Decentralized DNS Monday — September 14 2026 Weekly Update

Weekly companion to Overview - Decentralized DNS, ENS, PKARR, GNS, Handshake, Namecoin, and related files. Covers Sep 8–14. Key themes: ENS Labs × Immunefi audit competition closes TODAY Sep 14 11:00 UTC (T-0 — Immunefi captured "2d 0h remaining" on Sep 12; 306 reports / 20 confirmed / 56 under review still the public snapshot); ENSv2’s L1 plan supersedes the November 2025 Surge proposal; the hns-rs ecosystem moves to v0.4.1 (Sep 1) — replaces the v0.3.1 cited through August, the first protocol-coherent release line with a Shakescape swap session binding and signed watch readiness; root KSK rollover is now T-27 days with EMEA/APAC webinar comms wrapped Aug 26 and the LA Board workshop from Sep 4–6 producing no separate Reveal Day date yet (still tracked for mid-Sep); pkarr ships v8.0.1 on Aug 31 (dependabot-only, breaking patch for #241) — breaking the 19-day release plateau that the Sep 7 weekly was tracking; pubky-homeserver continues active development (30 commits on main since Aug 19) without a new tag, pubky-app similarly active on dev (Sep 11) with no new tag; DNS-AID draft-02 expires Nov 28 with no new draft; Handshake core hsd unchanged since Aug 22 2025 (>1 year stale) — only the hns-rs ecosystem is shipping.

TL;DR — This Week

• ENS Labs × Immunefi audit competition ENDS TODAY — Sep 14, 2026 11:00 UTC. Immunefi captured "2d 0h remaining" on Sep 12 (the same snapshot the audit competition's live page still shows as of Sep 14 morning); the public findings state hasn't refreshed since Aug 31 (306 reports submitted / 20 confirmed valid / 56 under review). Schedule after close: project remediation deadline Sep 20, results frozen Sep 28, 48-hour dispute window to Sep 29, payment complete + results published Oct 26. Vault TVL $69,989.29 (essentially unchanged from Sep 7). This is the gating step before ENSv2 mainnet deployment. See deep dive §1.
• ENSv2 and Namechain: ENS’s February 2026 announcement places ENSv2 on Ethereum L1 and ends Namechain development. The Surge proposal dates from November 2025.
• hns-rs moves to v0.4.1 (Sep 1, 2026) — replaces the v0.3.1 we cited through August. First coherent protocol release line with: Shakescape V1 protocol registry replacement (Denuo→Shakescape), HNSR profile for Shakescape swaps, signed swap-watch readiness, direct offers bound to swap sessions, protocol 0.4.1 marked current in docs. hsd (handshake-org/hsd) last commit remains Aug 22 2025 (>1 year stale, no v3.x tag). See §4.
• pkarr v8.0.1 (Aug 31) — the first breaking patch in the v8 line (per #241), dependabot-only contributor list, single commit 938a938. Breaks the 19-day tagged-release plateau tracked since Aug 19. pubky-homeserver (30 commits since Aug 19, last main commit Sep 11 06:43) and pubky-app (last dev commit Sep 11 15:56, +12 commits since Aug 13) remain active on trunk without new tagged releases.
• Root KSK rollover — T-27 days to Oct 11, 2026 hard cutover (KSK-2024 active; old key retired Jan 2027). ICANN EMEA webinar recording published Aug 26 (password: BmEKv5ue?); Sep 4–6 Board LA workshop reviewed New gTLD round — no separate Reveal Day date announced publicly yet, still tracking the "mid-Sep" window. See §2.
• ENS DAO Sep 8 burst (in addition to Sep 1): [Research] ENS-GR-01: A Ten-Proposal Governance Record for Delegation Incentives](https://discuss.ens.domains/) (DAO-Governance, 0 replies, Sep 8); ensforge: A unified TypeScript SDK for ENSv1 and ENSv2 (ENS Development, 1 reply, Sep 8) — the first "single API across both versions" SDK; Blockful service provider reports and updates (Sep 8, 11 replies). ENS Newsletter #120 expected ~Sep 15.
• DNS-AID quiet — draft-02 expires Nov 28, no new draft. Cloudflare "Agent Readiness" checker enforcement-of-draft-01 issue from Aug 24 weekly still unaddressed. Stale.

Deep dives

1. ENS Labs × Immunefi audit competition — closes TODAY Sep 14 11:00 UTC

The competition goes into close mode today. Per the live Immunefi page (Sep 12 capture still showing "2d 0h remaining"), the canonical schedule and post-close gating is unchanged from the Sep 7 weekly:

Scope unchanged: 5 targets (Manager app, Explorer app, Workers, Transaction-manager, Smart-account), 24 in-scope impacts, 137,845 LOC, tiered reward pool $70K (Critical) / $50K (High) / $30K (Medium/Low) / $3K (none), Primary $49K / All Stars $14K / Podium $7K. Vault TVL $69,989.29 (was $69,986.98 on Sep 7, $69,973.68 on Aug 31 — climbing slightly toward $70K target).

