Technical Glossary
A hierarchical, distributed naming system that translates human-readable domain names into numeric IP addresses required for routing network traffic across the internet, functioning as the fundamental directory service for all web-based connectivity. DNS operates through a recursive resolution process involving root servers, top-level domain authoritative servers, and caching resolvers that collaboratively resolve billions of queries daily. The system supports multiple record types including A, AAAA, CNAME, MX, and TXT records that map names to various service endpoints. IETF RFCs 1034 and 1035 define the core DNS protocol, with subsequent extensions for security and modern features.
A suite of IETF-standardized extensions to the Domain Name System that provide cryptographic authentication of DNS responses, ensuring that domain name resolution data has not been tampered with during transit. DNSSEC establishes a chain of trust from the DNS root zone through each delegated zone using digital signatures, DNSKEY records, and delegation signer records. Validating resolvers verify cryptographic signatures at each hierarchical level to detect cache poisoning and man-in-the-middle attacks targeting domain name infrastructure. The specification is defined across IETF RFCs 4033, 4034, and 4035 with operational guidance from NIST.
A domain name encoding system that enables the use of non-ASCII characters from scripts such as Arabic, Chinese, Cyrillic, and Devanagari in domain names through an ASCII-compatible encoding mechanism called Punycode. IDN technology expands internet accessibility by allowing users to navigate the web using domain names in their native languages and writing systems. The registration process involves validation against IDNA2008 protocol rules, Unicode normalization, and registry-specific language tables to prevent homograph attacks. IETF RFCs 5890-5893 define the current IDN standards, while ICANN manages the policy framework for internationalized top-level domains.
An organization responsible for maintaining the authoritative database of all domain name registrations within a specific top-level domain, operating the zone file and nameservers that direct DNS queries to the appropriate registrant nameservers. TLD registries manage the technical infrastructure, registration policies, and pricing frameworks for domains under their jurisdiction, including generic TLDs like .com and country-code TLDs like .uk. The Extensible Provisioning Protocol standardizes the interface between registries and registrars for domain lifecycle management operations. ICANN accreditation and IETF EPP specifications govern TLD registry operations and interoperability.
A query-response protocol for accessing registration data associated with internet domain names, IP address blocks, and autonomous system numbers from distributed registrar and registry databases. WHOIS provides essential transparency for domain ownership identification, intellectual property enforcement, and cybersecurity incident response by exposing registrant contact information and registration metadata. Privacy regulations including GDPR have significantly impacted WHOIS data availability, driving the transition to the Registration Data Access Protocol for structured, access-controlled queries. The protocol is defined in IETF RFC 3912 with RDAP successor specifications in RFCs 7480-7484.
The process of estimating the monetary worth of a domain name asset based on factors including keyword relevance, search volume, brandability, extension popularity, domain length, linguistic properties, and comparable sales transaction data from secondary markets. Valuation methodologies range from automated algorithmic appraisals using machine learning models trained on historical sales data to expert assessments considering strategic brand potential and type-in traffic value. Premium domain pricing in secondary markets can reach millions of dollars for short, memorable, category-defining names with high commercial intent. Industry platforms such as DN Journal and NameBio aggregate historical sales data used in domain valuation benchmarking.
A decentralized naming system in which domain name ownership records are stored on a blockchain ledger rather than in traditional ICANN-governed registries, providing censorship-resistant, self-custodial control over digital identity namespaces. Blockchain domains use smart contracts to manage registration, renewal, and transfer operations without intermediary registrar involvement, with popular implementations including Ethereum Name Service and Unstoppable Domains. These names can resolve to cryptocurrency wallet addresses, decentralized websites hosted on IPFS, and other Web3 resources through specialized resolvers. W3C decentralized identifier standards and EIP-137 provide the technical foundations for blockchain-based naming architectures.
A service that replaces a domain registrant's personal contact information in public WHOIS and RDAP records with proxy or privacy service provider details, shielding individual and business identity data from automated harvesting, spam targeting, and social engineering attacks. Privacy protection services maintain a forwarding mechanism to relay legitimate communications to the underlying registrant while filtering unsolicited contacts. ICANN's Registration Data Policy and GDPR compliance requirements have driven widespread adoption of privacy protection as a default registration feature. The Temporary Specification for gTLD Registration Data established post-GDPR operational guidelines for registrar privacy implementations.
