Item 1. BUSINESS

Overview

We are a global provider of domain name registry services and internet security, enabling internet navigation for many of the world’s most recognized domain names and providing protection for websites and enterprises around the world (“Registry Services”). Our Registry Services ensure the security, stability, and resiliency of key internet infrastructure and services, including the .com and .net domains, two of the internet’s root servers, and operation of the root zone maintainer function for the core of the internet’s Domain Name System (“DNS”). Our product suite also includes Security Services, consisting of Distributed Denial of Service (“DDoS”) Protection Services and Managed DNS Services. On April 1, 2017, we completed the sale of our iDefense Security Intelligence Services (“iDefense”) business.

We have one reportable segment, which consists of Registry Services and Security Services. We have operations inside as well as outside the United States (“U.S.”). For certain additional information about our segment, including a geographic breakdown of revenues and changes in revenues, see “Management’s Discussion and Analysis of Financial Condition and Results of Operations” in Item 7 and Note 7, “Geographic and Customer Information” of our Notes to Consolidated Financial Statements in Item 15 of this Form 10-K.

We were incorporated in Delaware on April 12, 1995. Our principal executive offices are located at 12061 Bluemont Way, Reston, Virginia 20190. Our telephone number at that address is (703) 948-3200. Our common stock is traded on the NASDAQ Global Select Market under the ticker symbol VRSN. VERISIGN, the VERISIGN logo, and certain other product or service names are registered or unregistered trademarks in the U.S. and other countries. Other names used in this Form 10-K may be trademarks of their respective owners. Our primary website is https://www.Verisign.com. The information available on, or accessible through, this website is not incorporated in this Form 10-K by reference.

Our Annual Report on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K, and amendments to those reports filed or furnished pursuant to Section 13(a) or 15(d) of the Securities Exchange Act of 1934, as amended (the “Exchange Act”), are available, free of charge, on the Investor Relations section of our website as soon as is reasonably practicable after filing such reports with the Securities and Exchange Commission (the “SEC”). The public may read and copy any materials we file with the SEC at the SEC’s Public Reference Room at 100 F Street, NE, Washington, DC 20549. The public may obtain information on the operation of the Public Reference Room by calling the SEC at 1-800-SEC-0330. The SEC maintains an internet site that contains reports, proxy and information statements, and other information regarding issuers that file electronically with the SEC at https://www.sec.gov.

Pursuant to our agreements with the Internet Corporation for Assigned Names and Numbers (“ICANN”), we make available on our website (at https://www.Verisign.com/zone) files containing all active domain names registered in the .com and .net registries. At the same website address, we make available a summary of the active zone count registered in the .com and .net registries and the number of .com and .net domain names in the domain name base. The domain name base is the active zone plus the number of domain names that are registered but not configured for use in the respective top level domain zone file plus the number of domain names that are in a client or server hold status. These files and the related summary data are updated at least once per day. The update times may vary each day. The number of domain names provided in this Form 10-K are as of midnight of the date reported.

We announce material financial information to our investors using our investor relations website https://investor.Verisign.com, SEC filings, investor events, news and earnings releases, public conference calls and webcasts. We use these channels as well as social media to communicate with our investors and the public about our company, our products and services, and other issues. It is possible that the information we post on social media could be deemed to be material information. Therefore, we encourage investors, the media, and others interested in our Company to review the information we post on the social media channels listed below. This list may be updated from time to time on our investor relations website.

https://www.Facebook.com/Verisign

https://www.Twitter.com/Verisign

https://www.LinkedIn.com/company/Verisign

https://www.YouTube.com/user/Verisign

https://www.Verisign.com

https://blog.Verisign.com

The contents of these websites are not intended to be incorporated by reference into this Annual Report on Form 10-K or in any other report or document we file.

Registry Services

Registry Services operates the authoritative directory of and/or the back-end systems for all .com, .net, .cc, .tv, .gov, .jobs,

.edu and .name domain names, among others. Registry Services allows individuals and organizations to establish their online identities, while providing the secure, always-on access they need to communicate and transact reliably with large-scale online audiences.