Public findings state — UNCHANGED from Aug 31: 306 reports submitted, 20 confirmed valid, 56 under review. Immunefi has not refreshed these counters between Aug 31 and Sep 14 — either the public view is delayed or the actual triage count is genuinely flat. The 306/20/56 snapshot will likely hold through publication on Oct 26.

Internal known-issues disclosure (Aug 14): ENS Labs published a "Public Disclosure of Known Issues" document (last updated Aug 14, applies to all 5 in-scope targets). Part 1 lists internal audit findings from May AI-assisted pass + 2-phase expert review + Round 2 follow-up + Round 3 source-level audit of transaction-manager + smart-account packages in August 2026. Part 2 lists known functional defects from QA. "Everything in both parts is already known to us and is not eligible for reward." Reports describing the same root cause as a listed entry are treated as duplicates. Sample known finding: R2-01 (Medium) — "Secrets remediation incomplete: .env files still tracked, provider keys unrotated" (Manager + Explorer). The full document is in scope page's "Public Disclosure of Known Issues" section.

ENS Labs Q3 framing unchanged: "Q3 will involve completing the remaining security and audit work and reading v2 for final deployment. After v2 launches on mainnet Ethereum, the team is looking forward to a more experimental phase of product development around specific integrations and use cases."

Operational gate sequence: 1. TODAY Sep 14 — competition closes 11:00 UTC; no new submissions accepted 2. Sep 20 — ENS deadline to resolve all submitted reports (i.e. patch Critical/High/Medium/Low) 3. Sep 28 — results frozen and calculated 4. Sep 29 — final 48-hour dispute window closes 5. Oct 26 — payment + public results publication 6. After Oct 26 — ENSv2 mainnet deploy window opens (separate ENS Labs + DAO governance go/no-go)

Cross-reference: ENS; Decentralized DNS Monday — September 07 2026 Weekly Update (Sep 14 closure date correction from "Sep 22" estimate).

2. Root KSK rollover — T-27 days, Reveal Day date still pending

T-27 days to Oct 11, 2026 KSK-2024 cutover; old-key retirement Jan 2027. ICANN's Aug 11 guidance document "What to Expect During the Root KSK Rollover" is the primary reference; ICANN blog Jul 27 "Preparing for the Root Zone KSK Rollover: What You Need to Know" is the executive summary. Risk to DNSSEC-validating resolvers that haven't loaded KSK-2024: total DNS resolution failure.

Recent comms: - Aug 26 EMEA Webinar Series — ICANN engagement-calendar entry + ISOC Live recording (password BmEKv5ue?\). - Sep 4–6 ICANN Board LA workshop — agenda included New gTLD 2026 Round; Reveal Day date still expected in mid-Sep window per ICANN's Aug 13 announcement. - Sep 9 ICANN blog "Chair's Blog: September Board Workshop Preview" — the pre-meeting chair's preview. No Reveal Day date confirmed publicly yet as of Sep 14.

Critical post-rollover fact for the decentralized-DNS stack: DNSSEC-validating resolvers are the universal choke point. Any naming system that uses DNSSEC anchoring (ENS DNSSEC import, Namecoin via ncp11, Handshake via resolver trust) inherits the dependency. Decentralized alternatives that don't use DNSSEC at all (GNS, PKARR/PKDNS, Tor .onion, Yggdrasil IPv6, Namecoin's P2P mode, Slashtags) are unaffected. This is the only scheduled global DNS event in 2026.

3. ENSv2 remains on Ethereum L1

ENS’s Surge proposal is dated 17 November 2025. Its later announcement, on 6 February 2026, says ENSv2 will deploy exclusively on Ethereum L1 and Namechain development will cease. The older proposal does not establish a September revival. See ENS.

