Alternative Roots

Alternative Roots are either systems not based on the DNS protocol at all or systems based on the DNS protocol but whose contents deviate from the IANA promulgated authoritative root zone file. Alternative Root Servers, or Alternative Domain Servers, provide users with alternative TLDs not currently available via mainstream browsers. The control of the official Internet is in the hands of the Internet Corporation for Assigned Names and Numbers (ICANN). IANA, a department of ICANN, has full control over the root server, which is a file on a computer that is kept at Herndon, Virginia. This file works as the official list of domain names on the Internet.

The DNS is a hierarchical system designed to allow humans to use text strings to access content or services in place of IP addresses on a global information network. Operating systems have been distributed for decades with the listing of default DNS servers to use as the authoritative place to obtain an answer when searching for a TLD. There are 13 Root Server Operators in that file, and they comprise the Internet's DNS root. In addition to the Internet's DNS root working in agreement with ICANN, several organizations operate Alternative Root Servers (often referred to as "altroots"). Each alternative root has its own set of root nameservers and its own set of TLDs.

Alternative Root Projects

Alternative Root Servers have been in existence since 1995 when several groups of Internet users found out that they didn’t have choices other than .com, .org], and so on. Historically, altroots could be divided into two groups: those run for idealistic or ideological reasons and those run as profit-making enterprises. The latest wave of altroots can be differentiated based on the technology on which they rely: blockchain. A blockchain domain name system is a decentralized directory for registering, managing, and resolving domain names. It can operate as a browser extension or stand-alone software. The nodes are equal in power and authority; all owners must contribute or delegate their votes to specific nodes to make decisions or changes to the blockchain DNS.

• Aloaha

• AlterNIC (aka ANIC): a domain name registry created by Eugene Kashpureff and Diane Boling that relied on an alternative DNS root with the aim of challenging the monopoly of InterNIC that operated from 1995 to 1997.

• BORN (aka Business Oriented Root Network)

• Cesidian Root:

• .chn: for the IoT in China.

• CINICS (aka Common Interest Network Information Center Society)

• .bit domains are based on the virtual currency Namecoin and included in OpenNIC's DNS.

• eDNS: an organization that promoted alternative DNS root services established by Karl Denninger; it opened and closed in 1997 as it did not achieve commercial success.

• EmerDNS: the DNS service offered by Emercoin, a blockchain platform created in 2013 that offers Decentralized Software Development Kits. Rather than using smart contracts, Emercoin uses NVS logic, which is not Turing-complete and cannot be used to write malicious code.

• Ethereum Naming Service (ENS): a second-level domain using the Ethereum protocol for building decentralized applications, providing a different set of tradeoffs for a large class of decentralized applications, that focuses on situations involving rapid development time, requiring security for small and rarely used applications, and offering wide-ranging, agile interaction. It has an abstract foundational layer: a blockchain with a built-in Turing-complete programming language so that anyone can write smart contracts and decentralized applications with their own arbitrary rules for ownership, transaction formats, and state transition functions. The foundation created .eth, then added functionality to work with existing main-root TLDs rather than requiring new extensions. The IETF has not added .eth to the special use domain name list. As of 28 March 2022, over 800,00013 domains have been created on ENS. The browser Opera can access ENS domains.

Potential Shortcoming: gas fees (user payments made to compensate for the computing energy required to process and validate transactions on the Ethereum blockchain) are required to claim a name or even change your nameserver.

• FriGate: Blockchain DNS services provided through a proxy, accelerates access to blocked websites, encrypts traffic, opens Tor sites, and supports EmerDNS.

• Handshake: A DNS-backwards compatible naming protocol. It adds a distributed, decentralized blockchain-based system to the root zone file where TLD ownership information is stored. No one controls it and anyone can use it, allowing for a root zone that is uncensorable, permissionless, and free of gatekeepers. Every peer in the Handshake network cryptographically validates and manages the root zone, eliminating the need for the Certificate Authority system. The Beacon browser can natively access the Handshake domains.

