ICANN: The Importance of IDN Compliance

ICANN’s Director of IDN discusses the importance of technical compliance for international domain names.

ICANN Director of the IDN Program Tina Dam wrote about the importance of compliance with IDN technical requirements on the ICANN blog today. It’s a must read for anyone who has invested in international domain names (domains that use non-roman/latin characters) or considering them as new IDN TLDs are introduced.

Dam stresses that technical compliance is required for the long term success of IDNs. Without it, the IDN system will collapse. This is especially important when new top level IDNs are released in the coming years. (Currently, IDNs are only available for registration at the second level with a roman character top level domain).

One example Dam provides is the domain names that were registered with a mixture of scripts, which were often used for phishing attacks. New technical standards forbid this.

One specific example of this is paypal.com, where the “a”’s are Cyrillic characters and the rest are Latin letters. This address is visually the same as paypal.com (all in Latin letters), but physically, to the computer, these are two different addresses. This is damaging the uniqueness principle of the DNS – probably the most important principle of the DNS and what makes it work in a stable manner.

As a result of non-compliance, a lot of application developers (e.g. browser developers) didn’t follow technical standards themselves. Some of them “whitelist” IDNs that they deem acceptable. Application developers certainly don’t want to be in the business of deciding which sites are safe.

If compliance is lacking, the IDN system will fail. Dam writes:

The worst scenarios could be one of the following two: either that IDNs will be filled with phishing attacks that IDNs will be of no use and users will be scared of using them, or restrictions in the application layer will be so strict that IDNs will for example not resolve in an adequate and at least not in a stable and secure manner. Either way, this does not provide the community what they have asked for and what we are attempting to provide them with the implementation of IDNs, namely, equal access to the DNS by all languages and scripts.

Of course, it’s up to the community to make sure these standards are complied with.