Root zone changes may shake up Net in Africa

The stability of the Internet is likely to be shaken next year, especially in emerging economies such as African countries, as ICANN deals with the introduction of changes to the root zone.

The root zone is at the apex of the Domain Name System (DNS) hierarchy and will go through major changes next year as ICANN introduces Internationalized Domain Names, new top level domains (TLDs), IPv6 and DNSSEC (DNS Security extension).

From January 2010, ICANN will implement DNSSEC -- using a technique also known as root signing -- on the root zone, which will affect the performance of the Internet. Currently, queries from domain servers to the root are 512 kilobytes or less, but DNSSEC will make them larger because it introduces new signatures and keys as part of the security features.

"The root signing is planned to start in January and will be introduced gradually as a way to test the problems that may arise; this will make Internet slower in some cases because the files coming from the root zone will be larger and heavier," said Bill Manning, a professor at the University of Southern California who runs the "B" root server.

"If ICANN is concerned about the stability of the Internet, the root signing is going to destabilize the system, especially in areas with low bandwidth, given the size of the responses," added Manning.

The effects of the root signing, IPv6 and addition of the new TLDs was addressed in a report titled "The Impact on the DNS Root System of Increasing the Size and Volatility of the Root Zone," which was prepared by the Root Scaling Study Team for ICANN.

The report indicates that if the only objective of root system management were stability, no change in the current size or composition of the root would be justifiable. Scaling up the root zone is likely to place additional demands on those operators that have copies of the root zone file in economically less-developed parts of the world.

One of the problems that ISPs will likely face in developing countries is that their firewalls may not allow the bigger DNS responses to filter through. This may require investment in firewalls with updated software.

"Investing in updated firewall boxes will sort most or some of the problems. Unfortunately, developing countries are often the dumping ground for the outdated hardware and software," said Manning.

There have been inconclusive reports on the effects of all the changes. Another report by the DNS Operations Analysis and Research Center (DNS-OARC) indicates that servers running on BIND- or NSD-based servers may handle the changes faster but with some expected problems.

The report by the DNS-OARC was conducted for the "L" root operated by ICANN.

"As the changes are introduced, there will be increase in capacity but we need to balance the pipes and the data," said Lars-Johan Liman from Autonomicae, who was presenting at the ICANN meeting in Seoul earlier this week.

The ICANN community seems split on whether DNSSEC should be introduced first or whether the new TLDs should be added first. According to the study by ICANN's root scaling study team, DNSSEC should be introduced first but proponents of the new gTLDs view it as a ploy to delay the introduction on new TLDs to the root.