“If you asked me years ago, I would have said we probably need to be ready in ten years,” John Crain, ICANN’s chief technology officer, told The Register. “Now, maybe it's less than that. I don't know if it's three years or five, but it's probably not ten.”
John Crain on an accelerating quantum threat to DNSSEC
Crain said he is aware of predictions that commercially viable quantum computers capable of easily deciphering encrypted information could appear “at the turn of the decade.” That changed his calculus: what once looked like a ten-year problem for the Domain Name System (DNS) and DNSSEC is now compressed into a much shorter window. Crain told attendees at ICANN’s annual meeting in Bali that the internet governance community will “ramp up the speed of development” to respond.
DNSSEC, larger keys, and DNS message-size constraints
One straightforward mitigation to resist quantum decryption is using larger cryptographic keys for DNSSEC. But larger keys increase zone size and response packet size, and risk pushing DNS traffic out of the single-UDP-packet model into multi-packet TCP sessions. As Crain put it, “If we go for larger key sizes, that means larger zones, larger packets, larger responses.” That expansion runs directly into existing DNS message-size limits and the operational preference for single UDP messages.
Your scanner finds 4,000 vulns. Which 12 matter?
Nubivance is a Rapid7 Registered Partner delivering vulnerability management as a service - scanning, risk-based prioritization, and remediation follow-through across IT and OT.
Fix the backlogICANN, the IETF and the prospect of shifting from UDP to TCP
ICANN, the IETF, and other internet governance bodies are already aware of the trade-offs and have begun preliminary work. Crain warned that “being prepared to go from UDP to TCP is going to take a few years,” and that deployment in a predictable manner is still “probably a few years away.” Those timelines, he said, are why planning and standards work must accelerate now.
Number Resource Organization and ICP‑2: new rules for registries
At the same conference The Register spoke with Jia-Rong Low, chair of the Number Resource Organization (NRO), the umbrella for the five regional internet registries (AFRINIC, APNIC, ARIN, LACNIC, and RIPE NCC). Low described an effort to revise Internet Coordination Policy 2 (ICP‑2), which previously described only the formation of a new RIR. The revised ICP‑2 expands coverage to the entire lifecycle of an RIR, adding three new stages—audit, emergency continuity operations, and derecognition—so ICANN has a defined role as an independent overseer. Work has gone through several public consultation rounds and currently holds the status of a recommended draft. Low said the document has been “very challenging” to produce remotely and that the Bali meeting has enabled in-person collaboration; he is hopeful the final document will be ready for review by the end of 2026 and ready for implementation not long afterwards.
Category 1 GTLDs, abuse findings, and registrar policy work
ICANN principal security scientist Siôn Lloyd reported analysis showing that Category 1 global top-level domains (GTLDs)—those tied to regulated sectors such as .bank, .doctor and .university or those needing extra safeguards—have a 45 percent higher chance of being targeted by DNS abusers than other domains, though they tend to have lower volumes of high-abuse domains. ICANN is advancing policy work in parallel: PDP1 would require registrars to take extra action against owners of domains that facilitate abuse, and PDP2 would regulate automated domain registration. Conference discussions also reflected momentum around a new GTLD application round that “seems to be progressing well,” with some suggesting this round could serve as a template for more frequent, predictable application cadences.
What this means for technologists, registries, and registrars
- Technologists and security teams: face a near-term engineering task—assessing the operational impact of larger DNSSEC keys and the practicalities of moving parts of DNS traffic from UDP to TCP, a migration Crain warns will "take a few years."
- Registries and the NRO: must prepare for tighter oversight and lifecycle controls under the revised ICP‑2, which introduces audit, emergency continuity operations, and derecognition as formal stages and seeks review by the end of 2026.
- Registrars and policy implementers: will need to prepare for new obligations if PDP1 and PDP2 are adopted—extra actions against abusive domain owners and rules on automated registrations—while the GTLD application cadence discussion may change planning for future top-level domains.
The record from Bali is straightforward: technical limits and governance processes are converging on a compressed timetable. The community knows the trade-offs—larger keys versus packet size, UDP versus TCP, and the governance burden of tighter registry oversight—and, by many accounts at the meeting, is moving faster to resolve them. Whether those efforts will yield a predictable, deployable plan within the shorter window Crain now anticipates remains the central question as 2026 draws toward its close.