Google has fixed the flaws in the Chromium browser engine that saw it poll DNS root servers, but ISPs who seem to have odd views about resilience now emerged as a new source of probably-well-meaning overconsumption of internet resources. ICANN’s office of the Chief Technology Officer delivered that view on Monday during the governance org’s annual conference in Bali, Indonesia, in a session that shared recent data from its Identifier Technology Health Indicators (ITHI) research program which monitors the security, stability and resilience of the domain name system. ICANN principal technologist Maud Durand opened with a discussion of “Chromioids” the odd flaw in Chrome that meant well-meaning efforts to avoid a form of DNS hijacking caused the browser to generate about half of all DNS root server traffic during the year 2020. Given Chrome’s enormous prevalence, that traffic was unwelcome. ICANN, plus other internetworking and governance stakeholders, told Google to sort it out. Durand said the Chocolate Factory gradually did. ICANN has kept measuring the impact Chrome makes and Durand shared the graph below which shows the browser’s share of DNS root server traffic falling from 45 percent to one percent today. Or as Durand described it, “in the noise.” ICANN has now detected a new source of odd DNS traffic: ISPs that use multiple DNS servers for every one of their customers’ requests. “Every single DNS query is sent three times: to Google, to Cloudflare, and to another DNS resolver,” Durand said, labelling this practice a “belt and suspenders” approach because a single resolver usually suffices to keep services up. It’s good practice to specify primary and secondary DNS resolvers, in case one doesn’t work. But DNS resolvers are already very resilient, and making multiple requests is unusual. The ISPs ICANN has spotted send DNS requests over IPv4 and IPv6, and for non-cached requests repeat them within 100 milliseconds for about half of queries. A further 30 percent repeat within thirty seconds. “It is hard to know if it is a bug or a specific behaviour,” Durand said, before advancing a personal theory that the ISPs who use this odd resilience technique can’t hire skilled internetworking engineers and therefore created a kind of brute-force resilience routine. The organization is researching the cause. ICANN feels the ISPs using this practice aren’t major players, but the org worries that if the practice becomes widespread, or is adopted by a large entity, it could have a nasty impact. Pointlessly busy DNS servers also matter because ICANN thinks the number of DNS service providers is becoming more concentrated. ICANN has tried to calculate how many DNS resolvers half of internet users can “see” when they are online. As the graph below shows, users could see almost 250 resolver farms in the year 2020. That figure is just under 150 today. Again, Durand isn’t sure why but suspects the number of DNS resolver operators might be shrinking and that the remaining visible resolvers belong to tech giants. ®

London's mobile network performance has slipped behind other European capitals as operators struggle to add capacity fast enough to meet demand. The city ranked seventh out of 18 in the continent for median download speed in 2021, but traffic has since expanded faster than available capacity. Other metropolises have improved; London now has the slowest speeds and the highest latency under load, according to mobile network testing firm Ookla. The research points to obstacles mobile operators face in adding extra capacity: applications for new street masts in London have fallen since 2022, and about three quarters of those filed since 2019 were refused. The Big Smoke was among the first European capitals to get 5G coverage, yet when Ookla's Q3 2026 tests found the city now has the slowest median download speed (109.43 Mbps), the slowest median upload speed (11.40 Mbps) and the highest latency under load - a measure of how the network copes with heavy use. Ookla's records show London’s 5G medina speed peaked at 200 Mbps in Q2 2021, fell as low as 102 Mbps in Q3 2023, then recovered slightly. Paris, by contrast, has stayed above 225 Mbps since mid-2021. The cause is congestion. In Central London, performance slumps on weekdays as commuters arrive: median download speed falls to 80.07 Mbps through the morning, 27 percent below weekend levels at the same hours. Part of the problem is that UK mobile operators own few of their antenna sites, many of which sit on rooftops in built-up areas, says Ookla. Under the Electronic Communications Code, and changes introduced in 2017, a London rooftop is worth about £1,000 ($1,333) a year to its owner, down from £21,000 ($28k). That givers landlords little motivation to host antennas, and many prefer solar panels. Operators can also receive notices to quit when a building is redeveloped, and it is estimated that this keeps about 7 percent of London’s rooftop sites out of action at any time. Planning rules compound the problem as applications for new masts are more likely to be refused in boroughs with conservation areas, such as Westminster. Street mast applications peaked in 2020, early in the first 5G build, and