Comments (16)

1. Jothan Frakes says:

   August 26, 2021 at 9:23 pm

   Registrars had sought to have more context about the percentages in this report identifying that they were referential to the small subset of registrars that triggered review, so that there would not be misunderstanding or misinterpretation of the figures.

   There are nearly 3000 registrars, so any percentages that are quoted within the statistics in ICANN’s reports should have probably factored that into a column to show the fractional percentage involved.

   Reply
   • Kevin Murphy says:

     August 28, 2021 at 10:19 pm

     “The report summarizes the methodology and the results of the audit of 126 registrars who in aggregate manage over 90% of all registered generic second-level domain names.”

     “As detailed in the report, ICANN Contractual Compliance identified 111 registrars that were not fully compliant with the RAA’s requirements related to the receiving and handling of DNS abuse reports”

     There are not 3,000 registrars. Not even close.

     Reply
     • Jothan Frakes says:

       August 30, 2021 at 7:18 am

       You are correct, the number was not 3000, it was 2504 according to ICANN and internic.net

       https://www.icann.org/en/accredited-registrars?sort-direction=asc&sort-param=name&page=1

       Whether 2500 or 3000, the point was that the percentage cited was self-referential within the document and the 126 involved in the audit, and not indicative of the actual overall % of ALL registrars.

       The overall percentages would not have been as news worthy.

       Reply
       • Kevin Murphy says:

         August 31, 2021 at 12:03 am

         Not sure I agree with that.

         ICANN said its survey covered “126 registrars who in aggregate manage over 90% of all registered generic second-level domain names.”

         It definitely covers all the major registrars, including whoever you’re working for right now.

         Reply
         • Jothan Frakes says:

           August 31, 2021 at 4:03 pm

           I own and operate a small, boutique registrar which was not part of the audit. I care about how registrars are portrayed as a result.

         • Kevin Murphy says:

           August 31, 2021 at 9:38 pm

           Very sorry Jothan. I seem to be making a habit in this thread of forgetting which registrar people work for nowadays. Just a series of brain farts. I apologise if I upset you with my error.

           I think ICANN’s sample of registrars selected for this audit was probably a lot more representative than you might think.

           I wrote about it earlier this year.

           http://domainincite.com/26191-153-registrars-fingered-for-icann-security-probe

           Most of the ostensible 2300 registrars are just shells. Many more don’t actually sell domains in any serious way. We both know this.

2. Owen says:

   August 26, 2021 at 10:10 pm

   The headline is grossly inaccurate and misrepresents ICANN’s report. Per the report (and your article), 15 out of 126 registrars (e.g. 11%) did not pass the audit. They are subject to additional testing later on to confirm that they have remediated any deficiencies. Eleven percent is not “most”.

   The most cited issue was “Website missing abuse tracking procedures” (75 out of 126, or 60%). This is a very minor deficiency, can also mean the tracking procedures were incomplete in ICANN’s opinion, and easily fixed. The report does not state that registrars are failing to combat DNA abuse, and this article should not be construed in that manner.

   Regarding the notices/follow up from ICANN (which you incorrectly classify as “failures”), it could be ICANN inquiring “we could not find your dedicated law enforcement telephone number”, and the registrar replying “that number is available upon request, not published online because it is a personal mobile number, and this is the number”. That example did happen, and certainly does not mean the registrar failed the audit as you allege.

   Reply
   • Volker Greimann says:

     August 27, 2021 at 9:53 pm

     Indeed, this “major failure” could be remedied in many cases by adding two words (“and tracked”) to the description of abuse procedures on registrar websites, and was not identified for some registrars when registrars presented the identical language to ICANN as part of their application to become accredited.

     Reply
   • Kevin Murphy says:

     August 28, 2021 at 10:28 pm

     I did not allege anything. ICANN did. I reported ICANN’s numbers. If you have a problem with how ICANN reports numbers, talk to ICANN. Don’t expect to get a response.

     Reply
   • Kevin Murphy says:

     August 28, 2021 at 11:06 pm

     If the registrar failed the audit, it failed the audit.

     If ICANN says you’ve got to give out your mobile number in order to pass the audit, and you don’t do that, then yeah you failed the fucking audit bro.

     Is that fair? Maybe. Maybe not. Do I care? Of course not.

     You have one job, Owen. Don’t embarrass Tucows by failing to abide by ICANN’s rules, no matter how stupid.

     How you doing with that?

     Reply
     • Volker Greimann says:

       August 29, 2021 at 11:01 pm

       Ah, but there is the crux of the matter. Certain contractual obligations may be interpreted different ways and cause a few back and forths before ICANN ultimately accepts the original answer given by the registrar.
       Take the LEA abuse contact:
       ICANN held the position that we had to give them that number and address. The contract however only obliges us to provide that to LEAs, which ICANN is not. So we refused to maintain the functionality of that contact. ICANN ultimately accepted that answer.