4. Handshake — hns-rs v0.4.1 ships Sep 1; hsd core dormant >1 year

hns-rs (handshake-rs/hns-rs): - v0.4.1 released 2026-09-01 02:55 UTC — first coherent protocol release line. - v0.3.0 was 2026-08-14 21:35 UTC. - v0.4.1 commit log (Sep–Aug window): - 2408c1e docs: record current protocol publications (2026-09-02) - 8d6b9ff docs: make protocol 0.4.1 current - 73611a0 Prepare coherent protocol release 0.4.1 - 7890011 Assign HNSR profile for Shakescape swaps - e1a2c37 Replace Denuo protocol registry with Shakescape V1 - 6def5cb Require signed swap watch readiness - 2a4e778 Bind direct offers to swap sessions - d271ea1 release(protocol): prepare 0.3.1 crate cohort

The Sep 7 weekly cited v0.3.1 as current; this is now out of date — v0.4.1 is the live release line. The repo is community-led under the handshake-rs GitHub organization, separate from handshake-org.

hsd (handshake-org/hsd) — dormant: - Last commit: 2025-08-22 (698e252 Merge PR #944 from 'nodech/fix-partial-open') — over one year stale. - Last tagged release: v2.4.0 from 2021-04-02 — no v3.x. - PR #952 (the long-open hard-fork proposal that the Aug 24 weekly noted as frozen since May 11) is still not landed.

This means Handshake core protocol development is effectively paused; only the Rust ecosystem under handshake-rs is shipping, and the focus is on the swap/auction layer (Shakescape V1) rather than consensus. HNS market cap still -99.8% from ATH; CoinGecko shows +54% 7d recovery but on low volume (the Aug 3 weekly already noted this bounce pattern).

Cross-reference: Handshake; Sep 7 weekly §"Handshake"; Aug 31 weekly §"hns-rs v0.3.1 19-crate cohort."

5. PKARR ecosystem — v8.0.1 breaks the Aug 19–Sep 7 tagged plateau

pkarr (pubky/pkarr) — v8.0.1 released Aug 31, 2026 (commit 938a938). Tagged-release history now: v8.0.0 (Aug 6) → v8.0.1 (Aug 31). The release is small — dependabot-only contributors (@dependabot, @andrei-21), no public changelog text visible on the release page, full changelog compare at v8.0.0...v8.0.1. Breaking-patch label referenced (#241) — matches the pattern from v5.0.5 which was "Yanked due to an unexpected breaking change [#241]." The Aug 31 release does NOT show yanked status; it's a real v8.0.1 minor release.

Trunk activity since v8.0.1 (Sep 1 onward) is also moving: - Sep ~: chore: add 7-day Dependabot cooldown (#305) — 5b67b7a - Dependabot group bumps: #301 (github-actions), #302 (cargo +11), #299 (cargo +8), #297 (chacha20 to 0.10.2), #298 (v8.0.1 release itself)

This breaks the 19-day tagged-release plateau the Sep 7 weekly was tracking (Aug 19 → Sep 7). The next tagged release is not imminent — Sep commit count is dominated by dependabot + CI workflow pins (v1.0.0), not feature work.

pubky-homeserver (pubky/pubky-homeserver) — still v0.11.0 (Aug 19) as latest tag, but main is highly active: - Last commit: 2026-09-11 06:43 UTC (HEAD -> main, origin/main, origin/HEAD) - 30 commits since Aug 19 (verified with git log --since="2026-08-19" | wc -l = 30) - Notable recent: bb95ecd feat: add read_timeout to Pubky client (#599), cf23bea build(docker)!: support debug builds and default to homeserver (#594), 3e9b933 feat(sdk): make two stage auth flow publicly available (#586)

pubky-app (pubky/pubky-app) — still on dev branch (last commit 2026-09-11 15:56 UTC), main branch still Aug 19. Active dev work: cb0494f fix(auth): reset settings store on sign-in and fail stale writes on read error (#2501), 5b28cec fix(ui): reduce mobile page gutter to 16px on remaining surfaces (#2502), 5ceb657 test(e2e): seed onboarding interest instead of assuming popular tags (#2498). No tagged release since v1.7.0 (Aug 13).

The pattern: Pubky team is shipping on trunk, not on tags — main/dev move daily, but the team is deferring tag emission to absorb SDK stabilization (the v0.10→v0.11 migration guide from Aug is the canonical example). This is consistent with the Sep 7 weekly's "team is in SDK stabilization" reading.

Cross-reference: PKARR; Sep 7 weekly §"Pubky plateau CONFIRMED."

6. ENS DAO Sep 8 burst — research + SDK + service-provider reports

The Sep 7 weekly captured the Sep 1 burst. The Sep 8 forum additions are fewer but higher-signal:

• [Research] ENS-GR-01: A Ten-Proposal Governance Record for Delegation Incentives](https://discuss.ens.domains/) — DAO-Governance, 0 replies, Sep 8. The "GR-01" suggests a structured research series (Governance Research #01) on delegation-incentive mechanisms. Likely author: a delegate researcher. Not yet commented.
• ensforge: A unified TypeScript SDK for ENSv1 and ENSv2 — ENS Development, 1 reply, Sep 8. The first single-API TypeScript SDK spanning both ENSv1 and ENSv2 contracts. This is a meaningful dev-experience improvement — the current state is two parallel SDK paths (viem / ethers v5 against ENSv1; new viem-style against ENSv2 Sepolia). A unified SDK reduces the migration cliff.
• Blockful - service provider reports and updates — 11 replies, Sep 8. Blockful is one of the active ENS service providers; their regular reports include Subname Registrar and Governor Nexus work. The Sep 7 weekly captured the Blockful completes Governor Nexus implementation milestone from Newsletter #119.
• ENS Newsletter #120 expected ~Sep 15 — Newsletter #119 was Sep 1; the cadence is every ~2 weeks (Aug 18 #118, Sep 1 #119, Sep 15 #120 projected).

