Decentralized DNS Monday — August 10 2026 Weekly Update

TL;DR — This Week

• ENS "Next Era" Executive Proposal PASSED (Aug 9): The on-chain executable proposal to empower the ENS Foundation passed with 1.27M ENS For vs 480.69K Against (quorum 1.33M of 1M). The scope was narrowed from the June 19 temp check: the DAO keeps its 54.6M ENS tokens and operational wallet ($16M); the Foundation gets administrative control of the ~$65M Endowment plus 1M ENS for employee compensation with multi-year vesting. Five-seat board: Nick Johnson (permanent), Alexander Urbelis (Executive Director), Kartik Talwar, Brett Sun, Anthony Leutenegger. Protocol governance stays with tokenholders. This is the most significant governance event in ENS history.
• ICANN 2026 gTLD Window Closes August 12: The first gTLD application round in over a decade closes at 23:59 UTC August 12. ENS applied for .ens as a brand TLD; Unstoppable Domains is supporting 19+ organizations and applying for .privacy, .twin, .hub, .agi, .brave, .robot, .anime and more. Evaluation fee: $227,000 per application. Earliest delegation: 2028. Namespace collision risk remains for blockchain-claimed strings.
• PKARR v8.0.0 Released (Aug 6): Major release — decouples public API from Mainline DHT internals, upgrades mainline to v8, gates relay testnet support behind explicit configuration, upgrades simple-dns to 0.12. Breaking changes for relay operators and downstream consumers.
• pubky-core → pubky-homeserver Rename + v0.10.0 Stable (Aug 5): The monorepo was renamed from pubky-core to pubky-homeserver to reflect its primary deliverable. v0.10.0 ships grant-based auth, signup deeplink authentication, strict capabilities, private data storage (/priv — ALPHA), Docker build pipeline, and path-addressed storage reads. Pkarr upgraded to v8, relay to v2.
• Pubky App Active Development: 10+ commits this week — collections reordering, media carousel fixes, quick reply UI, onboarding flow improvements. Pubky Ring (mobile key manager) gets direct signup deeplinks and design v12. The social layer atop PKARR is the most actively developed P2P naming ecosystem.
• GNUnet 0.28.0 Confirmed (Jul 17): Second major GNUnet release of 2026. GNS continues as the strongest lookup-privacy naming system. No new GNS-specific developments this week.
• Namecoin Active Sync: namecoin-core received Bitcoin upstream merges through Aug 3 (AuxPoW branch sync with Bitcoin Core 28.x). Still the longest-running blockchain DNS (15 years).
• ICANN Root KSK Rollover Countdown: October 11, 2026 — KSK-2024 becomes the sole root signing key. ICANN published detailed preparation blog (Jul 27) and "What to Expect" PDF. Operators of self-sovereign resolvers must verify DNSSEC compatibility.

Detailed Developments

1. ENS — "Next Era" Foundation Proposal Passes

The most significant governance event in ENS history concluded on August 9, 2026.

Timeline

Final Vote Results

What Was Approved (Narrowed Scope)

The executable proposal was significantly scaled back from the June 19 temp check after community criticism (led by the original constitution author and others) about treasury concentration:

• Foundation becomes operating entity: Five-seat board with full-time Executive Director, authorized to administer the Endowment (~$65M managed by Karpatkey).
• 1M ENS allocation: One-time transfer to the Foundation for employee compensation, multi-year vesting. This is the only ENS token transaction in the proposal.
• DAO retains: Operational wallet (wallet.ensdao.eth, ~$16M in ETH and stablecoins) and ~54.6M ENS tokens remain under tokenholder control via existing on-chain mechanisms.
• Protocol governance stays with tokenholders: Contract upgrades, registry, fees, constitution changes — all remain DAO-governed.

What Was Removed (vs. June Temp Check)

The temp check proposed delegating management of the DAO operational wallet, ENS token holdings, and Endowment to the Foundation. The executable version: - Keeps the operational wallet with the DAO (existing streams continue). - Keeps DAO-held ENS tokens under tokenholder control (minus the 1M transfer). - Only the Endowment moves to Foundation administration.

Board Composition

Independent directors compensated at 40,000 USDC/year. Tokenholders retain removal authority — a power web2 foundation boards lack.

