Decentralized DNS and Sovereign Naming

Why it matters

The DNS + X.509 stack has five choke points: root zone operators, TLD registries, registrars, recursive resolvers, and CAs. Any of them can be compelled or compromised to remove, redirect, or observe traffic on a domain. Encrypted transports like DoH and DoT change who can snoop but don't change who controls the names.

Seizures and takedowns

Some recent examples:

• 2023: ICANN's handling of the .ONION renewal disrupted privacy tooling.
• 2022-2024: Russian authorities seized .RU domains in bulk.
• 2024: sanctions-driven seizures hit several crypto projects.
• Ongoing: content-based takedowns through UDRP, URS, and court orders.

The structural issue is that legacy DNS ties a name to a registrar's database row, and that row can be modified, deleted, or transferred without the holder's consent.

Historical context

Early work (1990s-2010)

Recent activity (2020-2026)

Approaches

1. Blockchain-anchored names

These systems store ownership records on a chain and use the chain as the source of truth.

ENS (Ethereum Name Service)

.eth names registered on Ethereum, used as wallet addresses, IPFS content hashes, and DIDs.

2025-2026 changes:

• Gas costs dropped after Ethereum throughput improvements; ENS registrations got materially cheaper.
• ENSv2 (Feb 2026): Nick Johnson announced ENS would stay on L1 instead of launching the planned Namechain L2.
• CCIP-read (EIP-3668) is the standard pattern for cheap off-chain subname issuance.

Resources:

• docs.ens.domains
• ens.domains

Handshake (HNS)

Replaces the DNS root zone with a blockchain. You can own your own TLD.

Status (2026):

• Active but small.
• Second halving expected mid-2026 (block 340,000; tracker estimates range late April to late July depending on hashrate).
• Resolver work continues (HSD, hnsd).
• Mainstream adoption is minimal.

Resources:

• handshake.org
• HNSd resolver

Namecoin

The original blockchain DNS (2011). Still running, with a small user base.

• Oldest blockchain naming system.
• .bit TLD.
• Merged-mined with Bitcoin.
• Tiny ecosystem, longest track record.

Unstoppable Domains

A centralized company that sells blockchain names. Lock-in concerns apply.

• Sells .crypto, .wallet, etc.
• The company can freeze or transfer names.
• Not actually decentralized despite the marketing.

Nomen

Nomen is an experimental Bitcoin + Nostr naming protocol. Bitcoin supplies global ordering for first-claim-wins human-readable names; Nostr transports signed record updates from the owner key.

Nomen's design is valuable because it composes existing censorship-resistant systems instead of launching another chain. Its weakness is distribution: no mainstream client support, tiny repo footprint, and reliance on indexers. See Nomen.

Cardano DNS

Cardano DNS is a Blink Labs / Gimbalabs effort to build a Handshake + Cardano DNS marketplace. Handshake anchors top-level-domain authority; Cardano native assets and smart contracts represent second-level domains and DNS record updates; cdnsd indexes chain state and serves DNS answers.

Cardano DNS is more complex than ENS or PKARR, but useful where the product is a sovereign second-level-domain marketplace rather than merely service discovery. See Cardano DNS.

2. Public-key-addressed names

The name is a public key. No blockchain, no registrar, just cryptographic identity.

PKARR (Public-Key-Addressable Resource Records)

Names are Ed25519 public keys. Signed DNS records are published to the BitTorrent Mainline DHT (around 10M nodes) under each key's hash. No blockchain, no registrar, no fees. The primary production stack is Pubky, which extends PKARR with homeservers, SDKs (Rust, JavaScript, Swift, Kotlin), semantic social graph, and RESTful HTTP APIs. See PKARR for the deep dive and Pubky for the full system.

Iroh integration (FOSDEM 2026): Iroh, a library for direct QUIC connections between peers, uses PKARR as one of its endpoint-ID discovery mechanisms alongside DNS, mDNS, and Mainline DHT. This means PKARR-based identities can serve as Iroh endpoint identifiers for peer-to-peer connections — the key's hash resolves to a relay URL and IP address, enabling NAT穿透 and direct connection establishment without address-based identities. See the FOSDEM 2026 Iroh presentation and Pubky Dev Call #2 for the integration details.

Strengths: self-authenticating, free, no chain, no seizure path. Trade-offs: no human-readable names without a layer on top, DHT churn requires periodic republication, lookup observability is low. See PKARR for the full threat model and composition patterns.

Nostr NIP-05

Human-readable aliases resolved over HTTPS to a pubkey. Not censorship-resistant alone, but composable.

