ICANN – Terence Eden’s Blog

The purpose of DNS is to spread scams

Terence Eden — Sun, 06 Sep 2026 11:34:20 +0000

I imagine everyone here has received an unsolicited message telling them that their tax is overdue and that they urgently need to visit Genuine-Tax-Payment-Website.fart or that a parcel is delayed at customs and you can pay a small sum for its release at Almost-The-Right-Acronym.ak

You know it is a scam. Most people just mark as spam and move on with their day. But a significant number of people don't. They hastily visit the site, tap in their credit card details, give it their mother's maiden name, confirm address, upload a nude selfie, and only then realise that they've been had.

The Internet works at pretty close to the speed of light. You can register a .uk domain and a minute later it's accessible from the other side of the planet. Brilliant for users who want to quickly launch a website. Also brilliant for abusers who want to launch a spam campaign.

By the time enough people have reported the scammers' domain as suspicious, it is too late. In the time it takes for a registrar to disable the domain, or for its name to make its way to the Safe Browsing List, a million messages have already been sent and enough people have handed over their details.

We're told that "the purpose of a system is what it does". At the moment, the Domain Name System's purpose seems to be a vector for criminals to run scams on people at a terrifyingly high rate.

How big is this problem?

BIG!

There's a great blog post by Andrew Campling which reports on this startling claim:

The study found that at least 10% of all new gTLD domain names registered during the year had subsequently appeared on security blocklists by the time of analysis. It estimated that, taking account of subsequent blocklisting and associated domains not themselves blocklisted, the share of names registered by malicious actors may be closer to 20%.

DNS Abuse and Criminal Infrastructure: Beyond Definitions and Blocklists (emphasis added)

That links to a presentation by Interisle which contains some rather shocking statistics (albeit with disputed methodology). It looks at generic Top Level Domains (gTLD) - those are things like .com and .fun rather than country code TLDs (ccTLD) like .uk and .de.

It says 85 million new registrations of gTLDs were made in 2025. Of those 8.5 million were added to blocklists by May 2025. It reckons that a 10% abuse rate is the likely floor for these numbers and it's probably closer to 20%. One in five newly registered domains with a gTLD are scams. That's a bloody crisis.

13 TLDs had more than 50% of their registrations blocklisted.

I can understand why .bid and .loan are popular with scammers. But why .mobi?! What did I ever do to you, eh?

Who are the scammers registering these through?

Ah, our old friends at NameCheap. See Why do scammers love NameCheap?

If those five registrars had more effective policies, it might significantly dent the scammers' ability to ply their devious wares. Or they might just move on to other registrars.

As the report points out:

suspension rates for blocklisted domains were 7.4% to 16.3%.

The full report is on the Interisle website.

What can be done?

I don't know.

In the first instance, it might make sense for registrars to do strong Know Your Customer (KYC) checks on anyone buying a domain. But that stops anyone who wants to anonymously register I-Hate-Nintendo.whatever without risking the wrath of Intellectual Property lawyers.

Also, criminals have access to stolen money and stolen cards. They can convince a hapless mule to register a domain on the criminals' behalf.

Registrars could ask for an escrow payment. Pay €9 for the domain name put €900 in escrow. If your domain appears on a blocklist within the year, you forfeit the money. Criminals with stolen funds are unlikely to care but it would probably put off lots of people from getting a new domain.

There are various banned words and phrases depending on the TLD. For example, South Sudan has a list of political words which they don't want associated with their .ss ccTLD.

But if one gTLD bans a word, a different one might not. A scammer doesn't care if the gTLD is .arse or .elbow - they just want the start of the domain to look legitimate.

Some registrars have strings that they don't allow. In fairness to NameCheap, when I tried to register dwp-payments-gov-uk.pizza it told me that domain was banned. It wouldn't let me get any gTLD with that name.

But all it takes is one registrar to be slightly lax and the scammers get through. Increasing the complexity of the rules is also a hell of a burden on smaller registrars.

