Decentralized DNS Monday — August 24 2026 Weekly Update

Weekly companion to Overview - Decentralized DNS, ENS, PKARR, GNS, Handshake, Namecoin, and related files. This is a double-weekly covering Aug 10–24 (no Monday run on Aug 17). Key themes: the ICANN 2026 gTLD round closed Aug 12 with 1,600+ applications — the namespace collision question now has a clock on it (Reveal Day ≈ mid-October); ENS entered its post-"Next Era" accountability phase with forum threads on remaining funds and a new Security Council; the Pubky ecosystem shipped pubky-homeserver v0.11.0 and pubky-app 1.7.0 while quietly building AI-agent discoverability into a key-rooted social web (JSON-LD for crawlers, Nexus search APIs); GNUnet 0.29.0 broke protocol compatibility with 0.28.x; Handshake's hnsd saw its first real maintenance since March (Windows CI + automated TLD list); and DNS-AID advanced to draft-02 with a Cloudflare readiness checker already enforcing the older draft.

TL;DR — This Week

• ICANN 2026 Round CLOSED (Aug 12): 1,600+ primary applications, 1,100+ secondary (replacement-string) applications. Evaluation fee deadline passed Aug 19. Reveal Day — the public list of applied-for strings — is due no later than 9 weeks after close (≈ Oct 13), with the exact date announced mid-September. This is the moment the blockchain-TLD collision question becomes concrete.
• ENS post-Next-Era accountability begins: forum threads "Accountability Summary and Open Question on Remaining Funds" (Aug 18) and a proposal discussion for a new Security Council show governance follow-through after the Foundation handover. Meanwhile ensdomains/namechain was renamed to ensdomains/contracts-v2 — the ENSv2 contract repo, latest main commit "Post Audit Changes (#301)" (Jul 3).
• pubky-homeserver v0.11.0 (Aug 19): path-addressed storage writes, feature-flags endpoint, full UserService refactor. pubky-app 1.7.0 (Aug 13) + 28 commits: WoT-feed E2E tests, a default-follow "safe moderation bot," dynamic OG images, and JSON-LD for AI agents/crawlers (Nexus-Scout). pubky-nexus: starter-pack streams, interest-tag user search, a job-agnostic scheduling engine, and a WoT trust-traversal performance fix.
• GNUnet 0.29.0 (Aug 20): third major release of 2026; fixes transport-subsystem regressions; breaks protocol compatibility with 0.28.x — old and new peers cannot interoperate. Still "early adopters with some reasonable pain tolerance."
• Handshake hnsd revived: first maintenance since March — Windows test fixes, automated tld.h generation workflow, updated root-zone TLD snapshot and seed list (community contributor Nathan Woodburn). HNS +26.9% on the week (market-wide rally), ~$0.0025.
• Namecoin Core 31.1 (Jul 13) — vault previously tracked 28.0; Namecoin now tracks Bitcoin Core 31.x. Upstream syncs continue (pushed Aug 17).
• Root KSK rollover T-48 days (Oct 11): ICANN published updated "What to Expect" guidance (Aug 11); Verisign reports the rollover has "gone smoothly and predictably" with >95% KSK-2024 trust-anchor adoption.
• DNS-AID advanced to draft-02 (May 27, expires Nov 28): DNSSEC relaxed from blanket MUST to mandatory-when-TLSA; Cloudflare shipped an "Agent Readiness" DNS-AID checker — and a community thread flags it still enforces draft-01 semantics. Reference implementation moved to the dns-aid GitHub org.

Detailed Developments

1. ICANN 2026 gTLD Round Closes — 1,600+ Applications

The application submission window for the New gTLD Program: 2026 Round closed August 12, 2026 at 23:59 UTC, and ICANN's August 13 announcement confirmed the final shape of the round:

The secondary-application count is the notable structural novelty: the 2026 Applicant Guidebook lets applicants pre-designate replacement strings so they can escape contention sets without re-applying — over two-thirds as many replacement designations as primary applications indicates applicants hedging heavily against string collisions (including, plausibly, blockchain-claimed strings).

