1. Domains are guaranteed to be unique. We have global registrars and global DNS, its not possible to have duplicate domains..

2. Don't utilize a domain that is shared by lots of people. There is also lots of DNS tricks (TXT records) to "pin" a user to a domain or whatever. If the domain is shared (for example a company website), you just add a TXT record denoting what private key is allowed to do things. Heck you could setup fine grained permissions per key via txt records.

2. Yes they can expire and that situation is detectable. How is this any different than twitter or another service allowing re-use of a deleted username?

Of course domain names are unique... As long as BGP routes aren't poisoned or a million other issues. However, the issue mentioned in this thread isn't whether company ABC has abc.com but that 10 people at ABC can administer abc.com.

Twitter allowing reuse of deleted usernames is completely different than an existing domain that is used as a identity credential to represent different people over time.

This thread is not about whether domains can represent properties on the Internet but whether domains are valid for identification purposes of people as login credentials. They aren't valid, because a domain doesn't uniquely represent a person.

An idea to help with this would be a new resource record type, with an opaque value that changes only when the domain changes hands (yes, it is up to the registrar to decide when to change the value).

The resource records would live underneath registry.arpa, which has delegations that correspond to delegations at the DNS root; so to find out if example.com has changed, you can query:

    $ delv example.com.registry.arpa OWNER
    example.com.registry.arpa.     3660     IN     OWNER     "MEpnFkIk4sKW_oLPEl-R7WxFSAnWvgZnLYmRtn-3BkY"

You could put other stuff in there too, such as the start-date of the current registration... this is starting to sound like whois but structured and machine readable. Why on earth did that never take off!

An interesting related thing is the approach adopted by iSCSI, which constructs iSCSI Qualified Name (IQN)s by qualifying the domain name with the dates of registration.

So iqn.2003-05.com.example is a different identity to iqn.2021-01.com.example.