4 ms·

One of the answers on SE also says something along the same lines. Although I have no doubt that running a registrar costs a lot of money, this is the wrong ans

by kijin 13y ago

One of the answers on SE also says something along the same lines. Although I have no doubt that running a registrar costs a lot of money, this is the wrong answer to the original question. .com domains cost $10 because Verisign charges $7.85 for each of them in addition to the $0.18 ICANN fee. Large registrars, of course, get volume discounts, and they might even sell new domains at a loss when they think they can rip you off on add-ons and renewals. But by no means are they pocketing the entire $9.82 as the question mistakenly assumes.

smcl 13y ago
I'm not massively clued in on this so apologies if this is a bad question, but what's Verisign's role in this? That's a decent amount of cash, what is the service they provide for that?
- 0x0 13y ago
  They run the .com registry and zone, among other TLDs.
- lsc 13y ago
  I own the domain prgmr.com, and control the associated nameservers. I can make smcl.prgmr.com, and give it to you. I can even point smcl.prgmr.com at your own nameserver so you can make somethingelse.smcl.prgmr.com. You could, in fact, sell other people [something].smcl.prgmr.com. domains, and so on. It's just a line in my dns config. (then dealing with abuse complaints and the like) Now, Verisign owns .com. There's no technical difference, really, between .com, .co.uk, and prgmr.com. If you want smcl.com, you need verisign's dns servers to cooperate, just as if you want smcl.prgmr.com, you need my dns servers to cooperate. For this, verisign charges the registrar seven bucks and change. The registrar tacks on a few pennies (or does the same with advertising) and handles all interactions with you. Verisign has a nice re-seller interface. That's what the registrar/registry split is all about. But if I really thought people would give me money for something.prgmr.com. dns entries, I'm sure I could come up with a re-seller interface, too. Personally, I think the current price is a little high, but mostly because I don't like monopolies in general, and my feelings for Verisign can only be described with superlative synonyms for hatred. Personally, if someone has to have a monopoly on .com domains, I think a not-for-profit like ICANN would do a better job. It is a small injustice, though, for reasonable people with one or two domain names. (On the other hand, the registrars, the people who actually handle the customer interaction, are ridiculously efficient. if you want a domain cheap, you can get it for pennies over what the monopoly charges, or you can pay a few bucks more, and get pretty good service, showing that when there is competition, for-profit businesses can do a pretty good job.)
  - mkingston 13y ago
    It hadn't even occurred to me that someone might have considerable control/ownership over large tracts of DNS servers. (Of course they do, I'd just never thought about it!). So anyway, I'd just like to say thanks, this is a really great explanation.
    - walshemj 13y ago
      I worked for a registry a few years ago and the uptime the ICANN mandate are very very tough full redundancy on 4 separate continents.
      - toomuchtodo 13y ago
        Amazon, Google, Dnsmadeeasy, UltraDNS, Cloudflare all do it. I wouldn't say its that tough. Disclaimer: Infrastructure engineer
        walshemj 13y ago
        Well maybe tough isn't the right word certainly expensive and unless your ex Telco and used to that level of redundancy a bit of a shock. And Amazon AWS remind me how many major down time incidents have they had ;-)
        toomuchtodo 13y ago
        > And Amazon AWS remind me how many major down time incidents have they had ;-) Not sure if you were joking or not; I've managed thousands of instances in AWS across the world, and while us-east-1 continues to have issues occasionally, their DNS has been rock solid. Netflix uses them (with some UltraDNS for geolocation-based redirection, which Route53 doesn't support). That's good enough for me.
        lsc 13y ago
        It's way easier to build a reliable DNS cluster than it is to build a reliable UNIX box. Anycast works way better for UDP/dns than it does for TCP/http. The idea behind Anycast is that you announce the address block your DNS cluster is on out many different locations around the world. At each location you have (usually a redundant cluster of) dns servers. The router ahead of the IP of the person looking up an address on your nameserver will check it's bgp table, and then choose whichever location of yours is the fewest hops away. From that router's point of view, this is no different from you having one location with many different service providers. If one of your locations goes away, it stops announcing the block, and all clients that would have gone to it instead use the next closest (hop-wise) location. (this is actually one of the hard parts; if you have a setup where the dns server stops responding correctly but it's still announcing via bgp, you are broken.) You generally don't use this for HTTP and other connection-based stuff, because a route flap is going to move your connection endpoint to an entirely new server. This causes a bunch of problems with your connection oriented stuff. (yes, you can sync connection state across servers... but the latency in that is going to kill you.)

by kijin 13y ago

smcl 13y ago

I'm not massively clued in on this so apologies if this is a bad question, but what's Verisign's role in this? That's a decent amount of cash, what is the service they provide for that?