What happens next (per ICANN's announcement and the 2026 AGB timeline):

Freedom-tech stakes: Reveal Day is when we learn whether .crypto, .wallet, .nft, .x, .box or other strings already sold by blockchain registries (Unstoppable Domains, ENS-adjacent namespaces) drew ICANN applicants. Any overlap triggers the collision dynamic flagged in Unstoppable Domains and the Aug 3/Aug 10 weeklies: holders of Web3-only names on a string that ICANN later delegate to someone else face resolution ambiguity in every ICANN-resolving browser. Key-rooted schemes (PKARR, Tor .onion — see Overlay Naming - Tor .onion and I2P) are structurally immune: their names are derived from keys, not from a contested TLD string table.

At $227K × 1,600+ applications, the round also represents roughly $363M+ in evaluation fees flowing to ICANN — a reminder of exactly how much capital defends the incumbent namespace.

• Links: ICANN announcement — round closes with 1,600+ applications | ICANNWiki 2026 Round | 2026 Round page | Dotup timeline | See Unstoppable Domains, ENS

2. ENS — Post-"Next Era" Accountability Phase

Two weeks after the "Next Era" proposal passed (Aug 9) and made the ENS Foundation an operating entity, the governance system is digesting what it just did:

• "Accountability Summary and Open Question on Remaining Funds" (ENS DAO forum, Aug 18) — a community thread pressing on where the DAO's retained treasury (~54.6M ENS + the ~$16M operational wallet) actually sits operationally now that the Foundation administers the ~$65M Endowment. This is exactly the scrutiny the narrowed proposal invited: the DAO kept the money, so the DAO gets the questions.
• "Discussion: Proposal for a New Security Council" (forum, active through August) — the Next Era design relies on a Security Council able to cancel timelocked Endowment transactions; standing up the new council is the first structural follow-through item. A July 13 executable ("Establishing a new Security Council") began this process.
• Governor Nexus RFC (Mar 2026, still open) and "[Draft] Reform DAO governance by delegating 5M ENS tokens" (Jul 6, 26 posts) remain the longer-term governance-reform tracks.

Repo housekeeping with signal: ensdomains/namechain — the ENSv2 L2 name registry prototype highlighted in earlier weeklies — was renamed to ensdomains/contracts-v2 (48 stars). The latest main-branch commit is "Post Audit Changes (#301)" (Jul 3), with an AUDIT_README.md added May 7 — i.e., the ENSv2 contracts have been through external audit and are absorbing fixes. ENSv2 remains on track per the May 2026 milestones (ENS). The ensjs v4 SDK last released Jun 24 (CCIP test fixes).

Freedom-tech read: the Foundation can now, as Crypto Briefing noted, "participate in organizations including ICANN, IETF and W3C" and pursue stewardship of .ens. The institutional integration is no longer a strategy — it is the org chart. The open question for sovereignty watchers is whether the accountability threads mature into durable checks (the Security Council's cancellation power, tokenholder removal authority) or remain forum pressure.

• Links: Forum — General Discussion latest | contracts-v2 repo | Crypto Briefing — Foundation established | See ENS

3. Pubky Ecosystem — Homeserver v0.11.0, App 1.7.0, and Agent-Readable Social Web

The PKARR/Pubky stack remains the most actively developed P2P naming ecosystem, across four repos with substantive two-week output:

pubky-homeserver v0.11.0 (Aug 19)

Follows v0.10.0 (Aug 5) in two weeks:

• Path-addressed storage writes (PR #543) — complements v0.10's path-addressed reads (PR #536); the storage API moves from blob-style to filesystem-style semantics.
• Feature-flags endpoint (PR #550) — homeservers can now advertise capabilities; client SDKs can adapt without out-of-band coordination. Important for rolling out /priv private storage (still ALPHA) without breaking older clients.
• Full UserService refactor (PR #545): all user-based operations flow through UserService; services own their construction from AppContext (PR #554). Internal architecture maturing toward a maintainable service layer.
• Migration guide for the /priv events stream (PR #539) — signals /priv API is stabilizing enough to version.

pubky-app — 28 commits, release 1.7.0 (Aug 13)