We are the exclusive registry of domain names within the .com, .net, and .name generic top-level domains (“gTLDs”), among others, under agreements with ICANN and also, with respect to the .com agreement, the U.S. Department of Commerce (“DOC”). We are also the exclusive registry of domain names within certain transliterations of .com and .net in a number of different native languages and scripts (“IDN gTLDs”). As a registry, we maintain the master directory of all second-level domain names in these gTLDs and IDN gTLDs (e.g., johndoe.com and janedoe.net). Our global constellation of domain name servers provides internet protocol (“IP”) address information in response to queries, enabling the use of browsers, email systems, and other systems on the internet. In addition, we own and maintain the shared registration system that allows all registrars to enter new second-level domain names into the master directory and to submit modifications, transfers, re-registrations and deletions for existing second-level domain names (“Shared Registration System”).

Separate from our agreements with ICANN, we have agreements to be the exclusive registry for the .tv and .cc country code top-level domains (“ccTLDs”) for Tuvalu and Cocos (Keeling) Islands, respectively, and to operate the back-end registry systems for the .gov, .jobs, and .edu sponsored TLDs. These TLDs are also supported by our global constellation of domain name servers and Shared Registration System.

We also provide internationalized domain name (“IDN”) services that enable internet users to access websites in characters representing their local language. Our gTLDs and ccTLDs can support standards compliant registrations in over 100 different native languages and scripts.

Domain names can be registered for between one and 10 years. The fees charged for .com, .net and .name may only be increased according to adjustments prescribed in our agreements with ICANN over the applicable term. With respect to .com, price increases require prior approval by the DOC according to the terms of Amendment 32 of the Cooperative Agreement, as amended, between the DOC and Verisign (“Cooperative Agreement”). Revenues for .cc and .tv domain names and our IDN gTLDs are based on a similar fee system and registration system, although the fees charged are not subject to the same pricing restrictions as those imposed by ICANN on .com, .net and .name. The fees received from operating the .gov registry are based on the terms of Verisign’s agreement with the U.S. General Services Administration. The fees received from operating the .jobs registry infrastructure, and that of others for which Verisign provides such services, are based on the terms of Verisign’s agreements with those respective registry operators.

Historically, we have experienced higher domain name growth in the first quarter of the year compared to other quarters. Our quarterly revenue does not reflect these seasonal patterns because the preponderance of our revenue for each quarterly period is provided by the ratable recognition of our deferred revenue balance. The effect of this seasonality has historically resulted in the largest amount of growth in our deferred revenue balance occurring during the first quarter of the year compared to the other quarters.

Security Services

Security Services provides infrastructure assurance to organizations and is comprised of DDoS Protection Services and Managed DNS Services.

DDoS Protection Services supports online business continuity by providing monitoring and mitigation services against DDoS attacks. We help companies stay online without needing to make significant investments in infrastructure or establish internal DDoS expertise. As a cloud-based service, DDoS Protection Services can be deployed quickly and easily, with no customer premise equipment required. This saves time and money through operational efficiencies, support costs, and economies of scale to provide detection and protection against the largest DDoS attacks. Customers include financial institutions, software-as-a-service providers, e-commerce providers, and media companies. Customers pay a subscription fee that varies depending on the customer’s network requirements.

Managed DNS Services is a hosting service that delivers DNS resolution, improving the availability of web-based systems. It provides DNS availability through a globally distributed, securely managed, cloud-based DNS infrastructure, allowing enterprises to save on capital expenses associated with DNS infrastructure deployment and reduce operational costs and complexity associated with DNS management. Managed DNS service provides full support for DNS Security Extensions (“DNSSEC”) compliance features and Geo Location traffic routing capabilities. DNSSEC is designed to protect the DNS infrastructure from man-in-the-middle attacks that corrupt, or poison, DNS data. Geo Location allows website owners to customize responses for end-users based on their physical location or IP address, giving them the ability to deliver location-specific content. Customers include financial institutions, e-commerce, and software-as-a-service providers. Customers pay a subscription fee that varies based on the amount of DNS traffic they receive.