0x0 13y ago
They run the .com registry and zone, among other TLDs.
lsc 13y ago
I own the domain prgmr.com, and control the associated nameservers. I can make smcl.prgmr.com, and give it to you. I can even point smcl.prgmr.com at your own nameserver so you can make somethingelse.smcl.prgmr.com. You could, in fact, sell other people [something].smcl.prgmr.com. domains, and so on. It's just a line in my dns config. (then dealing with abuse complaints and the like) Now, Verisign owns .com. There's no technical difference, really, between .com, .co.uk, and prgmr.com. If you want smcl.com, you need verisign's dns servers to cooperate, just as if you want smcl.prgmr.com, you need my dns servers to cooperate. For this, verisign charges the registrar seven bucks and change. The registrar tacks on a few pennies (or does the same with advertising) and handles all interactions with you. Verisign has a nice re-seller interface. That's what the registrar/registry split is all about. But if I really thought people would give me money for something.prgmr.com. dns entries, I'm sure I could come up with a re-seller interface, too. Personally, I think the current price is a little high, but mostly because I don't like monopolies in general, and my feelings for Verisign can only be described with superlative synonyms for hatred. Personally, if someone has to have a monopoly on .com domains, I think a not-for-profit like ICANN would do a better job. It is a small injustice, though, for reasonable people with one or two domain names. (On the other hand, the registrars, the people who actually handle the customer interaction, are ridiculously efficient. if you want a domain cheap, you can get it for pennies over what the monopoly charges, or you can pay a few bucks more, and get pretty good service, showing that when there is competition, for-profit businesses can do a pretty good job.)
- mkingston 13y ago
  It hadn't even occurred to me that someone might have considerable control/ownership over large tracts of DNS servers. (Of course they do, I'd just never thought about it!). So anyway, I'd just like to say thanks, this is a really great explanation.
  - walshemj 13y ago
    I worked for a registry a few years ago and the uptime the ICANN mandate are very very tough full redundancy on 4 separate continents.
    - toomuchtodo 13y ago
      Amazon, Google, Dnsmadeeasy, UltraDNS, Cloudflare all do it. I wouldn't say its that tough. Disclaimer: Infrastructure engineer
      - walshemj 13y ago
        Well maybe tough isn't the right word certainly expensive and unless your ex Telco and used to that level of redundancy a bit of a shock. And Amazon AWS remind me how many major down time incidents have they had ;-)
        toomuchtodo 13y ago
        > And Amazon AWS remind me how many major down time incidents have they had ;-) Not sure if you were joking or not; I've managed thousands of instances in AWS across the world, and while us-east-1 continues to have issues occasionally, their DNS has been rock solid. Netflix uses them (with some UltraDNS for geolocation-based redirection, which Route53 doesn't support). That's good enough for me.
        lsc 13y ago
        It's way easier to build a reliable DNS cluster than it is to build a reliable UNIX box. Anycast works way better for UDP/dns than it does for TCP/http. The idea behind Anycast is that you announce the address block your DNS cluster is on out many different locations around the world. At each location you have (usually a redundant cluster of) dns servers. The router ahead of the IP of the person looking up an address on your nameserver will check it's bgp table, and then choose whichever location of yours is the fewest hops away. From that router's point of view, this is no different from you having one location with many different service providers. If one of your locations goes away, it stops announcing the block, and all clients that would have gone to it instead use the next closest (hop-wise) location. (this is actually one of the hard parts; if you have a setup where the dns server stops responding correctly but it's still announcing via bgp, you are broken.) You generally don't use this for HTTP and other connection-based stuff, because a route flap is going to move your connection endpoint to an entirely new server. This causes a bunch of problems with your connection oriented stuff. (yes, you can sync connection state across servers... but the latency in that is going to kill you.)