[conspire] (forw) Re: Domain registrars

[Rick Moen]

----- Forwarded message from Rick Moen <rick at linuxmafia.com> -----

Date: Wed, 23 Dec 2015 18:50:23 -0800
From: Rick Moen <rick at linuxmafia.com>
To: Deirdre Saoirse Moen <deirdre at deirdre.net>
Cc: [friends who asked for registrar-selection advice]
Subject: Re: Domain registrars

Quoting Dire Red (deirdre at deirdre.net):

> My personal favorite (and I have domains at three registrars) is
> iwantmyname.com - https://iwantmyname.com/about
> 
> Rick points out that gandi.net and joker.com are also good. (Gandi is
> one of the ones I use, I just prefer IWMN.)
> 
> I’m moving all my renewing domains to IWMN but not all were available
> from there when I registered them as I have some domains with weird
> TLDs like perdedor.soy.

Deirdre says IWMN's statement of domain ethics (on the About page) is
impressive.

tl;dr:  I don't know IWMN.  I can recommend gandi.net and joker.com for 
on numerous grounds.

Contents below:

1. Scope of Services
2. Criteria for a Good Registrar (Which Differ)
3. Impartial Review Sites
4. A Note on Price Practices and Aberrant Registrar Conduct 
5. Tucows OpenSRS Squares the Circle
6. Best Practices for Domain Owners


1. Scope of Services:  

When I speak of a 'domain registrar', I mean the company that records
you ownership, your domain contacts, the future expiration date, and
your authoritative nameservers in the Shared Registry System (SRS) and
creates glue records for your authoritative nameservers in the DNS.
And, of course, taking your money and sharing part of it with VeriSign
for operating the SRS and with ICANN for being bureaucratic busybodies 
with entitlement issues.

Some (many) registrars also bundle a variety of additional, optional
services, including:

o  authoritative DNS
o  privacy proxy for WHOIS data
o  e-mail
o  Web hosting

Sometimes, I find discussion goes sideways because I say I favour
(say) Joker.com and Gandi.net because they do the core job of domain
registrar well, but my interlocutor favours someone else that does good
bundled e-mail and erroneously thinks all registrars provide that
service.

Over the years, I've learned to be beware of people using the same words
but meaning different things.


2. Criteria for a Good Registrar (Which Differ)

Preference in domain registrars goes back to 1998 when ICANN (relying on
borrowed authority from the US Dept. of Commerce) ordered Network
Solutions ('NetSol') to split its domain business into a back-end database
('registry') reached by new Open Registry System protocols, and a retail
domain registrar front-end business, which was obliged to compete with
(new) third-party registrars.

NetSol remained infamous for high prices combined with inert failure to
do customer service, and occasionally aggressive actions to control
customers and deter competition.  VeriSign bought NetSol in 2000, then
sold the registrar (retail) half of the operation three years later to a
private equity firm.  VeriSign still operates the registry (back-end)
under US Federal contract.  

In 2003, the private equity firm owning NetSol (retail portion) sold it
to a different private equity firm.  In 2007, Web.com bought the firm
and did immediate (deep) mass layoffs -- which suggests NetSol as
registrar is probably now even worse than it was when it got its bad
1990s reputation.

Starting in 1998, some customers moved from NetSol to firms that
promised human customer service, and charged premium prices for 
that (e.g., $35 for .com domains).  I'm not sure any still exist;
the domains business is of necessity massively automated.  My guess is
that human handholding, even if sincerely promised, didn't work well.
The business relies critically on automation and economies of scale, and
interactive customer service famously does _not_ scale, especially the 
skilled and competent kind.

So, other criteria predominate in customer consciousness:

o  Price (of course).  GoDaddy leads this pack on account of volume, 
   and sucks massively in every other way.

o  Real-world fairness to customers.  As some registrars got a
   reputation for being manipulative and abusive towards customers, 
   choice-sensitive customers gravitated towards others.

o  Immunity to US Federal strong-arming.  Some customers including
   me see strong merit to a registrar operating outside the USA,
   such as Gandi.net (Paris) and Joker.com (Duesseldorf), as 
   US spooks, other Federal agencies, and courts cannot jerk them
   around.

o  Established record of rational and stable behaviour.


