IT950 TN02 Internet Domain Names 2025.pdf

Technical Note: IT-950-TN02 Effective: 11/1/2004 Last Reviewed/Revised: 4/3/2024 Next Review: 4/3/2027

INTERNET DOMAIN NAMES

PURPOSE

This technical note establishes the standards and procedures for registering an internet domain name that represents a Smithsonian museum, unit, research center, exhibition, or project.

The registration of individual Smithsonian domain names has led to ongoing administrative and hard costs associated with the Smithsonian owning a large number of domain names that must be individually administered, renewed, paid for by each Smithsonian Institution unit, and returned to the registrar when no longer needed.

In a larger sense relating to the Smithsonian name, including the Institution’s brand, messaging, and interests such as they are presented to the world at large via the internet, the existence of a large number of domain names creates a potentially confusing situation for consumers of Smithsonian content and a blurring of the Smithsonian’s identity.

This technical note establishes Smithsonian policy governing these considerations.

SCOPE AND APPLICABILITY

This technical note applies to all Smithsonian Institution employees and contractors who require an internet domain name for a Smithsonian website, including all Smithsonian websites created, funded, or hosted by or resident on the SI network or infrastructure, or hosted externally, regardless of whether Smithsonian staff or contractors created them.

Contractors may not purchase domain names on behalf of the Smithsonian unless their contract specifically states that the name will belong to the Smithsonian Institution and ownership and access will be handed over to Smithsonian technical staff without any additional fees.

RESPONSIBLE OFFICE(S) OR GROUP(S)

Digital Platforms (DPLAT) Domain Coordinator: Registers new domain names, renews existing domain names, monitors domain name usage at the Smithsonian, and has primary ownership to manage and apply IT security configurations for all Smithsonian domains.

Network Operations Center (NOC): Controls and maintains SI domain name servers, including entering Smithsonian internet domains and assists with the management of IT Security configurations.

Office of the General Counsel (OGC): Ensures the Smithsonian name is not infringed upon and retains its integrity. In cases of possible domain name infringement or cyber-squatting, OGC will, upon request from OCIO or another Smithsonian unit, evaluate the circumstances of the matter and recommend a course of action.

Requester: The point of contact in the Smithsonian unit requesting and managing the costs associated with a domain name.

Internet Domain Names

Registrar: The governing body responsible for registering and maintaining domain name registrations on behalf of the Smithsonian. Organizations using the SI nameservers must register their domains with the Smithsonian registrar of choice, Network Solutions, through the Smithsonian’s Domain Coordinator, regardless of where the site is hosted. It is highly recommended that all domains be registered through Network Solutions to provide for consistency of IT security and registrar services.

Change Control Board (CCB): Approves or denies change requests for domain name changes, additions, and removals based on published naming conventions and the technical merits of the request.

Technical Review Board (TRB): The TRB reviews all IT security, privacy, and accessibility requirements.

TRB approvals are required prior to CCB approvals.

DEFINITIONS

Domain Name: The name of a website on a network. Consists of a top-level domain segment and a primary-level domain segment. For example, Smithsonian.org.

IP Address: A string of numbers used as a unique address to identify a computer, website, or other entity on the network. The numerical equivalent to a domain name.

Primary Domain Name: The first segment of a domain name. For example, Smithsonian.org.

Top-Level Domain (TLD): The last segment of a domain name. For example. Smithsonian.org.

POLICY AUTHORITY

Deron Burba, Chief Information Officer (CIO)

POLICY

The registration of a domain name must be regularly renewed or the domain name will become available to any party that pays the registration fee, even parties that are unrelated to the Smithsonian.

For the protection of a wide range of Smithsonian interests (avoiding user confusion, ensuring the protection and integrity of the Smithsonian name, and such), having an unrelated party use a domain name that previously pointed to a Smithsonian Institution website must be avoided. This technical note provides information on how to avoid this possibility.

Regarding the protection of the Smithsonian’s brand identity and reducing the possibility of user confusion, this document codifies a set of considerations to substantially limit (but not unilaterally restrict or prohibit) the practice of Smithsonian units registering individual domain names.

Domain Name Considerations

The Smithsonian Institution owns the si.edu primary domain and its sub-domains, which are available free of charge to individual Smithsonian units through DPLAT. Smithsonian unit practitioners sponsoring the creation of websites under the auspices of the Smithsonian, hosted by and resident on the SI network or infrastructure as of the effective date of this technical note, are strongly encouraged to incorporate a subdomain of the Smithsonian Institution’s primary domain, si.edu. Certain exceptions are permitted, those generally being e-commerce websites or websites created for tenant organizations or special projects through the Smithsonian Institution.

