How DNS Works

While most of this topic doesn't require much technical knowledge, there is one technical part of DNS you should understand in order to grasp the political issues.

(If you want an even less technical description try DNS as Postcards.)

When you type a name, like "eff.org" into an internet program, it needs to find a way to map that to the internal routing number the internet really uses to reach the EFF computers. We at the EFF want you to be able to reach us using that name, too.

To do that, your computer uses DNS like a database. DNS translates from a name like "eff.org" into a raw number called an IP address. All internet traffic requires these numbers to work. Some computers do your DNS directly, but with most personal computers, your PC asks another computer at your ISP or corporation to do the work. The important point is that the looking up of the name is normally done by a computer you or your site controls, or one you pay to do such work for you.

That computer has a list that was installed in it by the people who run it. In almost all cases, that list just came with the DNS software, because everybody in the world uses a similar list. It's a list of what are known as the "root" servers of DNS. These are the master servers that can help you look up (resolve) any name you want to ask about.

There are about a score of these root servers around the world, and they all copy their own data from one master server, which is under the control of ICANN. Each one has the same data inside. The root servers don't actually contain much. They mostly list where you will find the servers that can look up names in the "top level domains" like .com, .org, .us, .uk etc.

Once the root server tells your system where the master ".org" server is, your system asks it where "eff.org" is. In particular, it gets back the raw internet IP address, the low level "phone number" of the internet. With that answer, your computer can talk directly to the computers at eff.org

(Quite often this is more efficient than it sounds because all the computers along the path remember the answers to questions they have asked recently, and don't need to ask them again.)

The important thing to know from all this is that while ICANN controls the master root server, and the other root servers are copies (mirrors) of it, and almost everybody uses the same list of root servers, there is no law that makes this so. A few people can, and do, use other lists of root servers.

In theory, if enough people got upset at ICANN and the root servers, they could switch to another set, and that other set could look up names for you any other way you might choose.

In practice, such a switch would be very hard to do, especially a switch that changed who the master for ".com" was from Network Solutions to come other company. If people switched, some people might get a different answer for whoever.com than others do. You couldn't hand out a domain name on your business card and expect it to work reliably for all the people you give it to.

So while there is no actual legal power in ICANN, there is a natural monopoly for the "root" (master) of the domain system, because if everybody doesn't use the same list, we lose some valuable features.

IP routing and root servers

It is worth noting that domain lookups go to and from the root servers because the main routers of the interent's ISPs and backbones have tables telling them where to find those servers. It would also be possible to change where the root servers are simply by having the relatively small group of people who control who can change routing tables set up new routes, so that those queries go to new servers.

This would be a controversial move, but it could happen overnight. It is, however, better if all ISPs worked together.