Potential shortcomings: Andrew Allemann points out that: Handshake is decentralized at the top level, allowing many companies and people to create top-level domains. However, it is centralized at the second level. Namecheap sells Handshake domains like .creator, .oo, and individuals pay annual fees for them. These blockchain-based domains have renewal fees and few people can access them. Moreover, with so many top-level domains, few to none may gain general recognition, a problem some people cited in the 2012 New gTLD Program.

• iDNS: Beginning as a research project at the University of Singapore, this DNS ran under the auspices of the Asia-Pacific Networking Group in 1998 and was incorporated in 1999. i-DNS successfully test-bedded IDNs over a 6-month period, in collaboration with CNNIC, and the NICs of Japan, Korea, Hong Kong, Taiwan, Malaysia, Thailand, and Singapore.

• Iperdome:

• Namecoin: created in 2010, this second-level domain system was the first decentralized name registration database to use the first-to-file paradigm (where the first registerer succeeds and the second fails); this implementation requires bootstrapping an independent blockchain and building and testing all the necessary state transition and networking code.

• name.space

• NBA

• Nebulis: Founders Philip Saunders and Mohamed Alborno call it "a new phonebook for the new web." It uses the Ethereum blockchain network and Interplanetary Filesystem to create a decentralized DNS and web servers, respectively.

• The NEM DNS is built on the NEM blockchain platform and is open source.

• New.Net/VendareMedia/Connexus: a commercial alternative root that sought to compete with .com, .net, and other TLDs. that attempted to work directly with internet service providers to activate their domain names automatically at the network level. The founders developed proprietary technology to allow their domain-naming system to exist alongside ICANN.

• Nokia Blockchain DNS: In early December 2021, Nokia Technologies acquire U.S. Patent No. 11,196,573 for a secure decentralized domain name system for the IoT and private resident usage of the blockchain for security.

• OpenNIC: a user-owned and -controlled top-level Network Information Center offering a non-national alternative to traditional Top-Level Domain (TLD) registries.
• Open Root Server Confederation (ORSC)

• Open Root Server Network (ORSN): A network of root servers in Europe (other than the one run by Paul Vixie in the U.S.) that operated from February 2002 to December 2008. ORSN had 2 operating modes: ICANN-based and the default, independent. The former involved daily synchronization but did not remove TLDs that ICANN; the latter was not automatically synchronized.

Letter	Operator	Location
A	Celox GmbH	Frankfurt, Germany
B	Funkfeuer	Vienna, Austria
C	KEVAG Telekom GmbH	Koblenz, Germany
D	Cyberlink Internet Services AG	Zurich, Switzerland
E	TRIERA Broadband	Maribor, Slovenia
F	Zen Systems ApS	Lyngby, Denmark
G	NFSi - Soluções Internet, Lda	Leiria, Portugal
H	Init Seven AG	Zurich, Switzerland
I	ALET.IT	Pisa, Italy
J	ASDA	Athens, Greece
K	Titan Networks Netherlands BV	Amsterdam, Netherlands
L	Paul Vixie	San Jose, California, United States
M	Home of the Brave GmbH	Frankfurt, Germany

• PeerName supports the .BIT, .EMC, .COIN, .LIB, and .BAZAR blockchain TLDs.

• Public-Root/INIAC: this project began operating in Dec 2003 and was supported by the Internet Names Authorization & Information Center beginning in 2005.

• Russian National Domain Name System: a project started in 2019 by Roskomnadzor, (Federal Service for Supervision of Communications, Information Technology and Mass Media), that may gradually become mandatory for all ISPs in Russia. Its servers are located on the Moscow Internet Exchange. The mission is to provide an alternative root for all users within Russia and continue functioning in case of its disconnection from the rest of the Internet.

• Stacks/OneName: a decentralized website on a Bitcoin blockchain founded by Jude Nelson, with no third party managing ID systems, databases, or web servers that combines DNS with a Public Key Infrastructure.

• UCDA

• UNIDT

• UnifiedRoot: River Book Investment Company bought this alternative root based in Amsterdam, The Netherlands, in 2005. It operates an independent infrastructure to enable the creation and usage of TLDs and IDNs registered on its system. The Unifiedroot root server platform is IPv6 and IDN ready and operates parallel to ICANN. Individuals cannot apply for a TLD or IDN with Unifiedroot. Only companies, organizations, and institutions can register a TLD or IDN.

