Decentralized DNS Monday — August 31 2026 Weekly Update

Weekly companion to Overview - Decentralized DNS, ENS, PKARR, GNS, Handshake, Namecoin, and related files. Covers Aug 25–31. Key themes: ENS Labs opened a four-week, $70K audit competition on Immunefi for the ENSv2 apps (closes ~Sep 22) — the last security gate before mainnet deployment; ICANN's Aug 27 blog restated the Oct 11, 2026 root KSK rollover as the hard cutover date with a hard warning that unconfigured validating resolvers will lose all DNS on that day; ICANNWiki formalized the 2026 Reveal Day schedule (date announced mid-Sep, publish no later than nine weeks after Aug 12); the Pubky ecosystem plateaued this week — no new homeserver/app/nexus releases since Aug 19, but pkarr v8.0.0 documentation matured with an architecture doc; the Handshake realrasengan hard-fork PR #952 ("Arbitrary DNS Records, Supply Reallocation, Tree Interval") hit 67 deletions and 2,670+ insertions of test/decoder/handler code, still open since March; and the ICANN Name Collision Observatory (Feb 2026) is now the standing signal that any applied-for string colliding with a Web3 TLD portfolio gets challenged before delegation.

TL;DR — This Week

• ENS Labs × Immunefi audit competition LIVE (Aug 18 → ~Sep 22): four-week public audit of the new ENS App + ENS Explorer, $70,000 reward pool, four severity tiers ($5K / $2K / $1K / $250). This is the final pre-mainnet security gate for ENSv2. ENS Labs has paired it with the standing $250K Immunefi bug bounty (re-upped Aug 27). ENS’s 6 February 2026 announcement states that ENSv2 will deploy exclusively on Ethereum L1 and that Namechain development will cease.
• ICANN reaffirms Oct 11, 2026 root KSK rollover in a Jul 27 / Aug 27 blog+guide update pair: "On 11 October 2026, the root zone will begin using only KSK-2024. … if your DNSSEC-validating resolver does not have KSK-2024 configured by this date, your network will experience total DNS resolution failures." Old key retires Jan 2027. T-41 days from this update.
• ICANNWiki publishes the 2026 Reveal Day formal schedule (Aug 27): ICANN will publish the public portions of all applications passing Administrative Check on Reveal Day, with the specific date to be announced mid-Sep and the publish deadline no later than nine weeks after the Aug 12 close (≈ Oct 13). Reveal Day publishes more string-level information than 2012 — primary strings, variant strings, replacement strings, public portions of applications — but applications are still subject to evaluation, objection, contention, contracting, and technical processes.
• Pubky ecosystem QUIET — no new homeserver/app/nexus releases in the past week. Last release: pubky-homeserver v0.11.0 (Aug 19), pubky-app 1.7.0 (Aug 13), pubky-nexus last commit Aug 9. PKARR v8.0.0 (Aug 6) and v7.0.0 (Jul 25) are the recent shipping cadence; an architecture docs PR (#280) was added Aug 11 but documentation polishing has been the only post-Aug-19 activity in the central Pubky repos. Internal SDK refactors continue (GrantManager, AuthState, PkarrError, get_homeserver_of — visible in the v0.10.0 migration guide).
• Handshake PR #952 "Handshake Hard Fork — Arbitrary DNS Records, Supply Reallocation, and Tree Interval" still open (created 2026-03-04, last updated 2026-05-11). This week no movement in the PR itself, but handshake-rs/hns-rs released v0.3.1 on Aug 23 (all 19 public protocol crates bumped; exact direct-offer protocol source consumed by HNS wallet published). The companion hns-node-rs readiness doc shows every RpcConsensusReadiness field green at source level, but production authority is still gated on a mainnet canary.
• ICANN Name Collision Observatory (live since Feb 4 2026) is the standing signal. The Observatory measures DNS magnitude — number of unique client networks querying a string, not total query count — and surfaces collision risk in ICANN's gTLD evaluation. The Web3 TLD portfolio story (UD's 19+ applications; ENS's .ens application; Handshake TLDs) intersects with collision review before any string can be delegated.

Deep dives

1. ENS Labs × Immunefi audit competition — ENSv2 security gate

The four-week public audit opened Aug 18 with a maximum $70,000 reward pool distributed across four severities (Critical $5K, High $2K, Medium $1K, Low $250). Scope: the new ENS App and ENS Explorer codebases. ENS Labs is pairing the competition with the long-running $250,000 Immunefi bug bounty program (re-upped Aug 27 in Immunefi's listing), so any issue found in the competition that also affects deployed ENSv1 components remains covered.

ENS’s confirmed plan is in its 6 February 2026 announcement: deploy ENSv2 exclusively on Ethereum L1 and cease Namechain development.