Besides, it's pretty easy to get a generic enough looking domain and stick the confusing bit on a subdomain. Here are a clutch mentioned in the report:

https://gov.uk-dwpaph.bond/uk/
https://gov.uk-dwpcjh.bond/uk/
https://gov.uk-dwpclc.bond/uk
https://gov.uk-dwpclw.bond/uk
https://gov.uk-dwpclj.bond/uk/

Perhaps there ought to be a delay before a new domain goes live to allow people to object to it? That would give governments, banks, delivery companies, and a dozen more "important" organisations a right to veto any "dodgy" looking domain.

But suppose someone wants to register gov-uk-stole-my-horse.horse to protest the government's cruel policy of stealing horses - is that a legitimate use of a domain? What if the Darwin Pensioner Divas - a group of elderly singers - want to take payments for their new album of goth/punk covers, can the DPD delivery company veto dpd-payments.music?

Do we want a domain name system where powerful companies control exactly which domains we can register? If I have an idea for a domain on a Friday night do I have to wait until Monday before it can be launched? Are those companies realistically able to parse millions of domains per year and have a low false-positive rate?

All of these things are possible - but all of them come with an impact on legitimate users. To be clear, I don't know what the right answer is.

What is ICANN doing about it?

Lots! It has been a few years since I've been to an ICANN meeting, but even back then the topic of abuse was high on the agenda. They appear to be looking at ways to coordinate abuse reports between various entities, along with some other policies which should hopefully work.

There are two salient points from one of the discussions held at the recent meeting

If anybody thinks that in our current age of AI and as we move into different kinds of computing, DNS abuse is going to numerically stay steady and we will have a downward effect on that baseline 2027 number. I'm not sure that that's an accurate assumption. I think it's going to be the other thing, which is […] it's going to be easier to abuse the DNS.

And

Abusers are going to abuse because it's just too lucrative, because no matter what we do, they will find the way to make profit off of that, and will try to circumvent everything that we do. That is not a reason not to do it, though.

Quite!

As I said, I don't know the answer to this. What I do know is, much like Android's app ecosystem being a haven for scammers, DNS is facing a crisis. When trust in a system goes, only chaos follows.

I don't want to live in a world where I have to show my passport and pay thousands of pounds to register a domain which is only available after being vetted by private interests. But I also don't want to live in a world where scammers have effectively no deterrent from abusing millions of people.

The purpose of a system is what it does. I hope DNS's purpose can become less dangerous while still remaining open.

How many consecutive hyphens can you have in a domain name?

Terence Eden — Mon, 08 Jun 2026 11:34:59 +0000

A seemingly simple question which sent me down into the murky depths of standards. How many consecutive hyphens can you have in a domain name? It probably isn't sensible to name your online presence a----------hyphen.com - but is there anything technically stopping you?

History

Let's do some history!

This is 1978's "HOST NAMES ON-LINE". Early Internet standards described the - character as "minus" rather than hyphen.

RFC 608

up to 48 characters drawn from the alphabet (A-Z),

digits (0-9), and the minus sign (-) ... specifically, no blank or space characters allowed;

no distinction between upper and lower case letters;

the first character is a letter;

the last character is NOT a minus sign;

no other restrictions on content or syntax.

So, originally, you could have as many hyphens as you wanted after the first symbol - which had to be a letter. The last symbol had to be a letter or number⁰.

That was later formalised in 1981's "DoD INTERNET HOST TABLE SPECIFICATION"

RFC 810 GRAMMATICAL HOST TABLE SPECIFICATION

<name> ::= <let>[*[<let-or-digit-or-hyphen>]<let-or-digit>]

That's carried in the the slightly more modern RFC 952.

By the time we hit 1987, the word "minus" has gone. Note, there are no restrictions on the number of hyphens - just as long as your domain name doesn't start or end with one¹.

RFC 1035 2.3.1. Preferred name syntax

The labels must follow the rules for ARPANET host names. They must start with a letter, end with a letter or digit, and have as interior characters only letters, digits, and hyphen.