Highlights beyond UI polish:

• WoT (web-of-trust) feeds hardening: 3 new WoT-feed E2E tests (Aug 20); "skip optimistic feed prepend on WoT-sourced streams" (Aug 14); "defer follow and profile-tag feed invalidation to next load" (Aug 21). The WoT-sourced feed is becoming a first-class, tested surface — see Nostr Web of Trust for the pattern.
• "Safe moderation bot default follow" (Aug 17) — new signups follow a moderation bot by default. A anti-spam/anti-CSAM measure with a censorship asterisk: the default-follow list is a soft power position. Watch who controls the bot.
• feat: add JSON-LD for AI agents and crawlers to learn of Nexus-Scout (Aug 14) — pubky.app now emits structured data so crawlers and AI agents can discover Nexus-Scout (the nexus search index). This is the stack's answer to agent discoverability: structured data on a key-rooted web, not DNS records (contrast DNS-AID, §9).
• Stream pagination livelock fix (Aug 12), dynamic open-graph images for collections (Aug 16), status emojis, notification grouping, article previews in feed.
• Prod-key sign-in blocked on staging homeserver deploys (Aug 18) — operational hygiene separating testnet/mainnet identities.

pubky-nexus — indexing layer accelerates (12 commits)

• Starter-pack streams + users-by-interest-tags API (Aug 21) — interest-graph discovery primitives.
• Search users by profile tags (Aug 20) and job-agnostic scheduling engine in nexusd (Aug 21) — nexusd growing from a crawler into a general indexing/scheduling platform.
• WoT perf fix: "wot stream queries ran the trust traversal once per post" (Aug 14) — collapsed to a single traversal. Also pubky dependency bumped to 0.10.
• Own-post visibility fixes across Reach filters (Aug 17); benchmark CI (Aug 17).

pkarr + pkdns

• pkarr (post-v8.0.0): relay error-result size reduction (#294), dependency-group bumps, and — notably — "docs: document client and relay architecture" (#280, Aug 11). Architecture documentation of the relay/DHT split is prep for more relay operators.
• pkdns: still dormant (last push Mar 23; v0.7.1 from Jul 2025). The resolver is stable but unmoving; open issue #103 ("extract the dns resolver into its own client library", updated Jun 18) is the main thread to watch for revival.

Freedom-tech read: the Pubky stack is quietly assembling the full alternative naming + identity + social + discovery stack on BEP44/Mainline. The JSON-LD/agent-discoverability move is strategically significant — it stakes the claim that agent discovery doesn't need DNS at all (see Takeaways).

• Links: pubky-homeserver v0.11.0 | pubky-app commits | pubky-nexus commits | pkarr commits | See PKARR, Pubky

4. GNUnet 0.29.0 — Protocol Break With 0.28.x

GNUnet 0.29.0 was released August 20, 2026 — the third major release of 2026 (0.27.0 Mar 19, 0.28.0 Jul 17), continuing the fastest release cadence in the project's 25-year history.

Key facts from the announcement:

• Purpose: "addresses a couple of regressions and general instability of the transport subsystem."
• Protocol compatibility break: "Major versions may break protocol compatibility with the 0.28.X versions. Git master is henceforth INCOMPATIBLE with the 0.28.X GNUnet network, and interactions between old and new peers will result in issues." A hard network fork — every GNS operator must upgrade together.
• Known issues (unchanged in substance from 0.27/0.28): CADET performance limitations; FS design issues; SET attack surface; RPS experimental; ~190 open bugs in the tracker; "some critical privacy issues especially for mobile users"; network "tiny."
• Contributors: Christian Grothoff, Florian Dold, TheJackiMonster, Martin Schanzenbach.
• Signing key: 3D11063C10F98D14BD24D1470B0998EF86F59B6A.

Freedom-tech read: GNS (RFC 9498) remains the strongest lookup-privacy naming system in this library, and the release cadence shows a live, funded team (Schanzenbach's DAPS-side research included). But the 0.29 network fork is a reminder of the deployment reality: a privacy-preserving name system whose network is "tiny" provides neither good anonymity sets nor reliable resolution. GNS is the right architecture searching for a user base — mirror-image of Handshake's problem (see §6).