Freedom-Tech Analysis

The "Next Era" marks ENS's definitive transition from DAO-driven experiment to institutional-grade infrastructure. The Mozilla/Signal/Linux Foundation model is explicitly cited. This is a double-edged sword for sovereignty:

• Positive: Professionalized operations, legal entity for partnerships (ICANN, governments), sustainable funding for development. ENS as infrastructure is more robust.
• Negative: Concentration of operational authority in five people (two from ENS Labs). The $65M Endowment under Foundation control is significant. While tokenholders retain protocol governance, the day-to-day reality of a Foundation-run organization is different from a DAO-run one.
• Context: ENS's market cap (~$169-191M circulating) is less than half its treasury (~$400M+). This gap has fueled the governance debate — the treasury is the elephant in the room.

The integrationist path continues: ENS works within ICANN rather than against it. The .ens gTLD application is the practical expression of this strategy.

• Links: Tally proposal page | The Defiant coverage | EtherWorld analysis | Crypto Briefing (governance crisis perspective) | WEEX (scaled-back plan) | Coingabbar (1M ENS allocation) | See ENS

2. ICANN 2026 gTLD Window — Final Days

The application submission period closes August 12, 2026 at 23:59 UTC. After this, no new gTLD applications until the next round (timeline TBD — likely 2030+).

Key Applicants

ENS: Applied for .ens as a .brand TLD — closed to public registrations initially, potential open TLD transition later. Strategic pivot: ENS works within ICANN. Application fee: $227,000. Earliest delegation: 2028.

Unstoppable Domains: Acting as broker and co-applicant, supporting 19+ organizations. Confirmed applications include: - .privacy (with Women in Web3 Privacy, Secret Network, FLUIDEFI) - .twin (digital twins infrastructure) - .hub (with Hub Culture) - .agi, .brave, .robot, .anime, and more

UD published refund pages for TLDs not pursuing the ICANN round (.altimist, .ask, .ltc, .onchain, .pengu, .quantum, etc.). Six TLDs (.u, .hi, .x, .go, .888, .og) designated Web3-only with no refunds.

Timeline

Namespace Collision Risk

ICANN may delegate strings (.wallet, .crypto, .nft) that blockchain registries already sold as Web3-only domains. Holders of affected blockchain domains face resolution risk — their "domain" may collide with an ICANN-delegated TLD they don't control. This validates key-rooted approaches (PKARR, Tor .onion) that don't claim TLD strings.

• Links: ICANN 2026 Round page | ICANN reminder (Jul 13) | CentralNic timeline | ICANNWiki 2026 Round | See Unstoppable Domains

3. PKARR v8.0.0 — DHT Decoupling

The core PKARR library shipped a major version on August 6, 2026.

Breaking Changes

1. DHT API decoupled from Mainline: refactor(dht)!: decouple public API from mainline (PR #287). The public PKARR API no longer directly exposes Mainline DHT internals — a DhtClient abstraction layer now sits between them. This improves API stability when the underlying mainline crate changes.
2. mainline upgraded to v8 (PR #285): Bumps the underlying DHT library. The DHT protocol itself (BEP44) is unchanged — records remain compatible.
3. Relay testnet support gated behind explicit configuration (PR #287): Relay operators must now opt-in to testnet support. This prevents accidental testnet traffic on production relays.
4. simple-dns upgraded to 0.12: DNS record parsing library updated. Downstream consumers may need to adjust record construction.

What Didn't Change

• Ed25519 signing and BEP44 mutable items remain the same.
• DNS packet format unchanged (1000-byte limit persists).
• Mainline DHT network (~10M nodes) unchanged.
• Records remain backward-compatible with v7/v6 resolvers.

Release Cadence

v7 → v8 in three weeks indicates rapid iteration on the relay and DHT layer. The resolve-policy system (CacheOnly, CacheFirst, NetworkOnly) introduced in v7 is now the standard resolution interface.

Significance

PKARR is maturing from an experimental library into infrastructure. The API decoupling means downstream consumers (Pubky, Iroh, pkdns) can upgrade the DHT layer without breaking their own APIs. The relay rate-limiting improvements (HTTP, inbound DHT, and user-triggered DHT quotas split in v7) position PKARR relays for production load.

• Links: pkarr v8.0.0 release notes | PR #287 (DHT decoupling) | PKARR GitHub | See PKARR

4. pubky-core → pubky-homeserver Rename + v0.10.0 Stable

The Pubky monorepo underwent a significant rename and shipped its first stable v0.10 release.

Rename: pubky-core → pubky-homeserver

On August 6, commit aa39c09 renamed all pubky-core links across the repository. The GitHub org redirect is active (github.com/pubky/pubky-core → github.com/pubky/pubky-homeserver). The rename reflects that the monorepo's primary deliverable is the Homeserver binary; the SDK, common types, and testnet are supporting components.