Because most of these criteria are subjective and debatable, 
there is no Royal Road to the best domain registrar -- not even if you
eliminated confusion over bundled optional services.

It is unclear whether pervasive bashing of NetSol (the retail half) is
entirely fair: The firm has a unique situation as the registry of many
people solely through inertia, either because the domains originated
pre-1998 or because of the erroneous assumption that they should be the
default choice.  On the one hand, NetSol has since 1998 had an obvious
incentive to drag its feat on outbound domain transfers to its sudden
large numbers of competitors.  On the other hand, it's unclear how much
of the horror stories owe to mishap on the part of largely unskilled
domain owners, rather than NetSol's fault.

As the registrar with the longest history, the most prominent registrar,
and the registrar with the biggest incentive to deter customer
defections, NetSol has had the best-known controversies:
https://en.wikipedia.org/wiki/Network_Solutions#Controversies

It is indisputable that NetSol's pricing is above average, its policies
have frequently been a bit hostile to customer interests, and it isn't 
known for quality customer service commensurate with its price premium.



3.  Impartial Review Sites

There was a brief time between 1998 and 2001, when we observers thought
review information would be ubiquitous and domain customers would be
well informed.  Several sites attempting to be the Yelp.com of domain
registrars existed.  The best of them was domainnamebuyersguide.com .
Then, by 2001, they all died.

I linked the final snapshot of domainnamebuyersguide.com from
http://linuxmafia.com/kb/Network_Other/ -- and you can see what I mean,
but it _is_ now 14 years out of date, so bear that in mind.

Note that domainnamebuyersguide.com included 'overall ranking', 'legal
ranking', and 'price ranking'.  'Legal' referred to the reasonableness
of the registrars' contract terms.  If the site and ones like it had
persisted, that might have been supplemented by records of real-world
abusive behaviour (vs. not, from other registrars).

Note that Gandi.net was near the top for 'Overall', #1 for 'Legal', 
and #1 for 'Price'.  (Again, this was the review site's opinion in
2001.)  Joker.com was for some reason not evaluated.  IMO, had it been
reviewed, it would have been up near Gandi.net.

Also near the top was domaindiscover.com of San Diego.  I was a Domain
Discover customer after leaving NetSol around 1998, and liked them, but
they were a bit pricey ($30).

The semi-piratical nature of the registrar market owes in part to the
eclipse of review sites.  The field is yelping for a Yelp.



4. A Note on Price Practices and Aberrant Registrar Conduct
 
A bad registrar is like a Don Draper on methamphetamine, whom you've
inexplicably entrusted with your vital interests.  The very least of
this is 'domain slamming' where registrar B deliberately steals a
customer's domain from registrar A through trickery.  It gets worse from
there.  Some registrars have a bad reputation for grabbing particularly
valuable expiring domains for themselves, or to sell on domain auction
sites (which some registrars themselves own and operate).  Some
registrars are infamous for passive-aggressively resisting / ignoring
customer attempts to transfer any domain to competitors.

Some registrars (e.g., GoDaddy) got bad reputations for disabling
domains merely because someone sent a trademark or copyright or similar
complaint e-mail.  In 2007, GoDaddy did this to site SecLists.org
hosting multiple high-profile security mailing lists including the one
for the nmap security utility, based on a (mishandled) complaint e-mail.  
nmap author Fyodor was so enraged that he created and operated for many
years debunking Web site NoDaddy.com to make sure the world was aware of
how terrible a company GoDaddy is.  GoDaddy eventually made this expose
site go away by buying domain NoDaddy.com from its custodian, and then
shutting the site down.

https://web.archive.org/web/20110627205958/http://nodaddy.com/

(It didn't help that GoDaddy management attempted to clumsily lie about
its actions in the SecLists.org incident, and got caught at it:
http://www.cnet.com/news/godaddy-pulls-security-site-after-myspace-complaints/)

Many domains aggressively court business using first-year discount
pricing, but then subsequent renewals are higher, and ongoing customers
can reasonably expect they're subsidising switchers' introductory
prices.  IMO, first-year discounts are best ignored, as they're a drop
in the bucket over typical domain lifetimes.

Below a certain commodity pricing, such as (currently) about $12 for
.com domains, you should wonder where the compensating disadvantage is.
(With GoDaddy, for example, the answer is 'everywhere else'.)

