Verisign

Verisign was founded in 1995 as a spin-off of the RSA Security certification services business. The new company received licenses to key cryptographic patents held by RSA (which expired in 2000) and a time-limited non-compete agreement. The new company served as a certificate authority (CA), with an initial mission to provide digital authentication services for internet commerce. Before selling its certificate business to Symantec in 2010, Verisign managed more than 3 million certificates across military, financial, and retail sectors, making it the largest CA globally.

In 2000, Verisign acquired Network Solutions for $21 billion, which operated the.com,.net and.org TLDs under agreements with the Internet Corporation for Assigned Names and Numbers (ICANN) and the United States Department of Commerce. Those core registry functions formed the basis for Verisign's naming division, which by then had become the company's largest and most significant business unit. In 2002, Verisign was charged with violation of the Securities Exchange Act. Verisign divested the Network Solutions retail (domain name registrar) business in 2003 for $100 million, retaining the domain name registry (wholesale) function as its core Internet addressing business.

For the year ending December 31, 2010, Verisign reported revenue of $681 million, a 10% increase from $616 million in 2009. Verisign operates two businesses, Naming Services, which encompasses the operation of top-level domains and critical Internet infrastructure, and Network Intelligence and Availability (NIA) Services, which encompasses DDoS mitigation, managed DNS and threat intelligence.

On August 9, 2010, Symantec completed a $1.28 billion acquisition of Verisign's authentication business. This sale included Secure Sockets Layer (SSL) Certificate Services, Public Key Infrastructure (PKI) Services, Verisign Trust Services, Verisign Identity Protection (VIP) Authentication Service, and a majority stake in Verisign Japan. The deal capped a multi-year effort by Verisign to narrow its focus to its core infrastructure and security business units. Following controversies regarding certificate validation practices, which led to Google untrusting Symantec-issued certificates in its Chrome web browser, Symantec sold the unit to DigiCert in 2017 for $950 Million.

On 14 December 2021, the Ministry of Justice, Communication and Foreign Affairs of the Tuvalu Government announced on Facebook that they have selected GoDaddy Registry as the new registry service provider for the domain after Verisign did not participate in the renewal process.

In 2011, Verisign was selected by the General Services Administration (GSA) to operate the registry services for the.gov top-level domain. They continued to operate.gov service until 2023, when Cybersecurity and Infrastructure Security Agency (CISA) chose Cloudflare to replace Verisign as the.gov operator.

Verisign's share price tumbled in early 2014, hastened by the U.S. government's announcement that it would "relinquish oversight of the Internet's domain-naming system to a non-government entity". Ultimately ICANN chose to continue VeriSign's role as the root zone maintainer and the two entered into a new contract in 2016.

Verisign's core business is its naming services division. The division operates the authoritative domain name registries for two of the Internet's most important top-level domains,.com and.net, and.name. It is the primary technical subcontractor for the.edu and.jobs top-level domains for their respective registry operators, which are non-profit organizations; in this role Verisign maintains the zone files for these particular domains and hosts the domains from their domain servers. In addition, Verisign is also the contracted registry operator for the country code top-level domain.cc (Cocos Islands). Registry operators are the "wholesalers" of Internet domain names, while domain name registrars act as the “retailers”, working directly with consumers to register a domain name address. It formerly was the contracted registry for.gov top-level domains as well as for the country code top-level domain.tv (Tuvalu).

Verisign also operates two of the Internet's thirteen "root servers" which are identified by the letters A-M (Verisign operates the “A” and “J” root servers). The root servers form the top of the hierarchical Domain Name System that supports most modern Internet communication. Verisign also generates the globally recognized root zone file and is also responsible for processing changes to that file once they are ordered by ICANN via IANA and approved by the U.S. Department of Commerce. Changes to the root zone were originally distributed via the A root server, but now they are distributed to all thirteen servers via a separate distribution system which Verisign maintains. Verisign is the only one of the 12 root server operators to operate more than one of the thirteen root nameservers. The A and J root servers are "anycasted” and are no longer operated from any of the company's own datacenters as a means to increase redundancy and availability and mitigate the threat of a single point of failure. In 2016, the Department of Commerce ended its role in managing the Internet's DNS and transferred full control to ICANN. While this initially negatively impacted VeriSign's stock, ICANN eventually chose to contract with Verisign to continue its role as the root zone maintainer.