       Or take the regular abuse contact:
       ICANN originally declared a failure of the registrar to respond to the test email sent to the abuse contact as failure. Yet the RAA only requires a registrar to actual abuse complaints, which the test email clearly was not, so there was no duty to respond and therefore no failure. ICANN ultimately accepted that answer.

       Or take the requirement to provide a tracking mechanism:
       ICANN took the position that such a mechanism must not only be present, but also be mentioned in the abuse process description even though there is no point to it. Many registrars ultimately added two words to their description to avoid prolonging the argument.

       And the list goes on…

       And Owen is absolutely correct:
       A registrar has only failed the audit after the audit is completed, not after providing the original answers, because, as shown above, interpretations may vary.

       Reply
       • Michael Palage says:

         August 31, 2021 at 1:58 pm

         Volker,

         Just to clarify, “refuse to maintain” actually means “refuse to maintain a separate contact.” It appears from the Hexonet abuse website, that there is information for both LEA and the general public to use the same email address and phone number.

         While I agree with you that having the words “tracking mechanism” in the stated policy may be a little bit of a nit, I do think it is important to have a formal tracking procedure in place instead of any ad hoc procedure. However, hopefully any ad hoc procedures without adequate tracking mechanisms were identified in the actual audit itself.

         With regard to the title of Kevin’s article, while he is correct that it is accurate from a letter of the law perspective, I think you and Owen make a valid point about the “spirit” of compliance. I probably would have used the word “deficiencies” similar to the language in the audit report, but it is Kevin’s blog to he gets to choose his own words.

         That being sad I believe the bigger story is that ICANN only audited 126 registrars. I did a spot check of several smaller registrars that were likely not audited based on their size and most that I checked also had the technical deficiencies you cited above. While ICANN did the statistical proper thing of including 126 registrars comprising 90% of the market, that means that over 2,250 ICANN accredited registrars were not checked. I wonder what ICANN is doing to address these deficiencies.

         Having tried to spot check various accredited registrars, I feel like the process for finding an abuse contact page could be a lot easier. Much like Registries have a standard page for RDDS look-ups, WHOIS.NIC.TLD, perhaps have a standard page for CPH’s off of their designated ICANN company URL would be a positive thing, e.g. abuse.hexonet.com or hexonet.com/abuse. Has there been any discussion of that within the RrSG?

         Best regards,

         Michael

         Reply
         • Owen says:

           August 31, 2021 at 9:46 pm

           Michael-

           ICANN generally only audited one registrar per family (assuming common control/operation and there were exceptions). There are about 470 registrars in the Web.com family, and around 1250 in the NameBright family (all of the registrars are for aftermarket/expired domain catching purposes). So that means only about 395 registrars were not audited. My guess is that both Web.com and NameBright family member(s) were in the audit due to their size.

           ICANN did not audit every registrar: they selected ones that had at least 5 abuse complaints filed with ICANN or were identified by registries as having abusive domains. As that covered about 82% of total registrars (by family) and over 90% of DUM, that’s a pretty extensive sample size. To cover the rest of the registrars- which have basically no abuse issues- would have tripled the cost of the audit. I’m not sure those costs outweigh the benefits, and differs from the first registrar ICANN did of all registrars (which was to establish a baseline).

     • Owen says:

       August 30, 2021 at 4:08 pm

       Only 11 registrars failed the audit and will be retested. The remaining registrars passed and received clean audit reports, and ICANN did not even remotely claim most registrars failed as you are incorrectly interpreting the report.

       Just because everything is not 100% perfect in a first review of an audit does not mean that is a failure. Sometimes the auditor needs clarification, or as Volker mentions, two words need to be added to one webpage, then it’s a pass (as opposed to a “fail”). That’s how audits work.

       I’m confused as to why you’re telling me not to embarrass Tucows- I don’t work there and never have. I work at Namecheap, and we were one of the 15 that did “pass with flying colors” per your article (which means we passed without further follow up from ICANN after we submitted our RFI and supporting documentation). Our “pass” is the same as the other 115 registrars where ICANN closed their audit and will not retest later.

       Reply
       • Kevin Murphy says:

         August 30, 2021 at 11:58 pm

         Sorry brother, I typed the wrong company name for your employer. My bad. I screwed up.

         Reply
       • Kevin Murphy says:

         August 31, 2021 at 9:44 pm

         ICANN said:

         “As detailed in the report, ICANN Contractual Compliance identified 111 registrars that were not fully compliant with the RAA’s requirements related to the receiving and handling of DNS abuse reports”

         Why are you blaming me for this? I’m just reporting what ICANN PR said.

         Reply