• user@domain.com maps to an npub.
• Uses DNS / HTTPS for resolution.
• Can be served over PKARR for full self-sovereignty.

3. Overlay and hidden naming

Censorship-resistant naming inside separate networks.

Tor .onion

Self-authenticating addresses where the name is the public key. Fully decentralized, with the strongest operator confidentiality.

• v3 names: base32(Ed25519 pubkey ‖ checksum ‖ version), 56 characters.
• v2 (deprecated 2021) used truncated SHA-1 of an RSA-1024 key, 16 characters.
• No registry, no CA. The name verifies the key directly.
• The only seizure path is compromising the private key.

Trade-off: hidden services only, not general DNS.

I2P .b32.i2p

Analogous to onion addresses. I2P's naming.

• Base32-encoded destination keys.
• End-to-end encryption is mandatory.
• Less widely deployed than Tor.

GNUNet GNS (GNU Name System)

Petname-based hierarchical lookup with cryptographic roots.

• RFC 9498 (published 2023).
• Hierarchical like DNS, but with cryptographic delegation.
• Privacy-preserving (minimal metadata).
• Integrated into GNUnet 0.26.0 (Nov 2025).

Features:

• Petnames: local nicknames for keys.
• Delegation: zone-to-zone control delegation.
• Privacy from the ground up.
• No blockchain. Uses GNUnet's DHT.

Resources:

• GNUnet
• RFC 9498
• NLnet GNS project

How this composes with confidential inference

A confidential LLM endpoint whose domain can be seized isn't actually uncensorable. Pair attested TLS (key pinned inside the enclave) with a decentralized name — .eth, .onion, or PKARR — and the only way to take the service down is to shut down the underlying TEE nodes. Attestation public key plus a pubkey-addressed name yields a self-authenticating endpoint with no CA, no registry, and no DNS to seize.

Stack comparison

|| Component | Traditional | Decentralized | |-----------|-------------|---------------| || Domain | registrar.com | .eth / .onion / pkarr | || TLS cert | Let's Encrypt / DigiCert | Attested TEE (inside enclave) | || Resolution | ICANN → registrar → DNS | Blockchain / DHT / Tor | || Seizure path | Court order to registrar | None (self-hosted key) |

Mesh and off-grid naming

When the global internet is not reachable, the naming model has to change. Two production systems address this directly:

• Yggdrasil — encrypted IPv6 overlay where every node has a stable, key-derived address in 200::/8 or 300::/8. The address is the key. No DNS, no registrar, no chain. v0.5.12 (Dec 2024) is the current reference.
• cjdns — the older cousin, with addresses in fc00::/8, routed by Kademlia DHT, with the CryptoAuth header that prevents IP spoofing. Maintenance-mode but still powers Hyperboria.

At the application layer, Briar shows the most extreme case: there is no global namespace at all. The "address book" is built from out-of-band contact exchange (QR codes, Bluetooth, Wi-Fi), and each contact's display name is local. Transports fall back through Tor, then pluggable transports, then Bluetooth and Wi-Fi.

The architectural pattern is the same one PKARR and Overlay Naming - Tor .onion and I2P use: name = key = address. What mesh adds is transport independence: the addressing layer doesn't care whether the underlying network is fiber, mesh radio, Bluetooth, or nothing. See Mesh & Off-Grid Naming for the full deep-dive.

Cautionary case study — Unstoppable Domains

The taxonomy of decentralized naming is incomplete without naming what isn't decentralized. Unstoppable Domains (UD) sells blockchain-anchored names (.crypto, .wallet, .nft, .x, .bitcoin, …) on Polygon and other chains. ~4.6M+ names are registered. The names are tokens in a wallet, which feels decentralized. But UD is a company with a website, a resolver, and an ICANN accreditation.

In September 2025, a patent application filed by UD in February 2024 was published: "Deactivation of decentralized domains." The patent describes a wallet-vote-based takedown mechanism, with anti-abuse design (wallet age, reliability scores, time windows) but explicit takedown path that exists outside the chain.

UD is also ICANN-accredited — the only Web3 naming company with both a Web3 chain-anchored product and the traditional registrar credential. This means UD is bound by UDRP, court orders, and ICANN contractual obligations, like any other accredited registrar.

The lesson for an Ungovernable.tech stack: blockchain-anchored ownership is not the same as decentralized governance. True decentralized naming has no off-chain operator that can take the name down. ENS, Handshake, Namecoin, GNS, PKARR, Nomen, Tor, I2P, and Yggdrasil all satisfy this. UD does not. See Unstoppable Domains for the full case study.