Other abusive practices include
https://en.wikipedia.org/wiki/Domain_tasting#Related_Practices
https://en.wikipedia.org/wiki/Domain_name_front_running
https://en.wikipedia.org/wiki/Domain_drop_catching
https://en.wikipedia.org/wiki/Domain_name_warehousing 



5. Tucows OpenSRS Squares the Circle

Soon after the registrar market opened in 1998, Midwest software company
and ISP Tucows invented an interesting business model:  Tucows qualified
as a registrar (thus getting SRS access), but delegated all retail
functions to individuals and firms signing up with Tucows to be
'resellers'.  Tucows's reseller arrangement, its middle layer of software
/ protocols between itself and its resellers, and the business division
that managed this part of the firm was dubbed 'OpenSRS'.  Thus, Tucows
itself gained the advantage of massive automation without the costs and
hassles of customer contact, which are to be always handled by the
customer's reseller.

In general, being an OpenSRS reseller is not, per se, a credible
business model.  At best, it's usually an adjunct service to a real
business, much like being a notary public.  For their part, resellers
often quickly learn to restrict whom they'll accept as customers and
retain preferentially customers requiring little or no personal
handholding.

I keep linuxmafia.com registered through a distant acquaintance in Texas
who's an OpenSRS reseller.  He likes me as a customer because I follow
best practices (see below) and thereby remain a no-hassle customer, and
send him a cheery thank-you note every year.  To the best of my
knowledge, he ceased accepting new customers many years back.  I know
one person whose further renewals were refused by this same seller after
she let an important domain reach the day of expiration and then
barraged him with frantic telephone calls to his house, e-mails, and
faxes, during a holiday weekend, moving herself to the 'too much hassle'
category overnight.

This OpenSRS topic is present, here, not so much to recommend OpenSRS as
to illustrate some of the industry's business realities:  Everyone wants
massive business volume, nobody wants to do handholding.


6. Best Practices for Domain Owners

a) The single best thing you can do to avoid problems and maximise
satisfaction is always keep domains of interest multiple years away
from expiration.  No, those additional years would not be 'wasted' if
you chose to move to a new registrar, as every registrar has a policy of 
carrying forward years remaining from the incumbent registrar.

b) Think twice before using a 'Private Registration' / 'Privacy Proxy' 
option.  Most registrars, usually at extra cost, permit you to list
a 'proxy' name / address / e-mail / telephone number for each of the
three contacts for your domain in the public WHOIS database.  Customers
think this service helps evade spam, but is notorious for preventing you 
from getting needed mail, including mail that must be received to move a
domain to a new registrar.

c) Never use the same name / address / e-mail / telephone number for all
three of a domain's public contacts.  To do so creates a single point of
failure for reaching the domain's management.  Always use at least two
people's (different) contact data.

(Note:  For some domains such as .au, public contact information is very
limited, allegedly for privacy-protection reasons.)

d) If moving a domain to a new registrar, for many top-level domains,
you must acquire an Authorization Code from your incumbent registrar and
provide it to the new registrar.  

e) If moving a domain to a new registrar, for some TLDs you must
telephone your incumbent registrar to start the process.  E.g., for
NetSol, see
http://www.networksolutions.com/support/preparing-a-domain-name-for-a-transfer-out-of-network-solutions/
.

f) If moving a domain to a new registrar, you must disable 'Private
Registration' / 'Privacy Proxy' before starting, and turn off the
Transfer Lock flag.  (Registrars may use a different name for this lock
flag.)  The Transfer Lock flag is a now-ubiquitous measure to deter
domain slamming.

g) Get to know your chosen registrar's domain control panel Web site
well.  At least skim-read its documentation.  Make sure multiple domain
stakeholders have the domain administration credentials and know how to
use the registrar's domain control panel Web site.

h) Periodically (e.g., yearly), check and test contact information
listed in the public WHOIS data, to make sure it's still valid and
reaches a human.

i) Be aware that most registrars forbid re-transfers of domains for the
first 60 days after the domain arrives at the registrar, and there may
be other restrictions during the initial two months.  This sort of
restriction was introduced to curb some scams involving frequent domain
movement.






----- End forwarded message -----