The [contracts-v2](https://github.com/ensdomains/contracts-v2) repo (renamed from namechain per the Aug 24 weekly) had its last main commit "Post Audit Changes (#301)" on Jul 3 — meaning contracts are already post-internal-audit, and the Immunefi competition is the external security gate before any mainnet deployment.

Why this matters: ENSv2 is the production successor to a system holding 35M+ registered names and primary identity records for the Ethereum ecosystem. The Contracts were already described as "full rewrite" by ENS Labs in the CoinMarketCap Aug 27 summary. The five-week window (Aug 18 → ~Sep 22) plus the standing bounty gives researchers multiple incentive layers. If the competition closes without Critical findings, ENSv2 is one step away from mainnet deployment.

Cross-reference: ENS; see also Overview - Decentralized DNS §"ENSv2" timeline entries (May 19 Role-Based Permissions; Feb 2026 stay-on-L1 decision).

2. Root KSK rollover — T-41 days, hard cutoff restated

ICANN's "Preparing for the Root Zone KSK Rollover: What You Need to Know" (Jul 27 blog, re-shared/expanded Aug 27) and the parallel PDF "What to Expect During the Root KSK Rollover" make the date and failure mode explicit:

• Oct 11, 2026: root zone signs exclusively with KSK-2024 (Key Tag 38696). The old key is fully retired Jan 2027.
• >95% of reporting validating resolvers already hold KSK-2024 via RFC 5011 add-hold. The remaining <5% are the failure surface.
• Failure mode: a validating resolver without KSK-2024 in its trust-anchor set loses all DNSSEC validation, which for the growing share of DNSSEC-signed zones manifests as total DNS resolution failure — "websites appear down, email bounces." (Priority Pixels UK summary, citing the ICANN release.)

Lessons from 2018: the original rollover was postponed one year because of operator unreadiness. This is the second-ever rollover — only happens when the root key-signing key itself changes (not when resolvers rotate their own trust anchors). For self-sovereign operators (pkdns instances, GNS proxies to DNS, hand-rolled unbound/knot/BIND 9.11+ validating resolvers), the operational deadline is Oct 11 and the verification tool is delv @resolver . DNSKEY plus a check against IANA trust anchors.

Cross-reference: Overview - Decentralized DNS; see Aug 24 weekly for the broader KSK comms context. The Aug 24 weekly correctly stated Oct 11 — this update confirms and adds the Jul/Aug 27 ICANN blog pair.

3. Reveal Day — formal schedule, ICANNWiki (Aug 27)

The ICANNWiki entry on Reveal Day (and the parallel "New gTLD Program (2026)" entry) formalizes the schedule post-closing:

• Closing date: Aug 12, 2026 (1,600+ primary applications; secondary/replacement-string apps also counted).
• Administrative Check: applications that pass this review are what Reveal Day publishes.
• Reveal Day: specific date to be announced in mid-Sep 2026; publish must happen no later than nine weeks after close (≈ Oct 13).
• What Reveal Day publishes (more than 2012): primary applied-for strings, variant strings, replacement strings, public portions of each application, contention groups. Confidential/protected information not posted in full.
• What Reveal Day does NOT publish: anything that confirms an application — published applications remain subject to evaluation, objection, contention resolution, contracting, and technical checks before delegation.

String Confirmation Day (post-Replacement Period) is the next public milestone; applications can still be withdrawn, replaced, or contested. The 2012 Reveal Day was a London press conference with the complete published list two weeks after close. The 2026 round has a longer internal review period (administrative check is more rigorous).

Volunteer/informal lists are circulating, but the ICANNWiki piece and CaptainDNS both flag these as unverifiable — Reveal Day is the public record.

Freedom-tech stakes (continuing from Aug 24): the applied-strings list is the moment Web3-TLD holders (Unstoppable Domains' 19+ portfolio, ENS's .ens, Handshake's on-chain TLDs) can diff against ICANN's pending strings and see real collision zones. The Name Collision Observatory's magnitude data is the signal ICANN's evaluators use to flag risk; any string with non-trivial pre-existing query volume gets extra scrutiny before delegation.

Cross-reference: Unstoppable Domains (UD's 19+ application portfolio); Overview - Decentralized DNS §"ICANN engagement"; Aug 24 weekly §"Reveal Day timeline."

