Latest news of the domain name industry

Recent Posts

ICANN confirms domain privacy is for all

Kevin Murphy, January 22, 2016, Domain Policy

Commercial entities will not be excluded from buying domain privacy services, ICANN’s GNSO Council has confirmed.

The Council last night voted unanimously to approve a set of recommendations that would make it compulsory for privacy and proxy services to be accredited by ICANN for the first time.

The recommendations govern among other things how privacy services are expected to behave when they receive notices of trademark or copyright infringement.

But missing is a proposal that would have prevented the use of privacy for “transactional” web sites, something which caused a great deal of controversy last year.

The newly adopted recommendations clearly state that nobody is to be excluded from privacy on these grounds.

The Council voted to adopt the final, 93-page report of the Privacy and Proxy Services Accreditation Issues (pdf) working group, which states:

Fundamentally, P/P services should remain available to registrants irrespective of their status as commercial or non-commercial organizations or as individuals. Further, P/P registrations should not be limited to private individuals who use their domains for non-commercial purposes.

The minority view that web sites that process financial transactions should not be able to use privacy came from intellectual property, anti-abuse and law enforcement community members.

However, opponents said it would infringe the privacy rights of home business owners, bloggers, political activists and others.

It could even lead to vicious “doxing”-related crimes, such as “swatting”, where idiots call in fake violent crime reports against rivals’ home addresses, some said.

It also turned out, as we revealed last November, that 55% of US presidential candidates operate transactional web sites that use privacy on their domains.

Two separate registrar initiatives, one backed by the Electronic Frontier Foundation, started letter-writing campaigns that resulted in over 20,000 comments being received on the the PPSAI’s initial report last July.

Those comments are acknowledged in the PPSAI final report that the GNSO Council just approved.

The adopted recommendations (which I’ll get into in a separate article) still have to be approved by the ICANN board of directors and have to undergo an implementation process that puts the rather broad policies into concrete processes and procedures.

How one registrar allegedly dodges ICANN Compliance

Kevin Murphy, November 17, 2015, Domain Registrars

A Chinese registrar has been accused by ICANN of playing games to avoid complying with Whois policy.

In a breach notice from ICANN Compliance last week, Beijing-based 35 Technology is told that it has failed to verify Whois records as required by its accreditation agreement.

The domain in question was shoesbbalweb.com, which DomainTools’ archived screenshots show was once used to sell branded running shoes.

I understand that 35 is believed to have suspended the domain when ICANN first referred a Whois accuracy complaint to it.

It is then said to have un-suspended the domain, without any change to the Whois record, as soon as ICANN closed the complaint.

The breach notice (pdf) instructs 35 to:

Provide records and information demonstrating that 35 Technology took steps to verify and validate the Whois information of the domain name since 23 March 2015, or provide ICANN with an explanation why the domain name suspension was removed without verifying and validation Whois information

The switcheroo appears to have been brief enough that its suspended state was not recorded by DomainTools.

ICANN has a monitoring program, however, that randomly spot-checks previously complained-about domains for ongoing compliance.

The registrar, which does business at 35.com, is not tiny. It had over 450,000 domains under management, in legacy gTLDs and a handful of Chinese-script new gTLDs, at the last count.

It has until the end of the month to explain itself or risk termination.

Most US presidential hopefuls use Whois privacy despite begging for cash

Kevin Murphy, November 9, 2015, Domain Policy

More than half of the remaining US presidential candidates could have risked losing their official campaign web sites under proposed Whois privacy rules.

Today I carried out Whois queries on all 18 candidates to discover that 10, or over 55%, use a Whois privacy service.

Of the three remaining Democrat candidates, only Bernie Sanders uses privacy. Martin O’Malley and Hillary Clinton do not.

Here’s a table of the Republican candidates and their chosen privacy services. N/A means their campaigns are using what appears to be genuine contact information.

CandidateDomainPrivacy Service
Ben Carsonbencarson.comN/A
Bobby Jindalbobbyjindal.comN/A
Carly Fiorinacarlyforpresident.comDreamHost.com
Chris Christiechrischristie.comDomainDiscreet.com
Donald Trumpdonaldjtrump.comN/A
George Patakigeorgepataki.comDomainsByProxy.com
Jeb Bushjeb2016.comContactPrivacy.com
Jim Gilmoregilmoreforamerica.comN/A
John Kasichjohnkasich.comDomainPrivacyGroup.com
Lindsey Grahamlindseygraham.comN/A
Marco Rubiomarcorubio.comDomainsByProxy.com
Mike Huckabeemikehuckabee.comDomainsByProxy.com
Rand Paulrandpaul.comWhoisPrivacyServices.com.au
Rick Santorumricksantorum.comN/A
Ted Cruztedcruz.orgDomainsByProxy.com

The results are interesting because rules under discussion at ICANN earlier this year — which are apparently still on the table in other international fora — would have banned the use of privacy services for commercial web sites that allow financial transactions.