By 1989, the "DOMAIN NAMES - IMPLEMENTATION AND SPECIFICATION" was tweaked again:

RFC 1123 2. GENERAL ISSUES

The syntax of a legal Internet host name was specified in RFC-952. One aspect of host name syntax is hereby changed: the restriction on the first character is relaxed to allow either a letter or a digit. Host software MUST support this more liberal syntax.

And, from then on, things stayed pretty stable until the futuristic year 2010. That was when Internationalised Domain Names (IDN) became available. They use the xn-- string at the start of the name so, the spec now says:

RFC 5891 4.2.3.1. Hyphen Restrictions

The Unicode string MUST NOT contain "--" (two consecutive hyphens) in the third and fourth character positions and MUST NOT start or end with a "-" (hyphen).

What they really mean is that "--" is banned in position 3 & 4 unless the first two characters are "xn"².

So, in theory, you can have up to 59 consecutive hyphens by ensuring that they start in position 4 and end at position 62.

Something like abc---[…]---z.com should be fine.

OR IS IT?!?!?

TLD Restrictions

There's what the RFC's say, and what a Top Level Domain (TLD) will allow. The Registry (the organisation which administers the TLD) may set their own, more restrictive, policies. Some will ban naughty words, or refuse IDN registrations, or prevent impersonation of Public Suffix domain, etc.

For example, South Sudan's .ss policies refuse to allow any hyphens.

Nominet, who run the .uk Registry, don't have any restrictions on the use of hyphens other than refusing to register xn-- domains.

But, in general, you can register multi-hyphened domain names with most Registries.

Anomalies

Of course, the mighty Internet mostly runs on spit and hope³. Naturally there are going to be mistakes, glitches, exceptions, and anomalies.

My delightful friend Q Misell had a rummage through her archives and helped track down some of the domain names which violate the modern rules. It's somewhat difficult to query every domain name, nevertheless, there are hundreds of multi-hyphened domains lurking within DNS.

Some, like ok--computer.com are long dead, but some are still active⁴!

Possibly the most consecutive hyphens belongs to http://a-------------------------------------------------------------a.com/

Sixty-one hyphens! The maximum possible, and it still works! The website looks like it hasn't been updated since it was first registered in 2000.

But what about more modern domains? The spookily named http://zz--icann-monitoring.uk/ was registered in 2024 - long after the rules were updated. But as Nominet doesn't allow xn-- domains, I guess it is fine?

There are some domains like bq--3bhauz7frjrgbka.com which look like they were pseudo-randomly generated. Perhaps as command-and-control servers?

Here's a quick table showing some of the ones Q found:

Domain	Creation Date	Status
`0-------------------------------------------------------------0.com`	1999	Down
`0-------------------------------------------------------------5.com`	2001	Live
`0---------------------0.com`	2000	Live
`0----------------0.com`	2000	Live
`0---------0.com`	2000	Live
`pr--newswire.org.uk`	2005	Down
`0o--o0.com`	2000	Down
`a-----a.net`	2000	Down
`pr--newswire.uk`	2019	Down
`uk--domain--names.uk`	2019	Live
`zz--icann-monitoring.uk`	2024	Live
`cd--storage-shelves.co.uk`	2012	Live
`mb--uk.co.uk`	2015	Live
`o---t.co.uk`	2016	Live
`om--tat-sat.co.uk`	1999	Live
`pr--newswire.co.uk`	2005	Down
`uk--domain--names.co.uk`	2000	Down
`we--buy--any--car.co.uk`	2009	Down
`i---i.net`	2001	Down
`a-------------------------------------------------------------a.com`	2000	Live
`a---b.com`	2000	Down
`v---v.net`	2000	Down
`we--care.net`	1999	Down
`b---h.com`	2001	Down
`bq--3bhauz7frjrgbka.com`	2000	Down
`bq--3bhauz7frjrgbkdcia.com`	2000	Down
`bq--3cbpcty2rjyq.com`	2000	Down
`bq--744a.com`	2000	Down
`bq--abs7czi.com`	2000	Down
`bq--abxgt4lb.com`	2000	Down
`bq--azbukkckjavdc.com`	2000	Down
`bq--azdecny.com`	2000	Live
`bq--eh7xj73b75xp62x7mh7xgah7ad7xj73b75xa.com`	2000	Down
`bq--gbbpy2enmnhq.com`	2000	Down
`bq--gbtfs2a.com`	2000	Down
`bq--s7z76.com`	2000	Down
`bq--zzzz.com`	2000	Down
`c-------7.com`	2001	Live
`f---you.com`	1998	Down
`id--design.com`	1999	Down
`ok--computer.com`	2001	Down
`t---28.com`	2000	Live
`t---taz---t.com`	2001	Down