VeriSign's naming services division dates back to 1993 when Network Solutions was awarded a contract by the National Science Foundation to manage and operate the civilian side of the Internet's domain name registrations. Network Solutions was the sole registrar for all of the Internet's non-governmental generic top-level domains until 1998 when ICANN was established and the new system of competitive registrars was implemented. As a result of these new policies, Network Solutions divided itself into two divisions. The NSI Registry division was established to manage the authoritative registries that the company would still operate, and was separated from the customer-facing registrar business that would have to compete with other registrars. The divisions were even geographically split with the NSI Registry moving from the corporate headquarters in Herndon, Virginia, to nearby Dulles, Virginia. In 2000, VeriSign purchased Network Solutions taking over its role in the Internet's DNS. The NSI Registry division eventually became VeriSign's naming services division while the remainder of Network Solutions was later sold by Verisign in 2003 to Pivotal Equity Group.

Controversies

2001: Code signing certificate mistake

In January 2001, Verisign mistakenly issued two Class 3 code signing certificates to an individual claiming to be an employee of Microsoft. The mistake was not discovered and the certificates were not revoked until two weeks later during a routine audit. Because Verisign code-signing certificates do not specify a Certificate Revocation List Distribution Point, there was no way for them to be automatically detected as having been revoked, placing Microsoft's customers at risk. Microsoft had to later release a special security patch in order to revoke the certificates and mark them as being fraudulent.

2002: Domain transfer lawsuit

In 2002, Verisign was sued for domain slamming – transferring domains from other registrars to themselves by making the registrants believe they were merely renewing their domain name. Although they were found not to have broken the law, they were barred from suggesting that a domain was about to expire or claim that a transfer was actually a renewal.

2003: Site Finder legal case

In September 2003, Verisign introduced a service called Site Finder, which redirected Web browsers to a search service when users attempted to go to non-existent.com or.net domain names. ICANN asserted that Verisign had overstepped the terms of its contract with the U.S. Department of Commerce, which in essence grants Verisign the right to operate the DNS for.com and.net, and Verisign shut down the service. Subsequently, Verisign filed a lawsuit against ICANN in February 2004, seeking to gain clarity over what services it could offer in the context of its contract with ICANN. The claim was moved from federal to California state court in August 2004. In late 2005, Verisign and ICANN announced a proposed settlement which defined a process for the introduction of new registry services in the.com registry. The documents concerning these settlements are available at ICANN.org. The ICANN comments mailing list archive documents some of the criticisms that have been raised regarding the settlement.

2003: Gives up.org domain

In keeping with ICANN's charter to introduce competition to the domain name marketplace, Verisign agreed to give up its operation of.org top-level domain in 2003 in exchange for a continuation of its contract to operate.com, which, at the time had more than 34 million registered addresses.

2005: Retains.net domain

In mid-2005, the existing contract for the operation of.net expired and five companies, including Verisign, bid for management of it. Verisign enlisted numerous IT and telecom heavyweights including Microsoft, IBM, Sun Microsystems, MCI, and others, to assert that Verisign had a perfect record operating.net. They proposed Verisign continue to manage the.net DNS due to its critical importance as the domain underlying numerous "backbone" network services. Verisign was also aided by the fact that several of the other bidders were based outside the United States, which raised concerns in national security circles. On June 8, 2005, ICANN announced that Verisign had been approved to operate.net until 2011. More information on the.net bidding process is available at ICANN. On July 1, 2011, ICANN announced that VeriSign's approval to operate.net was extended another six years, until 2017.

2010: Data breach and disclosure controversy

In February 2012, Verisign revealed that their network security had been repeatedly breached in 2010. Verisign stated that the breach did not impact the Domain Name System (DNS) that they maintain, but would not provide details about the loss of data. Verisign was widely criticized for not disclosing the breach earlier and apparently attempting to hide the news in an October 2011 SEC filing.