Still open from Sep 1 burst (carried from Sep 7 weekly, no resolution): - ENSIP-28: ENS Name Owned Accounts — Standards, 11 replies, Sep 2. Self-asserted claims attaching Safes, token-bound accounts, agent wallets via ENSIP-24 records. - [RFC] Privacy-Preserving Names: ENSIP for Stealth Address Resolution](https://discuss.ens.domains/t/rfc-privacy-preserving-names-ensip-for-stealth-address-resolution/22354) — 8+ replies as of Sep 1, build on Fluidkey + Cloaked flows. Fluidkey has run this in production for 2+ years supporting $1B+ transfer volumes across 28k users. - ENSIP: Text Record Attestations — class + schema records for organizational metadata, draft in progress. - Stealth-address ENSIP discussion adds implementation details — integrity checks for wildcard names, reference implementation review offered. - DNSSEC oracle replacement proposal live — security-critical; under-specified for DNSSEC trust anchoring.

7. DNS-AID — quiet, draft-02 expires Nov 28

No new draft since draft-02 (May 2026). Cloudflare's "Agent Readiness" checker still enforces draft-01 expectations without acknowledging the breakage (per Aug 24 weekly). Mid-Sep expected for new IETF submission; the mid-Sep announcement window from the Sep 7 weekly is the natural deadline for an IETF cut. If no cut, the working group loses a meeting cycle. Watch this week + next.

Cross-reference: Overview - Decentralized DNS; Aug 3 weekly §"DNS-AID — naming layer for the agentic web."

8. GNUnet / GNS — no new release since 0.29.0 (Aug 20)

GNUnet 0.29.0 was Aug 20 2026; this is the most recent release on the GNUnet news page. No 0.29.1 patch release, no libgnunetchat update since 0.8.0 (Jul 18). GNS protocol break vs 0.28.x still in effect (peers on 0.28.x and 0.29.0 will not interoperate). The August 20 announcement noted known transport-subsystem regressions that the release addressed; no further regressions reported. No new release; experimental software.

Cross-reference: GNS; Sep 7 weekly §"GNUnet / GNS."

9. Namecoin — upstream syncs continue, no Namecoin Core tag since 31.1

namecoin-core git history shows Bitcoin Core upstream sync merges (e.g. #36161, #36164, #36169, #36123, #36130, #36163, #36166) — these are Bitcoin Core PRs landed into Namecoin's fork. No Namecoin-specific tagged release since nc31.1 (the Sep 7 weekly corrected the Aug 24 "28.0" miss). ncp11 + ncp11 + ncgencert HTTPS-in-stock-browsers stack unchanged. The Bitcoin Core sync cadence means Namecoin tracks the Bitcoin Core security fix rhythm automatically. Stable plateau.

Cross-reference: Namecoin; Sep 7 weekly §"Namecoin."

Cross-cutting context

• ENSv2 mainnet deploy clock is mechanical — Sep 14 close → Sep 20 remediation → Sep 28 results frozen → Sep 29 dispute window → Oct 26 publication → ENS Labs + DAO go/no-go on mainnet. Q4 2026 framing per ENS Labs.
• Decentralized DNS ecosystem status Sep 14, 2026:
• Active shipping: ENS (contracts + SDK + DAO), PKARR (patch-level), pubky-homeserver / pubky-app (trunk-level), hns-rs (v0.4.x protocol line), Nethermind Surge (rollup framework).
• Plateau: GNS / GNUnet 0.29.0, Namecoin nc31.1, hsd (truly dormant), ICANN Reveal Day (waiting on date announcement), Handshake (market stable low, ecosystem pivoting to swap layer).
• Quiet / stale: DNS-AID (no new draft), Handshake PR #952 (>1 year stale), Namecoin Twitter.
• KSK rollover is the only scheduled global DNS event in 2026; Oct 11 is the hard cutover. Decentralized alternatives not using DNSSEC (GNS, PKARR/PKDNS, Tor .onion, Yggdrasil, Namecoin P2P mode, Slashtags) are unaffected.

Primary sources

• GNUnet: early-alpha software status