Repository structure: | Path | Purpose | |------|---------| | pubky-homeserver | Homeserver binary and library crate | | pubky-sdk | Rust client for Pubky apps, plus JS/WASM bindings | | pubky-common | Shared types and helpers | | pubky-testnet | Testing infrastructure |

v0.10.0 (August 5, 2026) — Key Changes

ALPHA: Private Data Storage (/priv): The Homeserver now provides a way to store private data accessible only to the user. This feature is under active development and explicitly marked "NOT for production use." Private data APIs may change or disappear. This is the first step toward end-to-end encrypted private storage on the Pubky stack.

Breaking Changes: - Grant-based authentication (PR #373): New auth flow replacing older cookie-based mechanisms. GrantManager extracted from session management (PR #412). - Deeplink refactor (PR #392): Updated URI scheme for app-to-app auth handoff. - startAuthFlow → startCookieAuthFlow (PR #460): API renamed for clarity. - Signup deeplink authentication (PR #482): New deeplink-based signup flow. - Strict capabilities and shared storage paths (PR #514): Tighter authorization model. - Error surfacing on get_homeserver_of (PR #477): Previously silent failures now propagate.

New Features: - Docker build pipeline (PR #416) — simplifies self-hosting. - List signup tokens endpoint (PR #420). - Path-addressed storage reads (PR #536). - OpenAPI YAML specification (PR #406) — formal API documentation. - Private events filtering from events endpoint (PR #454). - Migration guide for /priv events stream (PR #539).

Dependencies Updated: - Pkarr upgraded to v8 (PR #542). - Relay upgraded to v2 (PR #542).

Pubky Ecosystem Activity (Aug 3–10)

The Pubky ecosystem is the most actively developed P2P naming stack. The social app (pubky-app) receives daily commits — this is the only decentralized naming project with a consumer-facing application under active daily development.

• Links: pubky-homeserver v0.10.0 release | Migration guide | Pubky.org | Pubky FAQ | See PKARR

5. Handshake — Maintenance Mode Continues

No new Handshake developments this week. The network continues post-halving (block reward: 1000 HNS/block since Jul 22). HSD (full node) last pushed August 2025. hnsd (SPV resolver) last pushed March 2026. Namecoin-core continues to receive Bitcoin upstream merges (the Handshake codebase shares Bitcoin Core ancestry).

HNS token remains near all-time lows. CoinDataFlow forecasts ~$0.001443 by Aug 15 (−9.26% from current). No fundamental catalyst identified. The community continues migrating to BobWallet (self-custodial) and ShakeDex (decentralized marketplace) after Namebase's shutdown.

The HandyCon 2026 thread on NamePros indicates continued community engagement at the domain investor level, but infrastructure-level development remains minimal.

Freedom-Tech Assessment (unchanged from last week): Handshake's architecture remains sound. Adoption and infrastructure are the barriers. Post-halving supply reduction creates a deflationary dynamic for patient operators, but the browser integration wall remains insurmountable without a major platform partner.

• Links: CoinGecko HNS | Handshake.org | HSD GitHub | hnsd GitHub | NamePros HandyCon 2026 | See Handshake

6. Namecoin — Active Upstream Sync

Namecoin Core continues merging Bitcoin upstream changes into its AuxPoW branch. Commits through August 3 include:

• Merge bitcoin-core/gui#872: Menu action to export a watchonly wallet.
• Merge bitcoin/bitcoin#35869: Re-add contrib/guix for Python linting.
• Merge bitcoin/bitcoin#35860: Fuzz target RPC rework.

These are routine upstream syncs — Namecoin tracks Bitcoin Core 28.0 and applies its merged-mining (AuxPoW) layer on top. No Namecoin-specific features this week.

Why this matters: Namecoin's 15-year longevity is partly because it's a thin layer on Bitcoin Core. Every Bitcoin Core improvement (security fixes, performance, wallet features) flows to Namecoin for free. The .bit ecosystem (ncp11 + ncdns + ncgencert) remains the path to stock-browser HTTPS on a blockchain domain.

• Links: namecoin-core GitHub | Namecoin.org | See Namecoin

7. ICANN Root KSK Rollover — October 11 Preparation

ICANN continues its preparation campaign for the October 11, 2026 root zone KSK rollover. Key resources published:

• Blog post (Jul 27): "Preparing for the Root Zone KSK Rollover: What You Need to Know" — historical context (2010 signing, 2018 first rollover), KSK-2024 adoption data (>95% of validating resolvers ready), and critical steps for administrators.
• "What to Expect" PDF (Jul 27): Detailed technical document covering which users may be affected (small percentage), what root server operators will see, and the phased timeline.
• CircleID analysis: 2024-2026 rollover shows "very similar trends" to the 2017-2018 rollover. Both show >95% adoption of the incoming key after ~500 days of pre-publication.

