Dodgy registrars could be banned from .org promotions

The worse a registrar is at tackling abuse, the more likely it is to be excluded from promotions in the .org space, according to a new policy from Public Interest Registry.
The .org registry said today that it is introducing a new “Quality Performance Index” to rate its registrars according to the quality of their registrations.
They’ll be ranked according to three criteria: abuse takedown, renewal rates, and domain usage.
Those that score above a certain threshold will be pre-qualified for promotions. The others will be encouraged to talk to their PIR rep about things they could do to get their scores up.
This kind of mechanism should in theory make it relatively easy to separate registrars into conscientious corporate citizens on the one hand and fly-by-night spam-friendly jerks on the other.
Keeping the bad guys away from the discounts could go a long way to keeping .org a relatively healthy zone.
But I expect there may be concern from the middle-ground of the registrar space, where we have well-meaning but under-resourced registrars that may find their scores wanting.
An additional concern may be that PIR said it intends to change the score threshold depending on the promotion, which appears to give it the ability to exclude registrars more or less at will.
The QPI initiative also extends to PIR’s newer, lesser-used gTLDs.

ZADNA CEO suspended for “hybrid misconduct”

The CEO of South Africa’s ccTLD registry has reportedly been suspended amid claims of “acts of misconduct”.
According to reports in the local tech press, Vika Mpisane was suspended in early December and has been subject to a delayed disciplinary process since January.
“Mr Vika Mpisane was suspended for serious hybrid acts of misconduct including mismanagement of ZADNA funds and others,” ZADNA chair Motlatjo Ralefatane told MyBroadband.
While details are rather thin on the ground, there are local rumors that some of the allegations relate to Mpisane’s salary and bonuses.
Ralefatane reportedly said that forensic accounting investigations are ongoing.
ZADNA, the ZA Domain Name Authority, is a non-profit organization and official ccTLD manager for .za. It answers to the South African government, but is not funded by it. It should not be confused with ZACR, the commercial entity that actually runs the .za registry on ZADNA’s behalf.
Mpisane has come under increased scrutiny this week as it turns out he is running unopposed for the Southern Africa seat on the board of AFRINIC, the Regional Internet Registry responsible for handing out IP addresses on the continent, apparently without ZADNA’s knowledge.
According to MyBroadband, Ralefatane believes Mpisane should not be representing that he has ZADNA’s support for his run.
His CV (pdf), posted to the AFRINIC web site in April, states that he is the current CEO of ZADNA, with no reference to his suspension.
Ralefatane reportedly added that she is not sure if AFRINIC or ICANN are aware of the allegations against him. They are now.
Mpisane is still listed on ZADNA’s web site as its CEO, also with no reference to the suspension.
His bio on the site reads, in its entirety (errors from the original): “The voice of reason and wisdom An outstanding leader with passion about the internet and what is has to offer. He walks the talk and talks the talk”.

Brand kills off gTLD that is actually being USED

Two more companies have told ICANN they’ve changed their minds about running a dot-brand gTLD, including the first example of a TLD that is actually in use.
Dun & Bradstreet has said it no longer wishes to launch .duns, and Australian insurance company iSelect has had enough of .iselect.
Both companies filed to voluntarily terminate their ICANN registry agreements in March, and ICANN published its preliminary decision to allow them to do so this week.
While business data provider D&B never got around to using .duns, .iselect has had dozens of active domains for years.
The company started putting domains in its zone file about three years ago and had over 90 registered names at the last count, with about a dozen indexed by Google. That’s a quite a lot for a dot-brand.
It is using domains such as home.iselect, news.iselect and careers.iselect as redirects to parts of its main corporate site, while domains such as gas.iselect, creditcards.iselect and health.iselect send customers to specific product pages.
They all redirect to its main iselect.com.au site. There are no web sites as far as I can tell that keep visitors in the .iselect realm.
I’m pretty certain this is the first example of a voluntary contract termination by a dot-brand that is actually in active use.
There have been 52 such terminations to date, including these two latest ones, almost all of which have been dot-brands that never got out of the barn door.
That’s over 10% of the dot-brands that were delegated from the 2012 gTLD application round.

New gTLDs slip again in Q1

The number of domains registered in new gTLDs slipped again in the first quarter, but it was not as bad as it could have been.
Verisign’s latest Domain Name Industry Brief, out today, reports that new gTLD domains dropped by 800,000 sequentially to end March at a round 23.0 million.
It could have been worse.
New gTLD regs in Q1 were actually up compared to the same period last year, by 2.8 million.
That’s despite the fact that GRS Domains, the old Famous Four portfolio, has lost about three million domains since last August.
Verisign’s own .com was up sequentially by two million domains and at 141 million, up by 7.1 million compared to Q1 2018. But .net’s decline continued. It was down from 14 million in December to 13.8 million in March.
Here’s a chart (click to enlarge) that may help visualize the respective growth of new gTLDs and .com over the last three years. The Y axes are in the millions of domains.