• Unstoppable: This venture-backed company takes the traditional alt-root approach, offering extensions such as .crypto, .wallet and .nft. It is based on Polygon, an Ethereum scaling platform design, and as of March 2022, it has over 2,100,000 domains registered. Unstoppable Domains has developed its own browser based on Chromium.

Potential shortcoming: when ICANN launches its next round of nTLDs, multiple companies will apply for the aforementioned likely to be popular extensions, leading to Name Collision.

• .web IODesign: In 2012, IODesign claimed it had over 20,000 domains in its alternative root.

• Yeti-DNS: Supported by Japan’s WIDE Project, Paul Vixie’s engineering and security project TISF, and the Beijing Internet Institute, this project explores IPv6-only operation, DNSSEC key rollover, renumbering and scaling issues, and multiple zone file signers. Phase 2 of the project is decentralized (there no central node, so each node needs to reach a consensus when performing operations; the primary node is the executor but has no special authority); it is scalable; it uses threshold signature technology to reduce the number of DNSKEY; and it uses DM Management Committee (DMMC) for transactions.

Reasons Alternative Root Projects Have Developed

For IDNs

• In the first decade of the 2000s, individuals, organizations, and nation-states grew inpatient at ICANN's slow advancement of supporting international languages and scripts in gTLDs and ccTLDs, leading SSAC to release "SAC009: Alternative TLD Name Systems and Roots: Conflict, Control and Consequences," to encourage ICANN to move more quickly and to warn parties interested in operating alternative root name services or managing alternative TLDs that such activities would not be likely to succeed financially or logistically.

To Limit the Flow of Information

• Russia and China are working on alternative root projects to have more control over their citizens' use of and exposure to the internet.

Against Inefficiency and Abuses of Power

• In September 2001, Milton Mueller concluded that "competition among DNS roots should be permitted and is a healthy outlet for inefficiency or abuses of power by the dominant root administrator."
• There was a bottleneck in the domain name industry due to ICANN's glacial pace of delegating new TLDs especially in its early years.
• Alternative DNS roots can allow for more democratic control of the Internet.

Against Governmental/Intergovernmental Control of the Internet

• ORSN was founded out of concern over the U.S. government's control of ICANN.
• ORSC's founders wanted the evolution of the Internet's Domain Name System to be organic, from the bottom up, and free of intergovernmental agencies.

Experimentation

• In 2005, Paul Vixie, a member of the DNS's ISC F-Root team and involved in maintaining BIND, a popular open-source implementation of DNS, suggested to RSSAC that ICANN create an alternate root zone so that the technical community could add features like internationalized domain names, IPv6, and DNSSEC without disrupting older DNS behavior.
• Advances in authentication: Blockchain relies on a new security model of validation, reducing individual credential management.

Data Privacy

• Individual chooses relationships and connections via blockchain domain names, offering privacy and data protection, as all data and personal information are stored by the individual making the connections.
• Blockchain registrations contain unique encrypted hashes instead of individual names and addresses.

Peer-to-Peer Transactions

Individuals can make transactions with each other directly; they do not need intermediary companies.

Security

• In Blockchain-based DNS alternates, information is encrypted and stored in immutable and timestamped blocks (easier to audit, harder to tamper with and delete)
• Blockchain doesn't require certificates

Theories on Why Alternative Root Projects Fail

• Paul Vixie explains that “any set of DNS root name servers that serves any DNS root zone that did not come from IANA is an ‘alternate root’...[M]any attempts to fork the IANA name space and offer non-standard top level domains...has failed. Often that failure followed public ridicule by me. I think alternate roots of the ‘name space fork’ variety are a terrible idea for the global Internet, although I recognize the need for this kind of name space augmentation inside many enterprise networks...Vibrant competition among Internet name spaces is bad for all of us—bad for business, bad for freedom of expression, bad for national and personal security."
• DNS governance should be completely detached from governments and sovereignty concerns.
• The strong network effects associated with the IANA root zone create powerful disincentives to violate the global uniqueness of domain names.
• Countries’ economies and security are intimately tied to communications facilitated by the DNS root zone.