A protocol that uses DNSSEC-validated DNS records to bind X.509 certificates or raw public keys to specific domain names, enabling domain owners to specify which certificate authorities are authorized to issue certificates for their domains. DANE provides a mechanism to establish TLS trust anchors without relying solely on the traditional certificate authority public key infrastructure, reducing vulnerability to certificate misissuance and authority compromise. The protocol uses TLSA resource records to associate TLS server certificates with the domain names where they are found. IETF RFC 6698 defines the core DANE specification with additional profiles for email security in RFC 7672.
An XML-based application layer protocol designed for provisioning and management of domain name registrations, host objects, and contact records between domain registrars and registry operators in a standardized, interoperable manner. EPP supports the complete domain lifecycle including registration, renewal, transfer, and deletion operations through a stateful client-server interaction model with strong authentication. The protocol's extensibility mechanism allows registries to define custom extensions for jurisdiction-specific requirements and advanced domain management features. IETF RFCs 5730 through 5734 define the core EPP framework and domain-specific mappings.
A protocol for performing DNS resolution via the HTTPS protocol, encrypting DNS queries and responses between client stub resolvers and recursive resolvers to prevent eavesdropping, tampering, and traffic analysis of domain name lookups by on-path network entities. DoH integrates DNS resolution into standard HTTPS traffic flows, making it indistinguishable from regular web browsing and resistant to DNS-based content filtering and censorship mechanisms. Implementation requires DNS resolvers to expose an HTTPS endpoint accepting DNS wire-format or JSON-encoded queries. The protocol is standardized in IETF RFC 8484 and has been adopted by major browser vendors and public DNS resolver operators.
The secondary marketplace for buying and selling previously registered domain names through auction platforms, brokerage services, and private treaty sales, where premium domains with established traffic, brand value, or keyword authority command significant prices. Aftermarket platforms facilitate price discovery through ascending auctions, buy-it-now listings, and make-offer negotiation workflows with integrated escrow services for secure fund transfer. Domain investors analyze metrics including search volume, CPC values, comparable sales, and extension strength to identify undervalued acquisition targets. Industry platforms including Sedo, Afternic, and GoDaddy Auctions operate the primary aftermarket infrastructure.
A DNS resource record type that allows domain name holders to specify which certificate authorities are permitted to issue SSL/TLS certificates for their domains, providing a policy-based layer of protection against unauthorized certificate issuance. CAA records are checked by compliant certificate authorities before certificate issuance, and mismatches result in issuance denial and optional incident reporting to the domain holder. The mechanism complements Certificate Transparency logging by proactively restricting issuance rather than only detecting misissuance after the fact. IETF RFC 8659 defines the CAA record format and processing rules for certificate authority compliance.
A decentralized, permissionless naming protocol that aims to replace the existing certificate authority and DNS root zone trust model with a peer-to-peer blockchain system where top-level domain ownership is secured through proof-of-work consensus and Vickrey auction mechanisms. Handshake enables users to register, transfer, and manage TLDs without centralized governance, storing zone records directly on the blockchain for censorship-resistant name resolution. The protocol maintains backward compatibility with existing DNS infrastructure through integration with traditional recursive resolvers. Handshake represents an alternative approach to internet naming governance that challenges the ICANN-centric model.
A generic top-level domain operated exclusively by a brand owner for use within its own digital ecosystem, providing complete control over namespace management, registration policies, and DNS infrastructure for branded online presence. Brand TLDs like .google, .apple, and .amazon enable organizations to establish trusted, phishing-resistant digital namespaces that reinforce corporate identity and simplify internal resource addressing. The application process through ICANN's new gTLD program requires substantial investment in technical infrastructure, legal compliance, and ongoing registry operations. ICANN's Applicant Guidebook and Registry Agreement define the operational requirements and contractual obligations for brand TLD operators.