Note, "Live" just means an HTTP request returned something. There may, of course, be other services running on that domain, or on subdomains.

So What?

Without a full list of every domain name, it's rather hard to draw firm conclusions. But, in the absence of anything better to do, here are some thoughts.

Most people don't want multiple consecutive hyphens in their domain names. They're unwieldy but mostly not prohibited.
If the authors of RFC 5891 had access to a full list of domains, might they have chosen a different syntax for Punycode?
Why is it so hard to look through every single registered domain name anyway? Even Certificate Logs no longer seem to be easily searchable.
Are there any other weird restrictions which are violated by older domain names?
When will DNS finally go all-in with Unicode rather than this kludge? (Probably around the same time as IPv6 adoption!)

If you know of any weird multi-hyphenated domains, please stick a comment in the box 😊

Update! A kind anonymous benefactor has shared a list of eighty-four thousand domains with multiple hyphens. There are some very odd entries in there.

Way back in the year 1999, several domains were registered with trailing hyphens. This was swiftly corrected and the domains deleted. ↩︎
Note, I think this is when domain names expanded from 48 characters to 63. But that's a different Yak to Shave. ↩︎
I wonder why this isn't zero-based like so many other computery things. But that's a different rabbit hole. ↩︎
And, so I'm told, a cabal of vicious Furries waiting to pounce. ↩︎
There are also quite a few for sale. ↩︎

.ss TLD opening for direct registrations

Terence Eden — Wed, 31 Jul 2024 11:34:05 +0000

It looks like South Sudan's Top Level Domain is going to start allowing direct registrations!

Long-time readers of this blog will know that it's possible to register .me.ss domain names - there are various other 3rd level domains you can buy.

But, from the 1st of August 2024, you'll be able to apply for a 2nd level. So you'll be able to grab example.ss.

Here's the official announcement.

As per normal for a new TLD, there will be a period where organisations with Trade Marks can register their domains. Then a period where anyone with sufficient cash can register their cool idea for a domain. Then it opens up to everyone.

So what will they cost? Afriregister provided these prices:

Period	Domain	Registration	Renewal
Sunrise (2 years)	.ss	€1020	€110
	.co.ss	€610	€60
Landrush (1 year)	.ss	€300	€110
	.co.ss	€160	€60
Early Access (1 year)	.ss	€220	€110
	.co.ss	€160	€60
General (1 year)	.ss	€110	€110
	.co.ss	€60	€60

For comparison, their .me.ss domains are only €25.

Registrations will only be allowed in ASCII - which means no IDNs. The majority of the languages officially recognised in South Sudan appear to be written in the Latin script, so that shouldn't be a huge issue.

As is common with all other TLDs, there is a list of words which will not be allowed to be registered.

Applications will not be accepted for domain names appearing on the Second Level Domain (SLD) block list.

When I previously investigated this, there were lots of names which weren't available due to local politics. Although there is an archived version of the list of banned words (PDF), the modern SLD Block List appears to have vanished from the registry. I've asked them for an updated list which I'll link to once I get it.

I think it is fair to say that the .ss TLD has had a tumultuous history. There hasn't been much discussion of this change in policy since the announcement a few weeks ago - but I hope that this opening up will help South Sudanese people & businesses to establish their own distinct presence on the Internet.