• Links: 0.29.0 announcement | ftp.gnu.org/gnu/gnunet | bugs.gnunet.org | See GNS

5. Handshake — hnsd Revival (Community Maintenance)

The surprise of the fortnight: hnsd (the SPV name resolver — the lightest way to resolve Handshake names without a full node) received its first substantive commits since March:

All from community contributor Nathan Woodburn (long-time Handshake tooling maintainer). This is maintenance, not feature work — but it matters: an SPV resolver with a stale root-zone TLD snapshot silently fails on new TLDs, and automated regeneration removes a whole class of rot. Meanwhile hsd (full node) remains dormant (last push Aug 2025), and HNS traded up with the broad crypto rally: +26.9% on the week to ~$0.0025 (market +20.6%), volume-driven, no project-specific catalyst. Handshake's fundamentals (Namebase/Namecheap/ViaBTC exits, browser-integration wall) are unchanged — see the Aug 3 and Aug 10 weeklies.

Freedom-tech read: the difference between "dead" and "community-maintained" is exactly this pattern — a credible individual keeping the resolver's trust anchors fresh. Handshake is now in Namecoin-style life-support mode: architecture intact, token depressed, one-maintainer-deep.

• Links: hnsd commits | CoinGecko HNS | See Handshake

6. Namecoin — Core 31.1, and a Vault Correction

Namecoin's 15-year model — thin AuxPoW layer on Bitcoin Core, adopt every upstream improvement for free — remains the quiet counterexample to every "chain-DNS is dead" take. NMC trades ~$1.13. The .bit resolution stack (ncp11 + ncdns + ncgencert) last saw pushes Feb 2026 (ncdns) / Sep 2025 (ncp11) — stable-slow, like the chain itself.

• Links: namecoin-core nc31.1 | ncdns | See Namecoin

7. Root KSK Rollover — T-48 Days

The second-ever root zone KSK rollover lands October 11, 2026 — 48 days from this update.

• ICANN press release + updated guide (Aug 11): "What to Expect During the Root KSK Rollover" describes effects on DNSSEC-validating resolvers and affected-user experience; Kim Davies (VP IANA Services / PTI president): preparing and verifying systems "is essential to ensuring its success."
• Verisign observations post: the 2024–2026 rollover process has "gone smoothly and predictably"; KSK-2024 was pre-published Jan 2025 (21 months); adoption tracked via RFC 5011 add-hold polls mirrors the 2017–18 rollover (>95% of validating resolvers hold the new key).
• Failure mode for the unprepared: a validating resolver without KSK-2024 in its trust-anchor set suffers total DNS resolution failure on Oct 11. For self-sovereign operators (pkdns instances, GNS proxies-to-DNS, hand-rolled unbound/knot), this is the operational deadline of the quarter. Test now: delv @resolver . DNSKEY and check the RFC 5011 state, or validate against the IANA trust anchors.

• Longer track: the Root Zone DNSSEC Algorithm Rollover Study (final report) continues toward a process for migrating the root off RSA/SHA-256 — the eventual post-quantum question for the DNS itself (see Overview - Post-Quantum Cryptography).

• Links: ICANN release Aug 11 | Verisign observations | What to Expect PDF | ICANN blog Jul 27

8. DNS-AID — draft-02, Cloudflare Checker, New Org

The DNS-for-AI-agent-discovery effort (tracked since the Aug 3 weekly) has moved twice:

1. draft-mozleywilliams-dnsop-dnsaid-02 (updated May 27, 2026; expires Nov 28, 2026): adds Jeffrey Damick as author; the DNSSEC requirement was relaxed from a blanket MUST to mandatory when TLSA/DANE is used, warning-level otherwise. Still an individual draft (no working group), replacing the old bandaid draft.
2. Cloudflare shipped an "Agent Readiness" DNS-AID check in its dashboard — and a community thread ("Agent Readiness DNS-AID check still enforces DNSSEC as MUST from draft-01") reports it hard-fails valid SVCB ServiceMode records for AD=false even when no TLSA is published, i.e. the checker lags the draft. Friction like this is how you can tell a spec is being implemented for real.
3. The reference implementation moved from infobloxopen/dns-aid-core to the dns-aid GitHub org — Python SDK + CLI + MCP server, so agents can literally claude mcp add DNS-AID discovery. Infoblox/GoDaddy/DTel authors + Linux Foundation backing.

