Registry lock needs standardisation
CENTR whitepaper on a more standardised and streamlined approach to registry locks for domain names
In the latter part of 2018, there were several incidents [1, 2] involving major infrastructural domain names. The problems could have been prevented by using DNSSEC and 'registry locks'. Registry locks have been around for a long time, but not many people are familiar with them or recognise their potential value. By no means all registries offer lock services, and those that do all have their own distinct approaches. There is consequently growing market demand for standardisation. In response, CENTR is now looking at the issue, with SIDN actively involved. We are also reviewing our own registry lock service, .nl Control.
On CENTR's agenda
Following the incidents in 2018, the subject of registry locks was moved up the agenda, both for registries individually and for the European registries' association, CENTR. At the annual CENTR Jamboree in 2019, members discussed why more registrants aren't using locks to protect their domain names.
What is a registry lock?
A registry lock prevents significant changes being made to a registration without the registrant's knowledge. Whenever an update request is received, the registry (SIDN where .nl is concerned) checks with the registrant to make sure the request is legitimate.
Great diversity
One possible reason for the low take-up rate highlighted by the discussion was lack of awareness. Registrants often don't realise what their domain names are worth and or know about the existence of registry locks. Underlying the awareness problem is the great diversity in registry lock implementations: every registry takes its own unique approach. As well as complicating the technical integration challenge for registrars and resellers, diversity makes it hard to demonstrate the value of registry locks.
Survey of CENTR members
Several CENTR members including SIDN got together to form a working group to look into options for registry lock standardisation. The working group organised a survey of CENTR members, which revealed that fourteen of the twenty-seven participating ccTLD registries offered a registry lock service, while a further eight planned to introduce one. Existing and planned registry lock services were analysed and divided into two model groups, each of which had two variant subgroups. The models were intended to help registries align their registry lock services and thus reduce diversity. The technical implementations of the models can be standardised, in order to facilitate integration with registrars and resellers. Furthermore, it is hoped that classification will encourage migration to a more standardised approach, where registry-registrar interaction is more predictable.
Whitepaper
The CENTR working group described the models in a whitepaper available from the CENTR website. We hope that the document will help registries with the design of their activities, while also getting registrars and other stakeholders to think about the creation of standardised registry lock services. Above all, we're hoping that the initiative leads to more domain names being protected by registry locks in whatever form. Ultimately, that should help to make the internet safer and more trustworthy for everyone.
.nl Control is complex and time-consuming
SIDN has been offering a registry lock service for more than ten years. We call our service '.nl Control'. In parallel with the CENTR working group survey, we've been liaising with our registrars about possible ways of promoting use of .nl Control so as to increase the security of the .nl domain. From the feedback, it's apparent that the issues identified by CENTR exist within our domain as well: awareness amongst registrants is low and technical integration is challenging. What's more, the many manual steps and checks make .nl Control processes complex and time-consuming. As a result, .nl Control is used mainly by big brand owners, who see the service as part of their brand protection strategy. However, with many smaller businesses and self-employed people establishing an internet presence, we feel that this is a good time to link up with registrars and organise a joint awareness campaign aimed at the SME sector.
Transferring responsibility
In CENTR's classification system, .nl Control comes under Model 1B: registry-focused (registrar sale), out-of-band authentication. Implying that the service is sold through registrars and involves manual validation of transactions by SIDN. We felt that the main potential for improving the process lay in utilising automation opportunities and reviewing responsibility for authentication. With the current .nl Control model, authentication is performed by SIDN (the registry). However, responsibility could in principle be transferred to the selling agent (the registrar). In other words, the task of authenticating the registrant before the lock is applied and whenever a change is made could be given to the registrar. Greater assurance could then be built into the system by, for example, requiring the registrar to use two-factor authentication when logging into the Domain Registration System. That would provide a better guarantee that the party amending a registration is indeed the registrar.
eIDs may be the solution
However, .nl Control's model would then become 'registrar-focused'. Moreover, we would lose one of the scheme's unique selling points: that SIDN, the .nl domain's independent operator, authenticates the registrant when a lock is set up and whenever the registration is amended. We would prefer to retain that principle. An alternative approach would be to use technology to make the existing process more secure and efficient. Recent developments in the field of eIDs mean that it's now feasible to easily and reliably verify a registrant's identity on line. The need to provide a trade register extract and identity documents would be removed if the registrant were required to log in to an SIDN environment using an eID such as eHerkenning or IRMA when applying for .nl Control. By using a similar system for approving amendments, integration with existing (EPP) processes would even be possible. In the period ahead, we'll be working with .nl registrars and CENTR to progress our ideas with the aim of promoting adoption of .nl Control and making the .nl domain even more secure.
