Site Finder

Site Finderwas awildcard DNS recordfor alland.netunregistered domain names, run by and.nettop-level domainoperatorVeriSignbetween 15 September 2003 and 4 October 2003.

Site Finder

All Internet users who accessed any unregistered domains in the and.net domain space were redirected to a VeriSignweb portalwith information about VeriSign products and links to "partner" sites. This gave VeriSign the advantage of receiving greater revenue from advertising and from users wishing to register these domain names. It had the effect of capturing theweb trafficfor several million mistyped or experimental web accesses per day, and meant that VeriSign effectively owned all possible and.net domains that had not been bought by others, and could use them as an advertising platform.

VeriSign described the change as an attempt to improve the Web browsing experience for the naive user, without mentioning any use of the domain name system other than by browsers. VeriSign's critics saw this claim as disingenuous. The change led to a dramatic increase in the amount of Internet traffic arriving at verisign. According to the web traffic measurement companyAlexa,in the year prior to the change verisign was around the 2,500th most popular website. In the weeks following the change, the site came into the top 20 most popular sites, and reached the top 10 in the aftermath of the change and surrounding controversy.

Issues and controversy

There was a storm of controversy among network operators and competing domain registrars, particularly on the influentialNANOGandICANNmailing lists, some of whom asserted:

• that the redirection was contrary to the proper operation of theDNS,ICANN policy, and the Internet architecture in general;
• that VeriSign breached its trust with the Internet community by using technical architecture for marketing purposes;
• that the redirection broke variousRFCsand disrupted existing Internet services, such asemailrelay and filtering (spamfilters were not able to detect the validity of domain names);
• that the redirection amounted totyposquattingwhere the unregistered domain being resolved is a spelling mistake for a famous registered domain;
• that VeriSign abused its technical control over the and.net domains by exerting ade factomonopoly control;
• that VeriSign may have been in breach of its contracts for running the and.net domains;
• that the Site Finder service assumed that all DNS traffic was caused by Web clients, ignoring the fact that DNS is used by other applications such as networkedprinters,FTPsoftware, and dedicated communications applications. If users of these applications accidentally entered a wrong host name, instead of a meaningful "host not found" error they would get a "request timed out" error, making it look like the server existed but is not responding. No statement by VeriSign in support of Site Finder even acknowledged the existence of DNS traffic not caused by Web clients,although they published implementation details which mentioned this traffic.
• that Site Finder contained anend-user license agreementwhich stated that the user accepts the terms by using the service—but since mistyping an address automatically caused the service to be used, users could not refuse to accept the terms.

Others were concerned that the Site Finder service was written entirely inEnglishand therefore was not accessible by non-English speakers.

TheInternet Architecture Boardcomposed a document detailing many of the technical arguments against registry-level wildcards;this was used by ICANN as part of its supporting arguments for its action.

Fallout

A number of workarounds were developed to locally disable the effects of Site Finder on a per-network basis. Most notably, theInternet Systems Consortiumannounced that it had produced a version of theBINDDNS software that could be configured byInternet service providersto filter out wildcard DNS from certain domains; this software was deployed by a number of ISPs.

On October 4, 2003, as a result of a strong letterfromICANN,VeriSign disabled Site Finder. However, VeriSign has made public statements that suggest that they may be considering whether they will change this decision in the future. On February 27, 2004, VeriSign filed a lawsuit against ICANN, claiming that ICANN had overstepped its authority. The claim regarded not only Site Finder, but also VeriSign's much-criticisedWait Listing Service.The claim was dismissed in August 2004; parts of the lawsuit continued, and culminated in a March 1, 2006 settlement between VeriSign and ICANN which included "a new registry agreement relating to the operation of the.COM registry."

On July 9, 2004, the ICANNSecurity and Stability Advisory Committee(SSAC) handed down its findings after an investigation on Site Finder. It found that the service should not be deployed before ICANN and/or appropriate engineering communities were offered the opportunity to review a proposed implementation, and thatdomain name registriesthat provide a service to third parties should phase out wildcard records if they are used.

External links

• VeriSign's Site Finder Implementationdocument (PDF)at theWayback Machine(archived November 9, 2004)
• VeriSign's announcement to NANOG of their wildcard DNS changes
• ICANN Advisory Concerning Demand to Remove VeriSign's Wildcardof 3 October 2003
• Slashdot discussion regarding Site Finder
• Internet Software Consortium announcement of "delegation-only" feature that can be used to ignore gTLD wildcards
• VeriSign to revive redirect serviceCNET article written 15 October 2003atarchive.today(archived January 19, 2013)
• Washington Post (27.02.2004): Suit Challenges Powers of Key Internet Authority
• Findings of ICANN SSAC on Site Finder service(PDF)