Subject: IDNA 2008 Question Re: "Confusable" Characters In Domain Names

From: john daw <[email-masked]>
Date: Fri, 22 Oct 2010 11:33:14 +0100

Dear List Members,I am a little unclear what impact the IDNA 2008 policy will have ondomain name registrant's who have a domain that does not fall underthe policy's permissible code-points, particularly symbol-based domainnames.The page http://icann.org/en/topics/idn/fast-track/idna-protocol-2003.txtclearly explains what codes are permissible, but what in practice, will itmean if someone types in e.g. €.com in their browser under IDNA 2008?
Will IDNA 2008 not allow the domain registrant to satisfy a user's queryby forwarding them on to a different domain name?I'm curious to know how such domain names have been disabled, andprevented them from being shown/resolving.I will hope to hear any replies on this matter.Regards,
John Daw

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Fri, 22 Oct 2010 12:43:35 +0200

On Fri, Oct 22, 2010 at 11:33:14AM +0100,
 john daw <[email-masked]> wrote 
 a message of 169 lines which said:

> what impact the IDNA 2008 policy will have

It's actually IDNA 2010 since the RFC were all issued this year. 

> ondomain name registrant's who have a domain that does not fall
> underthe policy's permissible code-points, particularly symbol-based
> domainnames.

Do note they are probably uncommon, at least at the second-level since
most (probably all) of the TLD never allowed them.

> what in practice, will itmean if someone types in e.g. ?.com in
> their browser under IDNA 2008?

Browser policy. But typically, users will be presented with an error
message.

> Will IDNA 2008 not allow the domain registrant to satisfy a user's
> queryby forwarding them on to a different domain name?

Yes, browsers can (not MUST, CAN) perform mapping from what the user
typed to a legal domain name.

<http://www.unicode.org/reports/tr46/> may be an interesting reading
for you.

---

From: Andrew Sullivan <[email-masked]>
Date: Fri, 22 Oct 2010 08:52:39 -0400

On Fri, Oct 22, 2010 at 11:33:14AM +0100, john daw wrote:
> 
> Dear List Members,I am a little unclear what impact the IDNA 2008
> policy will have ondomain name registrant's who have a domain that
> does not fall underthe policy's permissible code-points,

Which "the policy" do you mean?  IDNA2008 isn't about policy, it's
about protocol.  Indeed, the RFCs, if you read them carefully,
explicitly suggest that zone operators (or "registries", but this does
not mean only TLD operators) need to have policies about what
particular code points they will allow.  In my view, the right answer
for most cases is a "default closed" with explicit allowance of
particular characters or ranges that you understand.

> particularly symbol-based domainnames.The page
> http://icann.org/en/topics/idn/fast-track/idna-protocol-2003.txtclearly
> explains what codes are permissible

That is not the table for IDNA2008.  It's for 2003.  The basic
approaches in 2008 and 2003 are different.  I suggest reading RFC5894
for more background.

> itmean if someone types in e.g. €.com in their browser under IDNA
> 2008?  Will IDNA 2008 not allow the domain registrant to satisfy a
> user's queryby forwarding them on to a different domain name?

The euro-currency sign is not a valid character in a U-label, and
therefore that domain is not valid under IDNA2008.  Conforming
implementations are not supposed to do a lookup for that domain.  It
is possible that such a character would be mapped _prior to_ getting
into the IDNA2008 algorithms.  There does not appear to be universal
agreement about how to map these things.  In that case in particular,
I don't know what you'd map it to.

> I'm
> curious to know how such domain names have been disabled,
> andprevented them from being shown/resolving.

The mechanism for this is outlined in the IDNA2008 documents, RFCs
5890, 5891, 5892, and 5893.  I suggest reading 5894 too if you want to
understand.

Note that none of this has much to do with your subject line, as
near as I can tell.  There is no effort in IDNA2008 to prevent
"confusable" characters in domain names.  That's not even a goal
consistent, at the protocol level, with expanding the available
character repertoire, though you could address many issues with good
policy for zone operation.

A

-- 
Andrew Sullivan
[email-masked]
Shinkuro, Inc.