Operations Infrastructure

Our operations infrastructure consists of three secure data centers in Dulles, Virginia; New Castle, Delaware; and Fribourg, Switzerland as well as more than 100 resolution sites around the world. These secure data centers operate 24 hours a day, supporting our business units and services. The performance and scale of our infrastructure are critical for our business, and give us the platform to maintain our leadership position. Key features of our operations infrastructure include:

•	Distributed Servers: We operate a large number of high-speed servers globally to support localized capacity and availability demands. In conjunction with our proprietary software, processes and procedures, this platform offers rapid failover, global and local load balancing, and threshold monitoring on critical servers.

•	Networking: We deploy and maintain a redundant and diverse global network, maintain high-speed, redundant connections to numerous internet service providers, and maintain peering relationships globally to ensure that our critical services are readily accessible to customers at all times.

•

Security: We incorporate architectural concepts such as protected domains, restricted nodes and distributed access control in our system architecture. In addition, we employ firewalls and intrusion detection software, as well as proprietary security mechanisms at many points across our infrastructure. We perform recurring internal vulnerability testing and controls audits, and also contract with third-party security consultants who perform periodic penetration tests and security risk assessments on our systems. Verisign has engineered resiliency and diversity into how it hosts classes of products throughout its set of interconnected sites to mitigate unknown vendor defects and zero-hour security vulnerabilities. This includes different physical security silos, which themselves are separated into bulkheads, and in which servers are located. Corporate networks are in their own physical silo. Thus, the corporate networks to which personnel directly connect are separated from the silos that house production services; administration of production gear from corporate systems must go through an internal, fortified intermediary; and account credentials used within the corporate networks are not used within the production silos, nor on the fortified systems.

•	Data Integrity: Verisign employs both phased and systemic integrity validation operations via a number of proprietary mechanisms on all internal DNS publication operations.

As part of our operations infrastructure for our Registry Services business, we operate all authoritative domain name servers that answer domain name queries for the .com and .net zones, as well as for the other TLDs for which we are the registry operator. We also perform the root zone maintainer function for the core of the internet’s Domain Name System (“DNS”) and administer and operate two of the 13 root zone servers that contain authoritative data for the very top of the DNS hierarchy. Our domain name servers provide the associated authoritative name servers and IP addresses for every .com and .net domain name on the internet and a large number of other TLD queries, resulting in an average of approximately 132 billion transactions per day. These name servers are located in resolution facilities which are in a controlled and monitored environment, incorporating security and system maintenance features. This network of name servers is one of the cornerstones of the internet’s DNS infrastructure.

We have continuously expanded our infrastructure to meet demands to support normal and peak system load and attack volumes based on what we have experienced historically, as well as to address projected internet attack trends.

Call Centers and Help Desk: We provide customer support services through our phone-based call centers, email help desks and web-based self-help systems. Our Virginia call center is staffed 24 hours a day, every day of the year to support our businesses. All call centers have a staff of trained customer support agents and also provide web-based support services utilizing customized automatic response systems to provide self-help recommendations.

Operations Support and Monitoring: Through our network operations centers, we have an extensive monitoring capability that enables us to track the status and performance of our critical database systems and our global resolution systems. Our network operations center is staffed 24 hours a day, every day of the year.

Disaster Recovery Plans: We have disaster recovery and business continuity capabilities that are designed to deal with the loss of entire data centers and other facilities. Our Registry Services business maintains dual mirrored data centers that allow rapid failover with no data loss and no loss of function or capacity, as well as off-continent tertiary Registry Services capabilities. Our critical data services (including domain name registration and global resolution) use advanced storage systems that provide data protection through techniques such as synchronous mirroring and remote replication.

Marketing, Sales and Distribution

We seek to expand our business through focused marketing campaigns and programs that target growth in the .com and .net domain name base, both domestically and in foreign markets. We offer promotional marketing programs for our registrars based upon market conditions and the business environment in which the registrars operate. We provide tools to be used by both registrars and end users to allow them to find relevant domain names. We market our Security Services worldwide through multiple distribution channels, including direct sales and indirect channels. We have marketing and sales offices in several countries around the world.

