Post by @jwildeboer@social.wildeboer.net

@jwildeboer There could be more of them... but they are all feeding themselves out of hidden primary root controlled by Verisign, a US corporation. So at the end, those public ones don't really count. Except if you consider they might, collectively, all decide to use another root than IANA one which is never impossible but quite not the highest probability. (and see previous court cases about .LY yes there were attempts to remove TLDs from root). They also all have relationships with ICANN. 1/x

@pmevzek It's the other way around. ICANN is the master. And ICANN has so far been quite OK-ish at defending the freedom of The Net. My personal preference would be to have no centralisation at all. But knowing that is impossible in the way DNS works, the next best solution would be to put ICANN under the UN, not the US. One letter, big consequences :)

@jwildeboer " the next best solution would be to put ICANN under the UN, not the US. " We would have to disagree on that. But there were such attempts in the past. Hence the WSIS, WGIG, IGF, etc. so that idea is 20+ years old and were the major force towards making ICANN less relient on US gov. (breakup from NTIA in 2016). ICANN just houses for now PTI (aka IANA) which technically coordinates. But companies like Verisign have their own specific contracts with US gov.

@jwildeboer "ICANN is the master.". Technically/theoretically just a technical coordinator implementing policies discussed and decided among all stakeholders (including governments with in theory again all the same power, but also other orgs) :-) Yes, no need to point out the difference between theory and practice and who captures what and how much.

@pmevzek It's a discussion I'd rather have over a long evening with food and drinks. 500 character messages are limiting. Could there be a more decentralised way for trust establishment? Yes. I think there is. It's what the ICAO (a UN agency) has established for travel documents. Which relies on a bilateral system of agreements, not a centralised one. See ICAO 9303 part 12 https://www.icao.int/publications/doc-series/doc-9303

@jwildeboer You are comparing something that is relevant only between governments (how they trust each other regarding travel documents) with something that has a public reach and needs a consensus, of not just governments but every single party online (who exactly controls .com or any other TLD?). You could mention as well how most BGP peering are set (over a beer 🙂 ?). But otherwise agree on the fact that the topic is far too broad for a thread here 🙂

@pmevzek I come from the times where you called someone in Dortmund at the university to add your .de domain in the right way, so yes, I am old and biased. I am also one of those that understand the complexity of reliability where centralisation is the obvious choice and decentralisation is an explosion of questions. Right now we can live reasonably well with centralisation on the DNS level but my risk assessment puts doubts on this. What next? That's the question. No real answers.

@jwildeboer @pmevzek

i think that summarizes well where we are. DNS decentralization is hard and we have more questions and concerns than concrete ways to fix it.

our best and easiest chance to fix this was in the 1980s :)

@paul_ipv6 @jwildeboer @pmevzek time travel always the best means to a comprehensive solution.

@jwildeboer @pmevzek Few organizations manage their own DNS servers. They contract with companies, mostly big American companies, as shown in this page: https://ithi.research.icann.org/graph-m9.html. (I helped set up that page.)

@paul_ipv6 @jwildeboer @pmevzek I think that security, and especially resilience to DoS attacks, is a big driver for concentration. The DNS server that you set in your basement can trivially be taken out by a DoS attack, so instead you contract with Cloudflare.

@huitema @paul_ipv6 @pmevzek I don’t really get the logic. When my four (2xIPv4, 2xIPv6) DNS servers I’ve configured as next step would fall over due to some attack, I switch to the next set? And for my local basement services I don’t need to reach out to the internet anyway.

@jwildeboer@social.wildeboer.net
Would be interested in your opinion about @aral@mastodon.ar.al 's take in using plain IP addresses instead of domains, via "web numbers"?

https://ar.al/2025/06/25/web-numbers/

@pmevzek@framapiaf.org

@fasnix @jwildeboer @aral @pmevzek

Much easier to share a customised hosts file, with both ipv4 and ipv6 addresses (and add an ipv6 address/name for your home server so others can use it).

@barbra @fasnix @jwildeboer @pmevzek Define “easier” :)

@barbra@vivaldi.net
"1. Create hosts file (it's just a plain text file)
2. Share it with people you know"

You assume that everybody knows how to create a hosts file.
I don't.
And your "average internet Joe" assumably doesn't as well.

And what about people I don't know, how should they find my (small-)webspace?
Anyone who I can't share that hosts file directly with?

@aral@mastodon.ar.al @jwildeboer@social.wildeboer.net @pmevzek@framapiaf.org

@barbra @fasnix @jwildeboer @pmevzek Right, so decentralised address books. That’s what I’m saying too.

@jwildeboer But this is indeed also why since 20+ years various countries (China and Russia mostly) claim to work towards independence from that, in one way or another, to have their own "local/national" root. It remains unclear how that is really technically working [I only ever saw https://www.ietf.org/archive/id/draft-diao-aip-dns-00.txt], but there are impacts as well for like which DNSSEC cryptography to use (GOST in Russia, SM2/3 in China, etc.) 2/2

@jwildeboer
Is there any research on creating a more federated, byzantine emperor tolerant dns root structure?

See also PKI root certificate lists and who authorises changes to them (Mozilla, Microsoft, Apple and various Linux distros, primarily Debian)...

@phlash Ah, the root certificates collection. Another point of centralisation. Though mostly focused on browsers, less on operating systems, where (for now) you can add your own root certificates, even on iOS and Android. It's a complex issue. And better solutions come from understanding how the current system works. That's the discussion I hope to fire up :)

@jwildeboer ISC might be US based technically, but it's not really within the exact jurisdiction the way it works.

@warthog9 And it's only one of 13 in the root collection.

@jwildeboer There are some internationally run & managed recursive DNS resolvers like 9.9.9.9 that I would have confidence in.

@dneary Do they still resolve autistici.org?

@jwildeboer @dneary No, recursive revolvers can't resolve anything that the root servers don't tell them about.

@kevin @jwildeboer This is true. Root resolvers are king - this is a user-friendly, privacy and security-conscious option instead of 1.1.1.1, 8.8.8.8, or 8.8.4.4. @jwildeboer What is autistici.org?

@dneary autistici.org was one of the main sites of A/I from Italy. The domain name was deleted from DNS without warning, raising questions about how far the US administration can and will go. See https://social.wildeboer.net/@jwildeboer/117200308433923512 for more context. @kevin

@jwildeboer While I appreciate that this isn’t your point, and while this is mentioned in the linked Wikipedia article, I just want to clarify that there are far more than 13 servers: “However, enabled by the use of anycast addressing, the actual number of root server instances—1954—is much larger, as of December 5, 2025.[3]”.

@ximon18 Yes. But the way to reach them goes through the 26 public IPv4 and IPv6 addresses. Anycast and load balancing don't counter the fact that we only have 13 root servers.

@jwildeboer What We Talk About When We Talk About Autistici

@jwildeboer Nothing with involvement by the current federal government of the United States of America is an ideal setup. The highest levels of our executive, legislative and judicial branches are occupied by people who are *at best* greedy folks bilking the taxpayers. Look to some states and cities if you seek sanity.

@jwildeboer honest question: how much of a difference does it make, in practice, that not all of those servers are under US jurisdiction, when ICANN itself is an organization headquartered in the US, which means it ultimately must abide by the laws of that country, and can be compelled to act by its courts?

@gasrios See my other thread ;) https://social.wildeboer.net/@jwildeboer/117202503510538546