Freedom-tech read (sharpening): DNS-AID is converging on "DNS + DNSSEC(when-DANE) + SVCB records = the agent directory." The Pubky counter-model (JSON-LD on key-rooted pages, §3) now exists in production code on both sides: DNS-anchored (dns-aid-core MCP server) vs key-anchored (pubky-app structured data + Nexus-Scout). The next quarter decides which model AI-agent frameworks integrate by default.

• Links: datatracker draft-02 | Cloudflare community thread | dns-aid-core | arXiv 2606.02314 | See AI Agent Identity on Nostr

9. Unstoppable Domains — Steady Web3-TLD Churn

UD's blog cadence continues: .super (SuperVerse collab, Jun 12) is the newest Web3-only TLD; .awaken (Awaken Tax, Feb 24) extends the tax-compliance branding play; ICANN-track posts for .twin, .hub, .openx, .verge, .yellow date from Dec 2025–Jan 2026, consistent with the 19+-application portfolio described in the Aug 10 weekly. Which of those strings actually appear on Reveal Day (≈ Oct 13) is the checklist item.

• Links: UD announcements | See Unstoppable Domains

Evidence at a Glance

Freedom-Tech Takeaways & Recommendations

1. Put Reveal Day (~Oct 13) on the calendar as a review trigger. When ICANN publishes the applied-strings list, diff it against Web3 TLD claims (UD's portfolio, ENS's .ens, Handshake's on-chain TLDs). Every overlap is a resolution-ambiguity event for existing name holders. The next DNS Monday after Reveal Day should be a dedicated collision-audit update to Unstoppable Domains and Overview - Decentralized DNS.

2. The agent-discovery fork is now visible in code, not just talk. DNS-AID ships an MCP server (DNS-anchored discovery); pubky-app ships JSON-LD + Nexus-Scout (key-anchored discovery). Both are consumable by the same AI-agent frameworks today. For the Daemon network, this is strategically load-bearing: agent identity anchored to DNS means ICANN/registrars/DNSSEC remain choke points on machine-to-machine commerce. The PKARR path deserves a proof-of-concept agent-directory client — pkarr's new architecture docs (#280) are the on-ramp.

3. GNUnet's 0.28→0.29 network fork is a small-scale rehearsal of the coordination problem every privacy network faces on breaking changes. Compare with Nym's hard-fork governance and Tor's two-relay-version authority windows. The lesson compounds: protocol agility (fast major releases) trades directly against network continuity (tiny networks can't survive many forks). Worth a cross-reference note in MOC - Composing Primitives eventually.

4. Watch the ENS Security Council formation, not the Foundation itself. The Council's power to cancel timelocked Endowment transactions is the only on-chain check inside the new structure. Who sits on it, and whether the "accountability" threads produce standing reporting requirements, determines whether Next Era is checked governance or board rule with extra steps.

5. KSK rollover: run the checklist before Oct 11. Any Daemon-operated validating resolver must confirm KSK-2024 in its trust-anchor set (RFC 5011 state or manual anchor). This includes pkdns-style setups that proxy to DNS upstreams. Total resolution failure is the failure mode; delv/dig +dnssec verification takes ten minutes.

6. Handshake and Namecoin now share a maintenance genre: architecture-first projects kept honest by tiny teams doing unglamorous work (Woodburn's tld.h automation; Namecoin's Bitcoin rebases). Neither will win adoption; both are load-bearing proof that chain-anchored naming survives multi-year bear markets. Keep both in this library's "longevity" column.

7. Pubky's "safe moderation bot default follow" is the first governance-shaped default in the stack. Benign today, but a default-follow list is a curation choke point — the exact class of soft power this library tracks elsewhere (relay allowlists, Bluesky moderation). Log it in Pubky and revisit if the bot's operator or policy changes.