4. Pubky — shipping plateau, docs polishing, internals refactor

The Pubky org had no new tagged releases between Aug 19 (homeserver v0.11.0) and today. Repo last-updates (per the Pubky GitHub org page and pubky.org/explore):

• pubky-homeserver: last commit Aug 19 (v0.11.0 release commit 6a14bdb; path-addressed storage writes, feature-flags endpoint, full UserService refactor, /priv ALPHA docs)
• pubky-app: last commit Aug 13 (v1.7.0; 28 commits including WoT-feed E2E tests, JSON-LD for AI agents via Nexus-Scout, default-follow "safe moderation bot," dynamic OG images)
• pubky-nexus: last commit Aug 13 (starter-pack streams, interest-tag user search, WoT trust-traversal perf fix)
• pubky: lib.rs SDK last released 0.9.1 May 27 (Rust 2024 edition)

What is happening in the gap is internal SDK refactor visible in the v0.10.0 → v0.11.0 migration guide: startAuthFlow/startCookieAuthFlow API surface, PkarrError::Query/PkarrError::Resolve enum cleanup, get_homeserver_of semantics change, GrantManager (account-level grant listing/revocation), AuthState refactor, /priv ALPHA private storage endpoint. PKARR v8.0.0 (Aug 6) brought its own breaking surface: CacheOnly/CacheFirst/NetworkOnly resolve policies, Client::resolve/Client::publish returns Result<SignedPacket, ResolveError>, DhtClient/RelayClient decomposition, mainline::Config rewrite, ed25519-dalek upgrade, keys module split.

The architecture docs PR (#280) landed Aug 11 — the same week pkarr v8.0.0 shipped — which suggests the team took the v8.0.0 release as the moment to commit documentation for the new resolver/publisher API surface. From the user side this looks like a quiet week; from the maintainer side it's a stability-and-documentation pass before the next feature push.

Why this matters: Pubky is the most actively developed key-rooted naming stack (PKARR + homeserver + SDK + app + Nexus + Ring key manager), and it's also the one closest to a coherent product story. A week without tagged releases from a project shipping ~2-3 versioned crates per month is normal — it's the pre-feature stabilization phase. The next release wave is most likely late Sep or early Oct, after the ENSv2 audit closes (Sep 22) and the DNS-AID draft-02 review window ends (Nov 28).

Cross-reference: PKARR (last updated Aug 24); Pubky (in 11-Identity); see Aug 24 weekly §"PKARR/Pubky" for the v8.0.0 changes and the v0.11.0 homeserver refactor.

5. Handshake — hns-rs 0.3.1 released; PR #952 hard-fork still pending

Two parallel Handshake efforts visible this week:

handshake-rs/hns-rs v0.3.1 (Aug 23)

PR #3 merged Aug 23 — bumps all 19 public protocol crates to 0.3.1, publishes the exact direct-offer protocol source consumed by the HNS wallet, removes the superseded oracle-price vector release assertions, retains checked legacy settlement compatibility vectors. The merge was gated on exact-head CI, CodeQL, and a credential-free 19-crate publish preflight. This is the Rust-native protocol stack that the Handshake community is building alongside the legacy Node.js hsd. The fact that it's a "release cohort" — not a single crate — implies a coordinated SDK release train.

handshake-org/hsd PR #952 "Handshake Hard Fork" (open since 2026-03-04)

The headline Handshake hard-fork proposal has not moved this week — last activity May 11, 2026 in the PR thread. Summary:

• Arbitrary DNS records on-chain (expand from 7 custom record types to full DNS zone support — A, AAAA, MX, CNAME, SRV, TLSA, generic RAW; 512 → 8,192-byte resource limit).
• Unclaimed supply reallocation (~874.7M HNS from expired airdrop + ICANN/Alexa name-claim windows → Handshake Foundation multisig, controlled by long-standing community members).
• Tree interval reduction (Urkel tree commits every block instead of every 36 blocks; proof availability from ~6 hours to ~10 minutes; light-client and proof-based verification latency drops sharply).

The PR thread is the canonical place to track this — the two main open threads are about (a) reorg safety at every-block tree commits and (b) whether a Foundation is the right funding vehicle (one commenter flagged the prior dweb foundation's under-utilized funds).

Why both matter: the hns-rs Rust stack is the forward-looking implementation; PR #952 is the consensus upgrade that would unlock uncensorable DNS-on-chain (RAW records) and make light-client verification practical. Neither is "shipping next week" — both are infrastructure work for a multi-year migration.

Cross-reference: Handshake (handshake org wallet/SDK ecosystem and PR #952); HNS market: $0.001685, market cap $1.148M, 681.189M circulating, +34.3% 30d (CoinGecko Aug 31).

6. ICANN Name Collision Observatory — the pre-delegation gate

Live since Feb 4, 2026. The Observatory exposes DNS magnitude data (unique client networks querying a string, not total query volume) for the gTLD applicant pool. ICANN's evaluation framework uses this as one of several quantitative factors in string risk assessment — applicants can see whether their chosen string has a collision profile before they commit.