New gTLDs have shrunk sequentially in six of the last 12 quarters, while .com has grown in all but two.
The ccTLD world, despite the woes reported by many European registries, was the strongest growth segment. It was up by 2.5 million sequentially and 10 million compared to a year ago to finish the period with 156.8 million.
But once you factor out .tk, the free TLD that does not delete expired or abusive names, ccTLDs were up by 1.4 million sequentially and 7.8 million on last year.

Second-level .au domains ARE coming soon

Australian ccTLD manager auDA has given itself approval to start selling .au domains at the second level for the first time.
auDA said today that it plans to lift its third-level-only rule in the fourth quarter this year.
The date of October 1 has been penciled in, but auDA said it will release more details as the time approaches.
There will be a grandfathering policy in place for existing registrants of 3LDs under the likes of .com.au and .org.au, but its deadlines are much tighter than the policies in, for example, .uk.
Under the published rules (pdf), registrants who owned 3LDs in .au before a cut-off date will get first dibs on the matching 2LD.
That priority period will end April 1, 2020.
After that, registrants who bought their .au names between the cut-off date and now will get also get priority, until August 1, 2020.
The cut-off date has yet to be determined by the auDA board of directors.
After the priority period is over, all unclaimed domains will be available to register by anyone.
You’re basically looking at six to 10 months of grandfathering rights, compared to the five years Nominet offered in when it made direct 2LD registration possible in .uk.
The 2LD policy has been four years in the making, and has courted controversy along the way.
Domain investors in particular have complained, worried that 2LDs will cause confusion and dilute the value of their 3LD investments.

.icu gets China nod as it tops 900,000 regs

Chinese regulators have approved .icu for sale and use in China, according to the registry.
ShortDot COO Kevin Kopas told DI today that the Ministry of Industry and Information Technology has approved its year-old gTLD for mainland use.
The company plans to launch .icu there formally June 12, he said.
Kopas also said that .icu has recently topped 900,000 registrations.
It’s a remarkable growth achievement for a gTLD with barely a year on the clock, given that SpamHaus stats show that its level of spam abuse is still comparable to .com.
But with prices at around $1.50 at its largest registrars and very little semantic value, one has to assume that a lot of its registrations are speculative. Its first junk drop could be brutal.
MIIT approval may help it continue its growth trend. To date, China-based registrars have recorded no .icu sales.

These 27 companies have ditched the .com for their dot-brand

Earlier today, I listed what I believe might be the top 10 dot-brand gTLDs with the most active web sites, but noted that it was probably a rubbish way to gauge the success of the dot-brand concept.
As a follow-up, I thought I’d figure out which brands have taken the bold step of ditching the .com and made their dot-brand their primary web destination.
I found 27 TLDs, which is simultaneously not a lot and easily twice as many as I was expecting.
The most-popular second-level string was “home”, with 12 examples. The string “global” occurs five times on the list.
I did this research manually with Google and a list of 275 dot-brands — anything with Spec 13 in its contract and more than two domains in its zone file — culled from my database.
To get on this list, at least one of the following had to be true:

• The dot-brand was the top hit on Google when searching for the brand in question.
• The .com redirects to the dot-brand.

Sometimes I had to factor out Google’s enormously irritating habit of localizing results, which would prioritize a .uk domain, particularly in the case of automotive brands.
On a few occasions, if I could not be certain whether the “official” primary site was in a ccTLD or the dot-brand, I used the brand’s Wikipedia page as a tie-breaker.
Some entries on the list may be a bit debatable.
I’m not sure whether .barclays should be there, for example. There’s little doubt in my mind that barclays.co.uk is the site that the majority of Barclays’ banking customers use, but barclays.com redirects visitors to home.barclays, so it fits my criteria.
In general, I’ve erred on the side of caution. If the top search result was for the brand’s .com, it was immediately ruled out, no matter how enthusiastic a dot-brand user the company otherwise appeared to be.
Here’s the list. Please let me know if you think I’ve missed any.
[table id=57 /]
Twenty-seven gTLDs is not a great many, of course, considering that some dot-brands have been delegated for half a decade already.
It’s about half as many as have already torn up their ICANN registry agreements, and it represents less than 6% of the new gTLDs that my database says have Spec 13 in their contracts.
But I reiterate that this is not a list of companies using their dot-brands but rather of those apparently putting their .com firmly in the back seat to their dot-brand.