Timeline

What Happens If You're Not Ready

DNSSEC-validating resolvers without KSK-2024 in their trust anchor set will experience total DNS resolution failure — cutting off internet access for users behind those resolvers. This affects operators of self-sovereign infrastructure (pkdns, GNS proxies, custom unbound/knot instances).

Algorithm Rollover Proposal (Separate Track)

ICANN also published a "Proposed Root KSK Algorithm Rollover" for public comment (Feb 3, 2026). The root zone has used RSA/SHA-256 since 2010. This proposal establishes a process for eventually transitioning to a different signing algorithm (potentially post-quantum). This is a long-term track, not the October 2026 event.

• Links: ICANN KSK blog (Jul 27) | What to Expect PDF | CircleID analysis | Algorithm Rollover Proposal | Security Brief coverage

8. DNS-AID — Naming for the Agentic Web (Continuing)

No new DNS-AID developments this week, but the standardization effort remains active and critical for the freedom-tech community to monitor.

Current Status: - IETF Internet-Draft: draft-mozleywilliams-dnsop-dnsaid-01 (March 2026, expires September 2026). - Linux Foundation project (launched May 27, 2026) with Python SDK, CLI, and MCP server reference implementation. - Backers: Cloudflare, GoDaddy, Equinix, Infoblox, ISC, CSC, Indeed, WWT. - Academic foundation: arXiv 2606.02314. - Companion: Agent Name Service (ANS) for verification.

Freedom-Tech Gap: DNS-AID defines how AI agents discover each other using existing DNS infrastructure. If this becomes the standard, agent identity is anchored to DNS — meaning ICANN, CAs, and registrars remain choke points. PKARR-based agent discovery (self-sovereign, DHT-resolved, no DNS dependency) is technically viable but absent from the standardization conversation. The IETF DAWN working list is the venue for engagement.

• Links: Linux Foundation announcement | IETF draft | GoDaddy/Infoblox press release | arXiv 2606.02314

Evidence at a Glance

Freedom-Tech Takeaways & Recommendations

1. ENS Has Chosen Its Path: With the "Next Era" proposal passed, ENS is now definitively an institution — Foundation-operated, ICANN-engaged, governance-professionalized. This is not a sovereignty project anymore. It's infrastructure with institutional backing. For public-facing identity that needs mainstream recognition (wallets, dApps, institutional use), ENS remains the best option. For seizure-proof pseudonymous naming, look elsewhere (PKARR, GNS, Tor).

2. PKARR Is the Only Stack with Consumer-Momentum: pubky-app receives daily commits. No other decentralized naming project has a consumer-facing application under active development at this pace. The homeserver rename, v0.10 stable, pkarr v8, and the /priv private storage alpha indicate the stack is coalescing into a complete platform: naming + identity + social + private storage, all on the DHT.

3. The gTLD Window Is Closing — Watch the Collision Zone: After August 12, we'll know which strings ICANN received applications for. The collision risk (blockchain TLDs vs. ICANN TLDs) becomes concrete. Monitor which Web3 TLD strings get applied for — if .crypto, .wallet, .nft get ICANN applicants, existing blockchain domain holders are in jeopardy.

4. October 11 KSK Rollover — Test Your Stack: If you run pkdns, a GNS proxy, unbound, or any DNSSEC-validating resolver, verify KSK-2024 is in your trust anchor. This is operational hygiene. A self-sovereign resolver that breaks on KSK rollover undermines the sovereignty claim.

5. The Agent Naming Gap Widens: DNS-AID continues at the Linux Foundation with IETF standardization. The freedom-tech community has not engaged. Every week without a PKARR-based agent discovery proposal is a week closer to agent identity being permanently DNS-anchored. This is the naming battle of the next decade — and the window for alternative input is closing.

6. Handshake's Value Is Now Purely Architectural: No commercial adoption, no browser support, token at ATL. The only argument for Handshake is architectural purity — you own your TLD on-chain. This is a valid but narrow use case. For most operators, PKARR or GNS serve better.

7. Namecoin's Longevity Is Its Own Argument: 15 years of operation, tracking Bitcoin Core, no protocol failures. The .bit stack (ncp11 + ncdns + ncgencert) works in stock browsers. It's not exciting, but it works. The longest-running blockchain DNS experiment in history.

Primary sources

• GNUnet: early-alpha software status