Research and Development

We believe that timely development of new and enhanced services, including monitoring and visualization, registry provisioning platforms, navigation and resolution services, data services, value added services, and Security Services, as well as new and enhanced ways to ensure the security, stability, and resiliency of our services, is necessary to remain competitive in the marketplace. During 2017, 2016, and 2015 our research and development expenses were $52.3 million, $59.1 million and $63.7 million, respectively.

Our future success will depend, in large part, on our ability to continue to maintain and enhance our current technologies and services and to develop new ones. We actively investigate and incubate new concepts and evaluate new business ideas through our innovation pipeline. We expect that most of the future enhancements to our existing services and our new services will be the result of internal development efforts in collaboration with suppliers, other vendors, customers, and the technology community. Under certain circumstances, we may also acquire or license technology from third parties.

The markets for our services are dynamic, characterized by rapid technological developments, frequent new product introductions, and evolving industry standards. The constantly changing nature of these markets and their rapid evolution will require us to continually improve the performance, features, and reliability of our services, particularly in response to competitive offerings, and to introduce both new and enhanced services as quickly as possible and prior to our competitors.

Competition

We compete with numerous companies in both the Registry Services and Security Services businesses. The overall number of our competitors may increase and the identity and composition of competitors may change over time.

New technologies and the expansion of existing technologies may increase competitive pressure. In addition, our markets are characterized by announcements of collaborative relationships involving our competitors. The existence or announcement of any such relationships could adversely affect our ability to attract and retain customers.

Competition in Registry Services: We face competition in the domain name registry space from other gTLD and ccTLD registries that are competing for the business of entities and individuals that are seeking to obtain a domain name registration, establish a web presence, as well as other uses of domain names, such as branded email. In addition to the gTLDs and ccTLDs we operate or for which we provide back-end registry services, there are over 1,000 other operational gTLD registries, over 250 Latin script ccTLD registries, more than 50 IDN ccTLD registries, and over 80 IDN gTLD registries. Under our agreements with ICANN, we are subject to certain restrictions in the operation of .com, .net and .name on pricing, bundling, marketing, methods of distribution, the introduction of new registry services, and use of registrars, that do not apply to ccTLDs and other gTLDs and therefore may create a competitive disadvantage.

To the extent end-users navigate using search engines or social media, as opposed to direct navigation, we may face competition from search engine operators such as Google, Microsoft, and Verizon, operators of social media networks such as Facebook, operators of ecommerce platforms such as Amazon, eBay and Taobao, and operators of microblogging tools such as Twitter. In addition, we may face competition from these social media businesses and ecommerce platforms if they are used to

establish an online presence by end-users rather than through the use of a domain name. Furthermore, to the extent end-users increase the use of web and mobile applications to locate and access content, we may face competition from providers of such web and mobile applications.

We also face competition from service providers that offer outsourced domain name registration, resolution and other DNS services to organizations that require a reliable and scalable infrastructure. Among our competitors are Neustar, Inc., Afilias plc, and CentralNic Ltd.

Competition in Security Services: Several of our current and potential competitors have longer operating histories and/or significantly greater financial, technical, marketing, sales, and other resources than we do and therefore may be able to respond more quickly than we can to new or changing opportunities, technologies, standards, and customer requirements. Many of these competitors also have broader and more established distribution channels that may be used to deliver competing products or services directly to customers through bundling or other means. If such competitors were to bundle competing products or services for their customers, we may experience difficulty establishing or increasing demand for our products and services or distributing our products successfully. In addition, it may be difficult to compete against consolidation and partnerships among our competitors which create integrated product suites.

Our Security Services business faces competition from companies such as Akamai Technologies, Inc., Cisco, Neustar, Inc., and Oracle, among others.

Industry Regulation

The internet is governed under a multi-stakeholder model comprising civil society, the private sector including for-profit and not-for-profit organizations such as ICANN, governments including the U.S. government, academia, non-governmental organizations, and international organizations. ICANN plays a central coordination role in the multi-stakeholder system. ICANN is mandated through its bylaws to uphold a private sector-led multi-stakeholder approach to internet governance for the public benefit. The multi-stakeholder process has and will continue to create policies, programs, and standards that directly or indirectly impact or affect our business. In addition, country-level regulations, such as those implemented by China, impose additional costs on our Registry Services, can affect the growth or renewal rates of domain name registrations, and may also affect our ability to do business. Similarly, in the European Union, legislative and regulatory bodies responsible for data privacy continue to enhance and modify data privacy protections, which impacts our collection and delivery of personal data as we provide our domain name registry services, and could affect costs of operation.

