The independent root
The root is an edited, signed zone.
WCAAN decides what goes into it. Tan's Network builds the zone from that decision, signs it, and keeps it available to resolvers.
01
Assembly
The starting point is the conventional ICANN delegation set. OpenNIC-only names are added next, followed by delegations WCAAN has admitted itself. Tan's Network signs and publishes the finished zone.
1ICANN baselineConventional public delegations
2OpenNIC additionsDelegations absent from the baseline
3WCAAN decisionsCETNIC and locally governed delegations
4Signed rootTan's Network publishes the result
02
Control path
WCAAN approves
A locally governed delegation enters the root only after WCAAN accepts it.
Tan's Network publishes
The operator turns the approved data into the zone actually served to resolvers.
DNSSEC authenticates it
A validating resolver can reject a zone or answer that was altered after signing.