The transition from UDP to TCP will take several years. We are probably a few years away from deploying this in a predictable manner." The issue is becoming more acute, and work will accelerate.

Internet Registry Reform

At the ICANN conference, the reform of regional internet registries and the update of Internet Coordination Policy 2 (ICP-2) were discussed. Jia-Rong Low, Chair of the Number Resource Organization (NRO)—a coalition of AFRINIC, APNIC, ARIN, LACNIC, and RIPE NCC—mentioned that developing the document entirely remotely proved "very difficult." Following the conflict in AFRINIC, which called into question the possibility of the African registry's withdrawal, the NRO decided to cover the entire lifecycle of a registry in ICP-2. The updated document defines four stages: recognition, audit, emergency continuity operations, and derecognition. The last three are new and establish ICANN's role as an independent oversight body. The final document is expected to be prepared by the end of 2026.

Fraudsters and "Trusted" Domains

Shion Lloyd, ICANN's Chief Security Scientist, reported that "Category 1" domains—related to regulated sectors (.bank, .doctor, .university) or requiring special guarantees (.sucks)—are more often targeted for DNS abuses: the risk is 45% higher than for other domains. However, high volumes of abuse are less likely for them. ICANN is working on a policy (PDP1) that will require registrars to take additional measures against domain owners who facilitate abuses, and on PDP2, which regulates automatic domain registration.