For example, a new website for a new exhibit at the National Museum of American History (NMAH) is strongly encouraged to be subdomain.si.edu or subdomain.americanhistory.si.edu, but not new-nmah.exhibit.org or subdomain.americanhistory.org.

SI.EDU Domain

Work pertaining to the implementation of subdomain.si.edu domain names that meet the following criteria will be performed by OCIO, at no cost to the requesting unit.

• The organization requesting an si.edu subdomain must be represented on the Smithsonian public website, www.si.edu.

• The webserver will be within the public access services zone of the Smithsonian firewall(s).

• The website must support the mission of a museum, Smithsonian office, scientific, art, historical or collections management, or a recognized Smithsonian project.

• The organization must be sponsored by a Smithsonian office or museum. Requests must come from a Director or Assistant Director.

• The organization and its members must agree not to post offensive files, pornographic images, or other materials that will reflect negatively upon the Smithsonian Institution.

NOTE: It is the policy of the National Telecommunications and Information Administration of the United States Department of Commerce (NTIA) to grant .edu domains only to accredited postsecondary institutions (see https://www.ntia.gov/page/edu-cooperative-agreement). Therefore, the .edu domain is not available to foundations, institutions, consortia, centers, and such, even though they may have an educational mission. The exception is domains granted prior to the existence of this policy, which are grandfathered-in and eligible for ongoing renewal.

SMITHSONIAN.US Domain

The Smithsonian Institution has purchased a lifetime registration for .smithsonian.us, primarily to prevent its use by an unrelated party. Use of www.smithsonian.us is exclusively for aliasing (linking) back to www.si.edu and no subdomains will be created under smithsonian.us.

SMITHSONIAN.MUSEUM Domain

OCIO registered the smithsonian.museum domain for the explicit purpose of internal technical use and to keep the domain from registration by an unrelated party. The domain is not deployed externally. The use of this domain and related subdomains are regulated by MuseDoma, the authorization body for the .museum domain.

SMITHSONIAN.ORG Domain

Use of smithsonian.org is exclusively for aliasing (linking) back to www.si.edu and no subdomains will be created under smithsonian.org.

SMITHSONIAN.GOV Domain

Use of smithsonian.gov is exclusively for aliasing (linking) back to www.si.edu and no subdomains will be created under smithsonian.gov.

https://www.ntia.gov/page/edu-cooperative-agreement

Alternative TLDs

In recent years, many new TLDs have been put into practice (such as .org, .net, .tv, .biz, or .info), and hundreds more have been announced (see ICANN Announcements). It is not the purpose of this policy to unilaterally prohibit the use of non-si.edu alternative domain names and subdomains, but the practice is strongly discouraged by OCIO for the reasons articulated above. In circumstances where a unit believes a non-si.edu alternative domain is appropriate and the best choice in a carefully vetted circumstance, the following conditions must be met:

• The unit or organization must be a non-profit organization affiliated with the Smithsonian or a tenant organization.

• The unit or organization must support the mission of a museum, Smithsonian office, scientific, art, historical or collections management, or a recognized affiliated organization.

• The organization or unit must be sponsored by a Smithsonian office or museum. Requests must come from a Director or Assistant Director.

• The organization or unit must agree to the Smithsonian’s best practices related to IT Security, Privacy, and Accessibility.

• The organization and its members must agree not to post offensive files, pornographic images, or other materials that will reflect negatively upon the Smithsonian Institution or the recognized affiliated organization.

• When the website is no longer needed or used, or is removed from service, the unit or organization must continue to maintain the domain registration as required in the Expiring, Unneeded, or “Parked” Domain Names section below.

COM Domain

All of the following requirements must be met in order to request a .com domain name, primarily that the website is used for electronic commerce:

• The organization requesting a .com domain must be affiliated with the Smithsonian Institution.

• Electronic commerce must be available from the website.

• OCIO will only honor requests that have been approved by the appropriate director of the

Smithsonian office sponsoring the site.

• The domain name must support the mission of a museum, Smithsonian office, scientific, art, historical or collections management, or a recognized affiliated organization.

• The organization or unit must agree to the Smithsonian’s best practices related to IT Security, Privacy, and Accessibility.

• The organization and its members must agree not to post offensive files, pornographic images, or other materials that will reflect negatively upon the Smithsonian Institution or the recognized affiliated organization.

• When the website is no longer needed or used, or is removed from service, the unit or organization must continue to maintain the domain registration as required in the Expiring, Unneeded, or “Parked” Domain Names section below.

https://www.icann.org/en/announcements/details/500-new-gtlds-introduced-into-the-internet-6-2-2015-en

Registering and Renewing Domain Names

• Domains are registered through the Smithsonian’s Domain Coordinator, or as delegated on a case-by-case basis by OCIO.