On-Going Issues

Fragmentation

Concerns have been raised over how alternative roots could lead to the technical, governmental, and commercial splintering of the Internet.

Name Collision

Conflicts can occur in user experience and functionality when there are identical TLDs that do not match in their delegation, which is why some form of centralized coordination is important in adding names to roots, such as we see with ICANN. The .biz TLD created by Pacific Root was in operation before ICANN proposed running .biz, and at least one of the alternative root servers resolves .biz to the PacificRoot's. There are .biz domain names that exist in different roots and point to different IP addresses. The possibility of such conflicts, and their potential for destabilizing the Internet, is the main source of controversy surrounding alt roots.

Governance

For better or worse, there is a lack of governance in decentralized systems such as that making use of Blockchain. However, the coordination required to encompass many voices and views and build consensus is glacial in contrast to the pace of pioneering and innovation in unregulated spaces.

Security

ICANN's DNS

• The DNS was not made with security in mind; thus, DNS Abuse has grown up along with the expansion of the Internet.
• Certificate providers can be hacked or coerced and can be a single point of failure in the trust chain of the web.

Blockchain models

• Easy to copy and paste
• could use QR codes but only works with smartphones

Functionality

Commentators note that alternative name systems today are clunky, hard to reach, and expensive; they put the onus on browsers, which do not want to govern. Adapting applications to use multiple alternative naming systems is complicated and particularly if the names overlap. Applications would have to know which alternative naming system to look up for each domain name or define an order for making the lookups. The approach for defining an order in the DNS has proved non-deterministic and problematic. Web gateways do not require any set up on the client's side, but they have to be maintained over time, must scale with demand, and are a single point of failure and a target for malicious actors. When a plurality of naming systems is deployed, the same number of bridges must be built, and users need to know to which alternative naming system the domain is registered to be able to use the right bridge to reach it.

Popularity

• Limited audience: few people can view sites or send emails and only to those also using domains in the alternative TLDs. This could be improved through the use of special helper applications, or if a custom configuration was made to their computer, or to their nameservers, or a custom configuration at an ISP upstream in the DNS hierarchy. None of these solutions were as comprehensive as being listed in the default nameservers that are seen when an operating system starts. Whilst technically trivial to set up, actually running a reliable root server network, in the long run, is a serious undertaking, requiring multiple servers to be kept running 24/7 in geographically diverse locations. During the dot-com boom, some alt-root providers believed that there were substantial profits to be made from providing alternative top-level domains. Only a small proportion of ISPs actually use any of the zones served by alt-root operators, generally sticking to the ICANN-specified root servers. This in turn led to the commercial failure of several alternative DNS root providers.

Blockchain Domains

• Blockchain websites are not yet popular, as they have unusual extensions (such as .eth), are based on complex smart contracts to form a human-readable web address, and require users to install special extensions and plugins to their browsers to access them.
• The Ethereum Name Service (ENS) offers users a simple, human-readable name for their cryptocurrency wallet(s), and operates in a manner similar to the DNS - converting plain language names (such as "example.eth") into an identifying hash string of characters that represents a user's wallet or identity. Uniregistry's decision to auction its portfolio of gTLDs and include an ENS non-fungible token (NFT) for each TLD, so that the winning bidder had the "rights" to sell second-level blockchain addresses to interested users, caused a controversy, as ICANN delayed acceptance of assignment requests throughout 2021 while it investigated whether the combination of NFT and TLD impacted the security and stability of the DNS.

History of Opposition

In May 2000, the IAB concluded "There is no getting away from the unique root of the public DNS" and called attempts at replacing it a "family of recurring technically naive proposals.

In July 2001, ICANN released its Internet Coordination Policy (ICP-3): A Unique, Authoritative Root for the DNS," declaring the necessity of a single, central authority to coordinate the assignment of unique parameter values and to maintain the public's trust in the Internet, which alternative roots could disrupt.

In January 2016, Bill Drake, Vinton Cerf, and Wolfgang Kleinwächter published a paper on Internet fragmentation that chastised the Yeti-DNS project for threatening to splinter the DNS.

In November 2021, ICANN published a blog post reiterating buyer beware when it comes to alternative root servers.