As the exclusive registry of domain names within the .com and .net gTLDs, we have entered into certain agreements with ICANN and, in the case of .com, the DOC under a Cooperative Agreement.

.com Registry Agreement

Following the extension of the .com Registry Agreement on October 20, 2016, the .com Registry Agreement provides that we will continue to be the sole registry operator for domain names in the .com gTLD through November 30, 2024. As part of the extension of the .com Registry Agreement, the Company and ICANN agreed to cooperate and negotiate in good faith to amend the terms of the .com Registry Agreement: (i) by October 20, 2018, to preserve and enhance the security and stability of the internet or the .com TLD, and (ii) as may be necessary for consistency with changes to, or the termination or expiration of, the Cooperative Agreement. The .com Registry Agreement includes pricing restrictions for .com domain name registrations, which sets a maximum price of $7.85 for a .com domain name registration and is consistent with the terms of the Cooperative Agreement as set forth below. In addition, on a quarterly basis, we pay $0.25 to ICANN for each annual increment of a domain name registered or renewed during such quarter. We are required to comply with and implement temporary specifications or policies and consensus policies, as well as other provisions pursuant to the .com Registry Agreement relating to handling of data and other registry operations. The .com Registry Agreement also provides a procedure for Verisign to propose, and ICANN to review and approve, additional registry services.

The .com and .net Registry Agreements with ICANN contain a “presumptive” right of renewal upon the expiration of their current terms. In addition to ICANN’s approval, a renewal of the .com Registry Agreement must be approved by the DOC, which, under certain circumstances, could refuse to grant its approval to the renewal of the .com Registry Agreement on similar terms, or at all. ICANN could terminate or refuse to renew our .com and/or .net Registry Agreements if, upon proper notice, (i) we fail to cure a fundamental and material breach of certain specified obligations, and (ii) we fail to timely comply with a final decision of an arbitrator or court. See “Risk Factors - Risks arising from our agreements governing our Registry Services business could limit our ability to maintain or grow our business” in Part I, Item 1A of this Annual Report on Form 10-K for further information. Our .com and .net Registry Agreements contain obligations to provide access to our systems, restrictions on our ability to market and bundle our products and services, and restrictions on our ability to control our registrar channel or own a registrar.

See the risk factor “Risks arising from our agreements governing our Registry Services business could limit our ability to maintain or grow our business” in Part 1A for further information.

Cooperative Agreement

The Cooperative Agreement will expire on November 30, 2018, unless the DOC, in its sole discretion, extends the term. The DOC has the right to conduct a public interest review for the sole purpose of determining whether the DOC will exercise its right to extend the term of the Cooperative Agreement. In connection with the aforementioned review, we agreed to cooperate fully and to work in good faith to reach a mutual agreement with the DOC to resolve issues identified in such review and to work in good faith to implement any agreed upon changes as of the expiration of the current term of the Cooperative Agreement.

The Cooperative Agreement provides that the Maximum Price (as defined in the .com Registry Agreement) of a .com domain name shall not exceed $7.85 for the term of the .com Registry Agreement, except that we are entitled to increase the Maximum Price of a .com domain name due to the imposition of any new Consensus Policy or documented extraordinary expense resulting from an attack or threat of attack on the Security or Stability of the DNS as described in the .com Registry Agreement, provided that we may not exercise such right unless the DOC provides prior written approval that the exercise of such right will serve the public interest, such approval not to be unreasonably withheld. The Cooperative Agreement further provides that we shall be entitled at any time during the term of the .com Registry Agreement to seek to remove the pricing restrictions contained in the .com Registry Agreement if we demonstrate to the DOC that market conditions no longer warrant pricing restrictions in the .com Registry Agreement, as determined by the DOC.

