The addition of more than 1,100 new generic top-level domains (gTLDs) over the last four years has not affected the security or stability of the root DNS system. That is the main conclusion of a study into the technical impact of the New gTLD Program, which was conducted for ICANN by a consortium consisting of TNO, SIDN and NLnet Labs and that was successfully concluded at the ICANN meeting in Copenhagen mid March.

"With so many new gTLDs coming into play, there were some concerns within the ICANN community about the security and stability of the root system," says Giovane Moura, Data Scientist at SIDN Labs, SIDN's research team. "You should keep in mind that extending the root zone with over a thousand new gTLDs, and in such a relatively short frame, had never been done before. If some of the new gTLDs had quickly grown to .com-like proportions, for example, that could have led to a significant increase of the traffic to the root DNS system."The outcome of the study is one of the inputs for the ICANN community to decide on adding even more gTLDs to the root zone. In this event, the authors recommend that new gTLDs should continue to be added in a gradual way, but with more frequent monitoring than during the previous round.
The New gTLD Program
Five years ago, the root zone comprised about 300 domain names. Most of these were country code TLDs, such as .nl for the Netherlands. The leading generic TLDs are .com, .net and .org, whose history goes back more than three decades to the first implementation of the Domain Name System (DNS). Containing about 130 million domain names, the .com domain is by far the largest TLD. In 2012, ICANN started the New gTLD Program, resulting in the addition of more than 1,100 new gTLDs to the root zone since September 2013. Notable examples are .xyz, .top and .club. To assess the technical impact of this extension, ICANN commissioned an empirical study, which was carried out by a consortium consisting of TNO, SIDN and NLnet Labs. The main questions were whether the security and stability of the root DNS system had been degraded, and whether a future further extension could have a negative impact in this regard.
"Kudos for the operators"
For the study – named 'Continuous Data-driven Analysis of Root Stability' (CDAR) – the team analysed large amounts of historical Internet measurement data. They found that, so far, all the new gTLDs combined make up only an insignificant fraction of the total number of queries to the root DNS system. Accordingly, the group found no evidence of a significant increase in traffic at the root system due to the new gTLD program. They also saw no increase in response times from the users' perspective that could be attributed to the New gTLD Program.Another outcome was that consistency of the data at the root DNS system is very high, meaning that zone file errors and DNSSEC validation errors were rare."Our findings can be attributed to good engineering practices employed over the years by the root DNS operators, such as various levels of redundancy and diversity”, Moura says. "Furthermore, the root DNS operators are constantly monitoring, analysing and improving their infrastructures. Attacks in the past have shown that the roots overall are very robust, so kudos for the operators."
Root DNS system
The root DNS system consists of 13 subsystems operated by 12 independent organisations that include Verisign, NASA and RIPE NCC. Using a technology called IP anycast, most of these subsystems in turn encompass multiple sites. This infrastructure currently comprises a total of 670 systems spread all over the world, most of them based on multiple servers. To illustrate the challenges that rapid growth in DNS traffic could create: root operators generally need about 18 months to significantly upgrade their infrastructures.
Internet of things
The analysis also showed a strong relationship between the number of second-level domains (SLDs) registered in a gTLD and the number of valid DNS queries for that gTLD. That suggests that the growth in registered SLDs is a good predictor for the contribution of new gTLDs to future growth in DNS traffic. So unless the number of new gTLDs grows in an unbounded way, or the number of domains within a gTLD grows to .com-like proportions – neither of which is likely to happen in the near future – the contribution of new gTLDs to the total volume of valid DNS queries will likely remain negligible.The CDAR team also used their findings to speculate about the future. One potential risk they identified is the removal of a gTLD from the root zone. Devices with obsolete software could continue to operate for years, querying for SLDs whose corresponding TLD no longer exists, which would generate an additional load on the root servers. This scenario will become more relevant with the advent of the internet of things (IoT), potentially comprising billions of connected devices.As part of this study, the team also produced a methodology, a set of parameters, and a set of tools, all of which may be useful for future studies.
Strong consortium

CDAR is the first study to look at the technical impact of the New gTLD Program. "At SIDN we have a huge interest in the stability and security of the root DNS system" Moura explains. "First, any issue with the roots will likely impact .nl as well, direct or indirectly. Second, since the roots and .nl are managed in a similar way, research-based findings can help us better understand and improve our own operations."Cristian Hesselman, head of SIDN Labs, adds: "What made this consortium very strong were the complementary skills and experience that the partners brought in. NLnet Labs has been developing DNS software for resolvers and authorities for many years, and some of the root servers use their NSD software. We at SIDN Labs are the research arm of the .nl TLD operator, so we are basically in the same business as the root operators. And TNO has previously been involved in a related study on DNS for ICANN. Bringing together industry, operator, research and developer experience allowed us to conduct this study in a multifaceted way. Although all partners contributed to all tasks, SIDN Labs' specific contribution involved our expertise in data analytics, research and operations.""Doing research and analytics on big data, in collaboration with universities, and publishing scientifically about this work is what sets us apart from other registries," Cristian says. "Only a few registries would have been capable of carrying out this type of study. As a matter of fact, we are currently working on data analysis project for ICANN, this time with Delft University of Technology."