All 18 candidates — even Trump — solicit donations on their campaign sites, and many sell T-shirts, bumper stickers and such.

Back in May, a minority of ICANN’s Privacy & Proxy Services Accreditation Issues Working Group (PPSAI) were in favor of banning privacy for such registrants.

The rationale was that criminals, such as those selling counterfeit drugs, should not be allowed to mask their Whois details.

Judging by a working group report at the ICANN meeting in Dublin last month, the proposed new rules have been killed off by the PPSAI after a deluge of comments — around 22,000 — that were solicited by registrars and civil rights groups.

However, according to the Electronic Frontier Foundation, at the exact same time as the PPSAI was revealing its change of heart, the US government was pushing for virtually identical policy at a meeting of the OECD, the Organization for Economic Cooperation and Development.

The EFF says the proposed OECD Recommendation “would require domain name registration information to be made publicly available for websites that are promoting or engaged in commercial transactions with consumers.”

It’s remarkable that the US government is apparently pushing for rules that are being violated by most of its own hopeful commanders-in-chief as part of the democratic process.

Clearly, fake pharmacies are not the only class of crook to find value in privacy.

Registrants guilty until proven innocent, say UK cops

Kevin Murphy, August 19, 2015, Domain Registrars

UK police have stated an eyebrow-raising “guilty until proven innocent” point of view when it comes to domain name registrations, in comments filed recently with ICANN.

In a Governmental Advisory Committee submission (pdf) to a review of the Whois accuracy rules in the Registrar Accreditation Agreement, unspecified “UK law enforcement” wrote:

Internet governance efforts by Industry, most notably the ICANN 2013 RAA agreement have seen a paradigm shift in Industry in the way a domain name is viewed as “suspicious” before being validated as “good” within the 15 day period of review.

UK law enforcement’s view is that a 45 day period would revert Industry back to a culture of viewing domains “good” until they are proven “bad” therefore allowing crime to propagate and increase harm online.

The GAC submission was made August 13 to a public comment period that closed July 3.

The Whois Accuracy Program Specification Review had proposed a number of measures to bring more clarity to registrars under the 2013 RAA.

One such measure, proposed by the registrars, was to change the rules so that registrars have an extra 30 days — 45 instead of 15 — to validate registrants’ contact information before suspending the domain.

That’s what the UK cops — and the GAC as a whole — don’t like.

They have a point, of course. Criminals often register domains with bogus contact information with the expectation that the domains will not have a long shelf life. Fifteen days is actually quite generous if you want to stop phishing attacks, say.

The Anti-Phishing Working Group says phishing attacks have an average up-time of 29 hours.

Clearly, ICANN’s Whois accuracy program is doing little to prevent phishing as it is; a switch to 45 days would presumably have little impact.

But the number of domains suspended for lack of accuracy at any given time is estimated to be in the hundreds of thousands, and registrars say it’s mostly innocent registrants who are affected.

Verisign said this March that .com domains “on hold” grew from roughly 394,000 names at the end of 2013 to about 870,000 at the end of 2014.

In June 2014, registrars claimed that over 800,000 domains had been suspended for want of Whois accuracy in the first six months the policy was in place.

Sharp wants dot-brand Whois requirement relaxed

Electronics firm Sharp wants to remove part of its new gTLD registry contract relating to Whois.

The company has filed a Registry Services Evaluation Process request to get its requirement to offer “searchable Whois” dropped. RSEP is the mechanism registries use to amend their contracts.

ICANN’s initial review has not found any security, stability or competition problems and has now opened the request up for public comment.

Because .sharp will be a dot-brand, all the domains would belong to Sharp and its affiliates, reducing the value of searchable Whois.

Searchable Whois is an enhanced Whois service that allows users to search on all fields (such as registrant, email address, etc) rather than just the domain name.

Such services are not mandatory under ICANN’s new gTLD rules, but applicants that said they would offer them could score an extra point in their Initial Evaluation.

In Sharp’s case, a one-point difference would not have affected the outcome of its IE. In any event, it did not score the extra point.

Sharp said it was requesting the change because it’s switching back-ends from GMO Internet to JPRS, which apparently does not or does not want to support searchable Whois.