The Cooperative Agreement also provides that the DOC’s approval of the .com Registry Agreement is not intended to confer federal antitrust immunity on us with respect to the .com Registry Agreement. The Cooperative Agreement also provides that any renewal or extension of the .com Registry Agreement is subject to prior written approval by the DOC. The DOC shall approve such renewal if it concludes that approval will serve the public interest in (a) the continued security and stability of the internet DNS and the operation of the .com registry including, in addition to other relevant factors, consideration of Verisign’s compliance with consensus policies and technical specifications, its service level agreements as set forth in the .com Registry Agreement, and the investment associated with improving the security and stability of the DNS, and (b) the provision of Registry Services as defined in the .com Registry Agreement at reasonable prices, terms and conditions. The parties have an expectancy of renewal of the .com Registry Agreement so long as the foregoing public interest standard is met and Verisign is not in breach of the .com Registry Agreement.

.net Registry Agreement

We entered into a renewal of our .net Registry Agreement with ICANN that was effective on July 1, 2017. The .net Registry Agreement provides that we will continue to be the sole registry operator for domain names in the .net TLD through June 30, 2023.

Root Zone Maintainer Service Agreement

In the fourth quarter of 2016, we entered into a new agreement with ICANN, the Root Zone Maintainer Service Agreement (“RZMA”) under which we perform the Root Zone Maintainer functions on behalf of ICANN. The RZMA will expire on October 19, 2024, with an automatic renewal unless earlier terminated.

The descriptions of the .com Registry Agreement, the Cooperative Agreement, and the .net Registry Agreement are qualified in their entirety by the text of the complete agreements that are incorporated by reference as exhibits in this Form 10-K.

Intellectual Property

We rely on a combination of copyrighted software, trademarks, service marks, patents, trade secrets, know-how, restrictions on disclosure, and other methods to protect our proprietary assets. We also enter into confidentiality and/or invention assignment agreements with our employees, consultants and current and potential affiliates, customers and business partners. We also control access to and distribution of proprietary documentation and other confidential information.

We have been issued numerous patents in the U.S. and abroad, covering a wide range of our technologies. Additionally, we continue to file numerous patent applications with respect to certain of our technologies in the U.S. Patent and Trademark Office and internationally. Patents may not be awarded with respect to these applications and even if such patents are awarded, such patents may not provide sufficient protection of our intellectual property. We continue to focus on growing our patent portfolio and consider opportunities for its strategic use.

We have obtained trademark registrations for the VERISIGN mark and VERISIGN logo in the U.S. and certain countries, and have pending trademark applications for the VERISIGN logo in a number of other countries. We have common law rights in other proprietary names. We take steps to enforce and police Verisign’s trademarks. We rely on the strength of our Verisign brand to help differentiate ourselves in the marketing of our products and services.

Our principal intellectual property consists of, and our success is dependent upon, proprietary software used in our Registry Services business and certain methodologies (many of which are patented or for which patent applications are pending) and technical expertise and proprietary know-how we use in both the design and implementation of our current and future registry services. We own our proprietary Shared Registration System through which registrars submit second-level domain name registrations for each of the registries we operate, as well as the ATLAS distributed lookup system which processes billions of queries per day. Our Security Services business also depends on proprietary intellectual property. Some of the software and protocols used in our business are in the public domain or are otherwise available to our competitors, and some are based on open standards set by organizations such as the Internet Engineering Task Force. To the extent any of our patents are considered “standard essential patents,” we may be required to license such patents to our competitors on reasonable and non-discriminatory terms or otherwise be limited in our ability to assert such patents.

Employees

The following table shows a comparison of our consolidated employee headcount, by function:

	As of December 31,
	2017			2016			2015
Employee headcount by function:
Cost of revenues	288			324			314
Sales and marketing	133			143			183
Research and development	226			228			253
General and administrative	305			295			269
Total	952			990			1,019

We have never had a work stoppage, and no U.S.-based employees are represented under collective bargaining agreements. Our ability to achieve our financial and operational objectives depends in large part upon our continued ability to attract, integrate, train, retain, and motivate highly qualified sales, technical and managerial personnel, and upon the continued service of our senior management and key sales and technical personnel. Competition for qualified personnel in our industry and in some of our geographical locations is intense, particularly for software development personnel.