Vixie Proposes 'Cooling-Off Period' For New Domains To Deter Cybercrime

There's no legitimate reason for a new Internet domain name to be registered and go live in less than a minute, Internet pioneer Paul Vixie. "My challenge:  Come up with a non-criminal reason you might need that" speed of setting up a new domain name, he says.

Vixie, who talked domain name abuse in a presentation at last month's RSA Conference in San Francisco, says the new generation of inexpensive and quick-to-deploy new domain names are good news for bad guys and bad news for good guys. In an interview with Dark Reading, Vixie detailed his own proposal of a "cooling-off period" for DNS providers to activate new domains, a strategy he says would help minimize domain abuse.  

Domain names go as cheap as $10 apiece now, he notes, and are created in less than 30 seconds. "I cannot find a non-malicious [reason] why would want a large number of cheap domain names [activated] in less than 30 seconds," he says. "We've seen how it benefits criminals" in their online activity, he says.

Placing new domain names in a temporary "penalty box" for a few minutes or hours could deter malicious activity, says Vixie, who is CEO of DNS threat intelligence firm Farsight Security. "If they still exist then and are not taken down … and are not in a reputation system [blacklist], that means there's probably nothing wrong with them."

Vixie says ICANN (Internet Corporation for Assigned Names and Numbers) could impose this waiting period on accredited registrars and licensed registries, although it wouldn't be able to do so for national country-code top-level domains (CCTLDs) not licensed by ICANN.  Global top-level domains could use this, which then could be adopted by some national CCTLDs that wanted to also take this approach.

The reserved and temporarily held names would be public, as well as their WHOIS information, as soon as they were reserved--just not active. So any complaints about them could be filed with the registrar about known spammers signing up for those domains, for example, he says. "This would give registrars the option of refunding the money and cancelling the reservation on the name" if it's a known bad actor group behind it, he says.

The current system of reputation systems like Spamhaus and others building blacklists of malicious domains is good, but alone cannot keep up with the lightening-speed domain registration process today, he says. "A block list is not enough. You can also buy URL filtering as a service, and have your browser reject domains that are bad," he says.

Blacklists are basically racing the bad guys as they register new domains. In a cooling-off period approach, you could detect a domain name when it's first registered. "10 minutes works for me at my house," Vixie says of the domain-hold approach he uses on his home networks.

"It's a very simple technique, and it's hard for criminals to adapt to," he says. "Rapid takedown forces spammers to only use a domain name for a short period of time, which means they give up after 5 minutes. So I'm holding its head under water for 10 minutes."

Vixie's firm Farsight has a global network of sensors monitoring the DNS infrastructure. "I'm now able to estimate one-third and two-third of the names in use on the Net," and any newly used names, he says. The firm offers licenses for access to that data, he says.