I'm not sure I get it. If anyone registers a domain first.second.name then you are basically registering a subdomain under second.name, right? You don't own anything, second.name owns your subdomain and can do whatever they want with it
Delegating multiple levels down is allowed by DNS spec but almost never done, and causes problems. For starters, some registrars just straight up did not handle the first.last.name case at all. Which is particularly bad for .name because originally, you could only register third-level domains. Only later did .name added second-level domain registration.
This creates an obvious collision problem: if John Doe registers john.doe.name first, and then Jane Doe wants to register doe.name, what happens?
You might think that, obviously, both registrations stick. But this means John Doe owns a subdomain of Jane Doe's namespace, that Jane Doe cannot get rid of or otherwise control. When someone looks up records on john.doe.name, doe.name is never queried; .name skips it. This causes all sorts of problems for cookies: John Doe can now set cookies on Jane Doe's website, and Jane Doe's website always sets cookies that John Doe's website can read[0].
The time-reversed scenario (John Doe registers after Jane Doe) is even worse. Obviously, top-level domain operators should not be allowed to project subdomains onto other people's registrations like this. Like, imagine if Verisign decided you could register subdomains on someone else's domain, that they did not control and could not get rid of, if you paid them a little extra? There would be all sorts of shenanigans.
The alternative resolution is confiscation: when Jane Doe registers doe.name, John Doe loses his website. This is more in line with how you thought it was working. And, indeed, what Verisign is planning to do is basically this en masse, dropping all the third-level delegations. Probably because the operational headaches of managing two different conflicting delegation schemes was too much.
[0] This is actually a problem for any DNS suffix that is shared across multiple websites; there's a Public Suffix List that exists specifically to keep you from, say, writing cookies to .com that hit every website. But doe.name isn't exactly a public suffix: it's Jane Doe's personal website, one that just happens to have a suffix collision with another website because of a stupid idea someone had.
I actually thought that one of the two registrations would be denied.
The only (barely) sane way I see how a registrar could offer both 2nd and 3rd level domains at the same time would be to keep them entirely separate:
Maintain two lists: One is a list of ordinary 2nd level domains that were directly sold, say something like whatsina.name.
The other would be a list of "commons" 2nd level domains that cannot be sold, because people own individual 3rd level domains on it, like doe.name above.
Which domain belongs to which list would realistically be first-come first-serve: If Jane Doe got there first and purchased doe.name, it would become a directly sold domain, and John Doe's (and also Jack Doe's) registration requests for john.doe.name and jack.doe.name would be denied.
Conversely, if John Doe got his registration for john.doe.name through first, doe.name would become a "commons" domain and Jane Doe's request would be denied, but Jack Doe's request for jack.doe.name would still get through.
Though I guess management at registrars doesn't like the phrase "cannot be sold" so I guess that wasn't how it was handled?
First off, it means selling doe.name separate from john.doe.name is literally impossible, because the e-mail forwarder only works if doe.name publishes the correct MX records. You cannot half-delegate a domain by record type, so .name can't shadow doe.name's MX record. So you're entirely correct that one of the two registrations gets denied because that's literally the only way the mail forwarder still works.
Second, it means hell for VeriSign's backend systems engineers. Along with the list separation you mentioned, any time someone registers first.last.name, it needs to also create a parallel registration for last.name, publish MX records on the corresponding subzone, and spin up a new mail server to forward mail for people who own a subdomain of last.name. I suspect this is part of why VeriSign wants to kill third-level domains more than anything else.
Although it is weird to have a registrar where you get to pick both the second and the third level freely.
> When the TLD name was first launched, only third-level registrations and forwarded e-mail addresses were available.