For decentralized-DNS holders, this is the upstream signal: if Web3 TLD strings (UD's .crypto, .wallet, .nft, .x, .box, etc., or ENS's .ens) draw ICANN applicants, the Observatory's pre-delegation magnitude measurement will surface whether the string has any pre-existing resolver traffic that the new gTLD would clobber.

Cross-reference: Unstoppable Domains (UD's 19+ applications portfolio); see Overview - Decentralized DNS §"ICANN engagement" and Aug 10 weekly for the ICANN window context.

7. DNS-AID / DANE / DNSSEC — quiet week

No new DNS-AID IETF draft this week. Draft-02 (May 27) remains the active reference, expires Nov 28. Cloudflare's "Agent Readiness" DNS-AID checker continues to enforce the older draft-01 semantics per a flagged community thread (from Aug 24 weekly — still unaddressed). The Linux Foundation / IETF DNS-AID working group has no new shipping artifacts.

Calendar (next 4 weeks)

Evidence at a glance

Freedom-tech takeaways

1. ENSv2 mainnet is one bug-bounty cycle away. The Aug 18 → ~Sep 22 audit competition window is the canonical "now or never" interval for security review before ENSv2 contracts go to mainnet. Any researcher holding findings on ENSv1 components (resolver behavior, ENS App auth flow, ENS Explorer data display) still has a window via the $250K Immunefi bounty.
2. Oct 11 KSK rollover is the operational deadline for self-sovereign validators. Any Daemon-operated validating resolver — including pkdns instances, GNS-to-DNS proxies, and hand-rolled unbound/knot/BIND 9.11+ resolvers — must confirm KSK-2024 (Key Tag 38696) in the trust-anchor set before Oct 11. delv @resolver . DNSKEY against IANA trust anchors; ten minutes of verification buys twelve months of operational safety.
3. Reveal Day ≈ Oct 13 is the Web3-TLD collision trigger. When ICANN publishes the applied-strings list, the diff against Unstoppable Domains' portfolio, ENS's .ens, and Handshake's on-chain TLDs is the audit task. Any string that gets delegated to a competing applicant creates resolution ambiguity for existing Web3 name holders in every ICANN-resolving browser. Key-rooted schemes (PKARR, Tor .onion) are structurally immune.
4. Pubky is in a stabilization phase. No new tagged releases since Aug 19, but the v0.10.0 → v0.11.0 migration guide is the real news — it locks the SDK/homeserver API surface and gives downstream integrators a stable baseline. The next feature wave (private /priv storage, JSON-LD agent discoverability maturation) likely lands late Sep / early Oct.
5. Handshake's two-track strategy. hns-rs is the Rust-native protocol stack shipping actively (19-crate cohort release Aug 23). PR #952 is the consensus upgrade that would unlock uncensorable DNS-on-chain, but it remains an open conversation thread with no merge date. Track the hns-node-rs readiness doc — production authority requires a clean mainnet canary.
6. Name Collision Observatory is the pre-delegation gate. Any ICANN applicant for a Web3 TLD string gets measured against existing DNS magnitude before their application passes Administrative Check. The Observatory's data is the upstream signal that determines whether Web3 TLD holders face a collision event at Reveal Day.

Cross-cutting

• Overview - Decentralized DNS — comparative landscape; ENSv2 timeline; KSK rollover comms.
• ENS — ENSv2 mainnet audit window; Security Council activated Jul 21; stay-on-L1 (Feb 2026); Turkey adoption (Jun 2026); .ens gTLD application.
• PKARR — v8.0.0 (Aug 6); v0.11.0 homeserver (Aug 19); architecture docs PR #280 (Aug 11); Iroh integration (Jan 2026 FOSDEM).
• Pubky (in 11-Identity) — ecosystem overview; identity + data stack on PKARR.
• Handshake — hns-rs 0.3.1 cohort (Aug 23); PR #952 hard-fork (open since March); HNS market +34.3% 30d; Namecheap exited HNS Jun 10.
• GNS — GNUnet 0.29.0 (Aug 20); protocol break with 0.28.x.
• Namecoin — Core 31.1 (Jul 13); no new release this week.
• Mesh & Off-Grid Naming — Yggdrasil, cjdns, Briar (mesh layer adjacent to decentralized DNS).
• Overlay Naming - Tor .onion and I2P — operator-confidentiality story; structurally immune to ICANN collision.
• Unstoppable Domains — cautionary; 19+ application portfolio intersecting with ICANN collision review.
• MOC - Censorship Resistance — naming as one layer of the stack.
• Glossary — DNS, ENS, Handshake, GNS, PKARR, petname, Zooko's triangle, Ed25519, DNSSEC, KSK, RFC 5011.

Primary sources

• ENS is staying on Ethereum, 6 February 2026