have fallen by more than four-fifths since 2022. Three quarters of applications for new street masts since 2019 were refused, against one in five upgrades. "Planning restrictions, particularly in conservation areas, make it harder to install and upgrade the mobile equipment London needs," Ookla lead industry analyst Luke Kehoe told The Register. "Notices to quit can also force rooftop sites offline during redevelopment long before replacements are ready, leaving operators trying to restore lost capacity while demand keeps growing." City Hall has noticed, and a draft plan for the capital drawn up by the Mayor of London observes that notices to quit "have eroded London’s overall mobile connectivity compared to other equivalent cities." The plan, due tor adoption in 2028, would require developers to keep mobile service running during construction, put masts on taller buildings and in the public realm; and ask boroughs to work with operators on sites in conservation areas. Other experts blame different factors for London’s poor mobile service. Professor Mohamed-Slim Alouini of the King Abdullah University of Science and Technology (KAUST) told The Register last year that the government’s decision to rip-and-replace network equipment supplied by China-based vendor Huawei had diverted funds that should have gone into building more capacity. He also said 5G was overhyped early on, leading to a perception among users that it wasn’t really worth having and operators reluctant to invest. Whatever the cause, London’s mobile experience now trails its European peers, though people elsewhere in the UK who still can’t get a 5G signal will have little sympathy. ®

ICANN has started testing authentication schemes that will allow law enforcement agencies to make urgent requests for non-public WHOIS information – when needed to address threats to life, critical infrastructure, or child exploitation. Domain registrars collect information about their customers and in the past that data was publicly available in WHOIS records. Some domain registrars offer services that substitute their own contact details, to preserve customer privacy. In recent years, laws like GDPR mean registrars are sometimes required to hide WHOIS data. That’s fair enough but makes it hard for law enforcement to contact a domain holder if their resources are being misused – intentionally or otherwise – for purposes such as hosting malware, acting as command-and-control infrastructure for malware, or facilitating phishing. ICANN’s definition for the kind of behaviour it thinks justifies urgent requests for WHOIS info is “imminent threat to life, of serious bodily injury, to critical infrastructure, or of child exploitation.” The org has convened an Input Group on Law Enforcement Agency Authentication Mechanisms to consider the issue, and that group yesterday explained its progress during ICANN’s annual meeting in Bali, Indonesia. At this point, readers may have concerns that this proposal could allow law enforcement authorities to make inappropriate requests for WHOIS information. Several factors may ease such concerns. One is that representatives of domain registrars Namecheap and Verisign spoke during the session about the proposal, and both were supportive. Another is that the Input Group’s work is largely technical. Once it devises a mechanism to allow requests, other groups within ICANN dedicated to policy will work out acceptable use and related issues. This is the way internet governance gets done! Specialists work on their own bits of a problem and then collaborate to create a robust system that works at a technical level, is practical, and enforceable in multiple jurisdictions. How they’ll do it At this point, ICANN’s preferred approach is to use Security Assertion Markup Language (SAML) so that authenticated users at law enforcement agencies can log into the governance org’s Registration Data Request Service (RDRS) and file requests to access non-public WHOIS info. ICANN is already testing this approach with the FBI and Interpol but is open to other authentication mechanisms to allow other agencies access RDRS. The Input Group’s aim is to publish a spec those agencies can conform to. ICANN will pass requests filed in RDRS to whichever registrar sold the domain. The registrar will have 24 hours to consider the request – or up to 72 hours for complex queries. Registrars will also be able to deny requests if they feel the query does not meet the urgency threshold. Register readers might worry that a colossal agency like the FBI could flood RDRS with requests from thousands of individual agents, swamping domain registries. ICANN’s plan is to avoid that by requiring law enforcement agencies to nominate certain personnel who are permitted to make requests, and to enforce that permission using a token shared during SAML handshakes. The content of that token is the kind of policy question that the Input Group expects others at ICANN to finalize later. Another issue under consideration is how to protect the identity of law enforcement workers who make RDRS requests, as ICANN feels they could become targets of harassment (or worse) if their requests to see WHOIS data include email addresses. ®