Summary

|| System | Type | TLD | Governance | Maturity | Status | |--------|------|-----|------------|----------|--------| || ENS | Blockchain | .eth | DAO | Mature | Active, ENSv2 in progress (Role-Based Permissions live May 19 2026, Sepolia alpha testing) | || Handshake | Blockchain | Any | Permissionless | Niche | Active but strained; ViaBTC HNS pool closed Jun 1 (was ~50% hashrate); Namebase wound down Jun 2; 2nd halving ~Jul 22 2026 (2000→1000 HNS); resolver work continues; ecosystem shifting to smaller pools + self-hosted tools (BobWallet, ShakeDex) | || Namecoin | Blockchain | .bit | Permissionless | Legacy-active | Namecoin Core nc31.1 (Jul 2026, tracks Bitcoin Core 31.x); ncp11 + ncdns + ncgencert end-to-end stack; FOSDEM 2026 + 39C3 talks | || PKARR / Pubky | DHT | Custom | None | Emerging | Active dev, Pubky Core suite (2025-26), Pubky Nexus pushed 2026-05-31 | || Tor v3 .onion | Overlay | .onion | None | Mature | Stable; v2 fully retired 2021-12-15 | || I2P .b32.i2p | Overlay | .b32.i2p | None | Mature | Stable; PQ migration in progress (Proposal 169) | || GNS | DHT | Custom | None | Experimental | RFC 9498, GNUnet 0.27.0 (Mar 2026) | || Nomen | Bitcoin + Nostr | Custom | Protocol only | Experimental | Low activity, useful design pattern | || Cardano DNS | Handshake + Cardano | HNS-backed TLDs | Contract / marketplace rules | Experimental | Active cdnsd, Catalyst funded | || DNNS | Lithosphere L1 | Programmable | On-chain governance | Announced | No public repo yet | || Slashtags | Hyperswarm DHT | Custom | None | Historical | Superseded by Pubky Core; design pattern lives on | || Mesh & Off-Grid Naming (Yggdrasil) | Encrypted IPv6 overlay | 200::/8 / 300::/8 (IPv6) | None | Experimental | v0.5.12 Dec 2024; embedded Go library | || Mesh & Off-Grid Naming (cjdns) | DHT-routed IPv6 overlay | fc00::/8 (IPv6) | None | Maintenance-mode | Hyperboria community; cryptoAuth | || Mesh & Off-Grid Naming (Briar) | Local petname + transport fallback | Local petname | None | Mature | Briar 1.5.17 Mar 2026; Desktop 0.6.0-beta 2026 | || Unstoppable Domains | Blockchain + company | .crypto, .wallet, .x, .bitcoin, … | Company + ICANN | Cautionary | 4.6M+ names; takedown patent filed 2024, published 2025 |

Evidence at a glance

Trade-offs

What's good

• No seizure risk: the name is the key, not a database row.
• No renewal fees on PKARR, Tor, or I2P. One-time key generation.
• Self-authenticating: the name proves ownership cryptographically.
• Censorship-resistant: no central record to remove.
• Composable with TEEs, FHE, and MPC.

What's hard

• Usability. Users need resolvers, extensions, or bridges.
• Search isolation. Search indexes don't cover these spaces.
• Phishing. Homoglyph and typo attacks are easier in new namespaces.
• Blockchain costs. ENS needs ETH, HNS needs HNS, gas varies.
• Root governance varies. Handshake is permissionless; ENS root has multi-sig governance.
• Key management. Lose the key, lose the name (especially with PKARR).

Attack surface

Primary sources

• hsd mainnet renewal window

• hsd name-expiry rule

• GNUnet software status

• Yggdrasil project status

Documentation and specs

• ENS docs — docs.ens.domains
• Handshake — handshake.org
• PKARR — github.com/pubky/pkarr
• pkdns — github.com/pubky/pkdns
• GNS RFC 9498 — rfceditor.org/rfc/rfc9498
• Tor Rendezvous Specification v3 — spec.torproject.org

Repositories

• pubky/pkarr
• pubky/pkdns
• pubky/pubky-core — SDKs, homeserver, semantic social graph
• pubky/pubky-ring — mobile key manager
• pubky/pubky-nexus — social graph indexing
• pubky/pubky-app — Pubky.app social PWA
• handshake-org/hnsd
• namecoin/namecoin
• ursuscamp/nomen
• ursuscamp/noms
• blinklabs-io/cardano-dns
• blinklabs-io/cdnsd

Research

• Chor et al., Private Information Retrieval, JACM 1998.
• GNUnet, The GNU Name System (RFC 9498, 2023).

For renewal, resolution and key-recovery decisions, see naming systems compared.