The introduction of the new top level domains (TLDs) such as .music, .books, etc. will increase the number of people and organisations adding and removing entries into the root DNS servers (.) for their own TLD.
Given the TLDs "me." and "in.", this means they will have different protections in place to create and manage subdomains ( myna.me. , bitco.in. ). Sure the root servers have an established protocol to work with TLDs, but what's to say that the TLDs ability to interact with the root servers hasn't been spoofed or intercepted by an adversary.
The risk I'm concerned about is, what is to prevent a malicious actor from adding or removing NS hosts? If a hacker could add a rogue NS for a TLD, that would obviously give the attacker complete control over all subdomains, the DNSSec records, and many other aspects of security including SSL.
There are other security issues to be concerned about, such as is the registration process for the TLD's registration web portal, are the correct controls in place? Have audits been done?
- Are there any documented cases of DNS hacking at the TLD level?
- What mitigates this risk?
- Is there a standard, accreditation, or assurance that I can rely on before using a given second level TLD?
- Is any third party that watches the DNS roots of .COM / .NET / .ORG (etc) and monitors them for changes?
This risk is particularly concerning as more and more people rely on URL shorteners to make "cute" URLs. In essence they are allowing a 3rd party, whose government may not allow for privacy protections, lawsuits, or other support we would otherwise expect, if that DNS provider were to be hacked.
Example of different TLDs that have some name servers, how do we know these servers are correct?
> com. Server: a.root-servers.net Address: 18.104.22.168 Name: com Served by: - m.gtld-servers.net 22.214.171.124 com - l.gtld-servers.net 126.96.36.199 com - k.gtld-servers.net 188.8.131.52 com - j.gtld-servers.net 184.108.40.206 com - i.gtld-servers.net 220.127.116.11 com - h.gtld-servers.net 18.104.22.168 com - g.gtld-servers.net 22.214.171.124 com - f.gtld-servers.net 126.96.36.199 com - e.gtld-servers.net 188.8.131.52 com - d.gtld-servers.net 184.108.40.206 com > biz. Server: a.root-servers.net Address: 220.127.116.11 Name: biz Served by: - a.gtld.biz 18.104.22.168 2001:503:7bbb:ffff:ffff:ffff:ffff:ff7e biz - b.gtld.biz 22.214.171.124 biz - c.gtld.biz 126.96.36.199 biz - e.gtld.biz 188.8.131.52 biz - f.gtld.biz 184.108.40.206 2001:500:3682::12 biz - k.gtld.biz 220.127.116.11 2001:503:e239::3:2 biz > me. Server: a.root-servers.net Address: 18.104.22.168 Name: me Served by: - ns2.nic.me 22.214.171.124 me - ns.nic.me 126.96.36.199 me - b2.me.afilias-nst.org 188.8.131.52 2001:500:4f::1 me - a2.me.afilias-nst.info 184.108.40.206 2001:500:47::1 me - d0.cctld.afilias-nst.org 220.127.116.11 2001:500:28::1 me - c0.cctld.afilias-nst.info 18.104.22.168 2001:500:27::1 me - b0.cctld.afilias-nst.org 22.214.171.124 2001:500:26::1 me - a0.cctld.afilias-nst.info 126.96.36.199 2001:500:25::1 me >