• Contractors may not purchase domain names on behalf of the Smithsonian unless their contract specifically states that the name will belong to the Smithsonian Institution and ownership and access will be handed over to Smithsonian technical staff without any additional fees.

• Registration of the smithsonian.com domain, including its subdomains, has been delegated to Smithsonian Enterprises (SE) by OCIO.

• Network Solutions is the preferred official registration agency for domain names ending with .org, .net, .tv, .biz, or .info.

IT request forms must include:

• Requesting the domain name(s) required as described in the Domain Name Considerations above.

• Except for si.edu subdomains, new registrations are to be made for a minimum of 10 years.

• The request should list a contact that can authorize the registration of the domain name via the registering unit’s purchase card, except for si.edu subdomain requests which are available free of charge. Fees are payable directly to the domain name administration agency.

Domain Coordinator Duties

• Reviews the request and determines if the name is available. If a possible name infringement is discovered during this review, the Domain Coordinator will contact OGC.

• Contacts the requesting official with multi-year pricing and proceeds to register the domain in conjunction with the requesting official, via the requesting official’s unit purchase card.

• Notifies the CCB of the new domain name via a change ticket.

• Works with the registrar and other Smithsonian staff to apply IT Security configurations to the new domain name(s).

• Requests IP addresses, aliases, redirects, and such, as required once the name has been registered.

• Notifies the requester that the name has been successfully registered

The NOC enters the IP address, naming data, and IT Security configuration into the Smithsonian’s DNS.

Registered domains are tracked by the DPLAT Domain Coordinator, who is responsible for contacting relevant unit practitioners and coordinating renewal of those domains or performing other related services (transferring between registrar accounts and such). In all cases renewal fees are paid by the unit, typically by conference call with the Domain Coordinator and the practitioner who is authorized to use the unit’s purchase card.

The Domain Coordinator will monitor the domain registration as follows:

• For domains other than si.edu, the Domain Coordinator will contact the unit 30 to 60 days before the multi-year registration expires to confirm that the unit plans to keep the domain name active.

• If so, the unit must provide a purchase card to pay a nine-year term renewal fee, or a renewal term long enough to ensure that the domain meets the requirements specified in the Expiring, Unneeded, or “Parked” Domain Names section below.

OCIO reserves the right to refuse domain name renewal if the requesting organization has not complied with this technical note in the past.

OCIO is not required to provide computer hardware to any organization requesting a domain.

Expiring, Unneeded, or “Parked” Domain Names

Existing websites that are no longer needed, used, or are removed from service will have their domain name registered a minimum of an additional five years from the time the use ceases, with the exception of the si.edu subdomains.

The unit or division that obtained or requested the domain will fund the renewal of the name for at least five years beyond the cessation of its use. This puts the domain name in a dormant state to ensure that no association by an unrelated third party can be made with the Smithsonian Institution.

During this period of dormancy, the domain name can be redirected to a Smithsonian “Discontinued Website” page, such as https://www.si.edu/discontinued-website, or may simply be removed from DNS, resulting in a blank “DNS Error” or registrar stub page (as shown in the example at http://emammals.org).

Domain names that were registered but never placed into service (for example, not entered into a DNS and never pointed to Smithsonian content directly or via redirect) do not need to maintain the five-year dormancy period. These domains may be allowed to expire at the end of their registration term.

The practice of registering a domain name and not placing it into service (in many cases to preclude its registration by others) is known as “parking.” Parked domains are unpublished in public documents and typically not accessible to internet users. As long as these domains do not appear on websites as crawlable links they will not be entered into search engine databases, further limiting their exposure.

Parked domains should not resolve to a web page (including generic registrar “under construction” pages) and should not be linked on web pages or websites. At the registrar, these pages will point to Smithsonian’s nameservers, but will not be entered into Smithsonian’s DNS, resulting in a generic “DNS error” page. If a parked domain is no longer needed at the end of its registration period, it may be allowed to expire without requiring the five-year dormancy period.

RELATED POLICY AND PROCEDURES

IT-930-TN23, Electronic Authentication

The Submit an IT Request form on the Service Portal.

TECHNICAL NOTE CHANGE LOG

Date of Revision Description of Changes

4/3/24 Rewritten to include information related to ITMC, IT Security best practices, privacy requirements, and accessibility requirements.

https://www.si.edu/discontinued-website http://emammals.org/ https://sinet.sharepoint.com/sites/PRISM2/OCIO/ITPolicies/IT-930-TN23.pdf https://smithsonianprod.servicenowservices.com/it?id=sc_cat_item&sys_id=9f9fa7bd1b545c10520ba82eac4bcbbf&referrer=related_items

Date of Revision Description of Changes

1/31/2020 Extensively rewritten to reflect new standards and procedures for internet domain name registration

7/7/2006 Previous revision changes not entered

11/1/2004 Initial release