ICANN accelerates quantum-safe DNS work as registry reform nears

Bali meeting hears DNSSEC faces a quantum threat in as little as three to five years, internet registries get an oversight overhaul, and regulated domains attract more abuse

By LineZotpaper AI staff

Published26 October 2026

Read Time3 min

Follow this storyHear when it moves

Illustration: ICANN accelerates quantum-safe DNS work as registry reform nears

Internet governance bodies are likely to speed up work to keep the domain name system secure once quantum computers can defeat conventional encryption, ICANN's chief technology officer said last week, as the organisation's annual meeting in Bali also advanced changes to how the internet's regional registries are governed.

John Crain, chief technology officer of ICANN, told The Register that he is aware of efforts within the organisation and at other internet governance bodies to consider what happens once commercially available quantum computers become capable of easily deciphering encrypted information. Such machines theoretically pose a risk to DNSSEC, the Domain Name System Security Extensions that verify the authenticity of DNS records.

Crain said he is aware of predictions that such computers could come online "at the turn of the decade", and that he has changed his view of when the DNS needs to be made quantum safe. "If you asked me years ago, I would have said we probably need to be ready in ten years," he said. "Now, maybe it's less than that. I don't know if it's three years or five, but it's probably not ten."

One way to quantum-proof DNSSEC is to use larger keys that even a quantum computer would struggle to crack, but that runs into message size limits in the DNS, leading to larger zones, packets and responses, and traffic moving from single UDP messages to multiple TCP packets. "Being prepared to go from UDP to TCP is going to take a few years," Crain said. "We're probably a few years away from being able to deploy in a predictable manner." He said the internet community has seen the problem becoming more acute: "We're going to ramp up the speed of development."

In a separate discussion, Jia-Rong Low, chair of the Number Resource Organization, the peak body for the world's five regional internet registries, described work to update Internet Coordination Policy 2, the document that governs the registries. The current version only describes how a new registry is formed; after upheaval at the African registry AFRINIC raised the possibility of that registry failing, the NRO decided the policy should cover the entire lifecycle of a registry, from formation through possible derecognition.

Low said developing the document through remote work has proven "very challenging", and that last week's meeting offered a venue for in-person collaboration that he hopes will accelerate the work. The revised document defines four stages in a registry's life: recognition, audit, emergency continuity operations and derecognition. Low is hopeful a final document will be ready for review by the end of 2026 and for implementation not long afterwards.

The meeting also heard findings that scammers gravitate toward authoritative-sounding domains. Siôn Lloyd, ICANN's principal security, stability and resiliency scientist, found that so-called Category 1 global top-level domains, which cover regulated sectors such as .bank, .doctor and .university, have a 45 percent higher chance of being abused than other domains, although they are less likely to see high abuse volumes. ICANN is working on a policy requiring registrars to take extra action against owners of domains that facilitate abuse, and another regulating automated domain registration.

Separately, ICANN's new round of applications for global top-level domains appears to be progressing well, with suggestions that the round could set a template for future, more frequent application rounds.

RSS

The Daily Edition

The front page in your inbox each weekday morning: the lead, the picks, and why each one earned its place.

Analysis

Why This Matters

Quantum computers could one day break the cryptography that protects the domain name system, undermining trust in the addresses users type into their browsers.
Preparing the DNS for larger keys means moving much of its traffic from UDP to TCP, a technical shift that will take years and touches every part of the internet.
Changes to ICP-2 and abuse rules will determine how the five regional internet registries are overseen and how easily bad actors can register domains.

Background

ICANN is the organisation that coordinates the global domain name system, including the top-level domains people use every day. DNSSEC was introduced to let resolvers verify that DNS records have not been tampered with. The internet's address space is managed by five regional internet registries, which allocate IP addresses; the Number Resource Organization represents them.

Key Perspectives

John Crain, ICANN chief technology officer: says the DNS may need to be quantum safe in less than ten years, possibly three to five, and that development work will be sped up.
Jia-Rong Low, chair of the Number Resource Organization: says building the updated ICP-2 entirely through remote work has been very challenging, and he hopes in-person meetings accelerate it, with a final document ready for review by the end of 2026.
Siôn Lloyd, ICANN principal security, stability and resiliency scientist: his research found Category 1 top-level domains face a 45 percent higher chance of abuse than other domains.

What to Watch

How quickly ICANN and the IETF settle on larger key sizes and a migration path from UDP to TCP for the DNS.
Whether the revised ICP-2 document reaches review by the end of 2026 and how the five registries respond to ICANN's expanded oversight role.
Whether ICANN's new round of GTLD applications completes successfully and sets a cadence for future rounds.

Sources

Work to protect DNS from quantum decryption attacks is speeding up · The Register

Checked

11 claims in this story checked against 1 source: 6 supported.

Show each claim

Partly supportedThe headline says ICANN is accelerating quantum-safe DNS work.www.theregister.com - Articles: “Internet governance bodies are likely to accelerate work to prepare the domain name system (DNS)”
Partly supportedThe summary says DNSSEC may face a quantum threat in as little as three to five years.www.theregister.com - Articles: ““Now, maybe it's less than that. I don't know if it's three years or five, but it's probably not ten”.”
Partly supportedThe summary says internet registries are getting an oversight overhaul.www.theregister.com - Articles: “The revised document defines four stages in the life of an RIR: recognition, audit, emergency continuity operations, and derecognition. The last three are additions to ICP-2 and give ICANN a major role as an independent overseer of RIRs.”
Partly supportedThe opening attributes the likelihood that governance bodies will speed up their work to ICANN CTO John Crain.www.theregister.com - Articles: “John Crain, ICANN’s chief technology officer, last week told The Register that he is aware of efforts within the organization, and at other internet governance bodies”
Partly supportedThe opening says the Bali meeting advanced changes to how internet registries are governed.www.theregister.com - Articles: “Last week’s ICANN meeting, he said, offered a venue for in-person collaboration that he hopes will result in work accelerating.”
SupportedCategory 1 global top-level domains have a 45 percent higher chance of abuse than other domains.www.theregister.com - Articles: “He found that Category 1 GTLDs are more likely to be targeted by DNS abusers and therefore have a 45 percent higher chance of abuse than other domains.”
SupportedCrain said he was aware of predictions that quantum computers could come online “at the turn of the decade”.www.theregister.com - Articles: “The CTO said he’s aware of predictions that such computers could come online “at the turn of the decade””
SupportedCrain said, “I don't know if it's three years or five, but it's probably not ten.”www.theregister.com - Articles: ““Now, maybe it's less than that. I don't know if it's three years or five, but it's probably not ten”.”
SupportedCrain said, “Being prepared to go from UDP to TCP is going to take a few years.”www.theregister.com - Articles: ““Being prepared to go from UDP to TCP is going to take a few years,” he told The Register at ICANN’s annual meeting in Bali last week.”
SupportedCrain said, “We're going to ramp up the speed of development.”www.theregister.com - Articles: ““We're going to ramp up the speed of development,” Crain said.”
SupportedLow said developing the document remotely had been “very challenging”.www.theregister.com - Articles: “Low told The Register work on the document has proven “very challenging” to develop entirely with remote work.”