These are the 10 most-used dot-brands

This article was deleted October 1, 2019 after numerous errors were discovered.

GRS has lost three million domains since Famous Four died

The old Famous Four Media gTLD portfolio has shrunk by roughly 60% since old management were kicked out.
At the same time, the new registry is selling less than one percent of the domains it used to add each month.
The 16 TLDs, now managed by GRS Domains, have a total of approximately 2 million domains in their zone files today, compared to about 5 million at the end of August 2018.
Last August was when GRS, which seems to have taken over the portfolio about a year ago, announced that it was introducing “much more transparent and sensible pricing strategy” of $9.98 per domain per year across the board.
Its 16 TLDs include the likes of .loan, .win and .bid. Many had been offered in the sub-$1 range, largely via former affiliate AlpNames, attracting huge volumes of registrations but low renewals and a lot of spammers.
I compared the zone file counts at the end of August 2018 to yesterday’s numbers, rounding to the nearest thousand, and came up with this:
[table id=55 /]
Don’t think for a second that the correction is over. The story of the old FFM portfolio’s decline will roll for many more months. Each TLD is still seeing monthly deletes in the thousands.
The number of new regs across the portfolio every month has dropped off a cliff — a big cliff with jagged rocks and sharks circling at the bottom — since the August price changes.
Whereas in January 2018 the 16 gTLDs saw a combined total of over 400,000 adds, by January 2019 this had dropped to fewer than 1,700, a 99.59% decline.
[table id=56 /]
In each case, the drop-off in adds started in August last year. Each TLD went almost immediately from thousands of new regs per month, to under 100.
I compared Januaries because January 2019 is the date of the most-recent registry transaction data. January 2018 was not an atypically strong month for sales for any of the TLDs; for many, it was on the slow side.
Famous Four was replaced by GRS about a year ago after investors in Domain Venture Partners, the ultimate owner of the portfolio, fell out with FFM management.
The registrar AlpNames, which was responsible for a huge share of FFM’s sales and was managed by the same people, has also since gone out of business.

Major registries posting “fabricated” Whois data

One or more of the major gTLD registries are publishing Whois query data that may be “fabricated”, according to some of ICANN’s top security minds.
The Security and Stability Advisory Committee recently wrote to ICANN’s top brass to complain about inconsistent and possibly outright bogus reporting of Whois port 43 query volumes.
SSAC said (pdf):

it appears that the WHOIS query statistics provided to ICANN by registry operators as part of their monthly reporting obligations are generally not reliable. Some operators are using different methods to count queries, some are interpreting the registry contract differently, and some may be reporting numbers that are fabricated or otherwise not reflective of reality. Reliable reporting is essential to the ICANN community, especially to inform policy-making.

SSAC says that the inconsistency of the data makes it very difficult to make informed decisions about the future of Whois access and to determine the impact of GPDR.
While the letter does not name names, I’ve replicated some of SSAC’s research and I think I’m in a position to point fingers.
In my opinion, Google, Verisign, Afilias and Donuts appear to be the causes of the greatest concern for SSAC, but several others exhibit behavior SSAC is not happy about.
I reached out to these four registries on Wednesday and have published their responses, if I received any, below.
SSAC’s concerns relate to the monthly data dumps that gTLD registries new and old are contractually obliged to provide ICANN, which publishes the data three months later.
Some of these stats concern billable transactions such as registrations and renewals. Others are used to measure uptime obligations. Others are largely of academic interest.
One such stat is “Whois port 43 queries”, defined in gTLD contracts as “number of WHOIS (port-43) queries responded during the reporting period”.
According to SSAC, and confirmed by my look at the data, there appears to be a wide divergence in how registries and back-end registry services providers calculate this number.
The most obvious example of bogosity is that some registries are reporting identical numbers for each of their TLDs. SSAC chair Rod Rasmussen told DI:

The largest issue we saw at various registries was the reporting of the exact or near exact same number of queries for many or all of their supported TLDs, regardless of how many registered domain names are in those zones. That result is a statistical improbability so vanishingly small that it seems clear that they were reporting some sort of aggregate number for all their TLDs, either as a whole or divided amongst them.

While Rasmussen would not name the registries concerned, my research shows that the main culprit here appears to be Google.
In its December data dumps, it reported exactly 68,031,882 port 43 queries for each of its 45 gTLDs.
If these numbers are to be believed, .app with its 385,000 domains received precisely the same amount of port 43 interest as .gbiz, which has no registrations.
As SSAC points out, this is simply not plausible.
A Google spokesperson has not yet responded to DI’s request for comment.
Similarly, Afilias appears to have reported identical data for a subset of its dot-brand clients’ gTLDs, 16 of which purportedly had exactly 1,071,939 port 43 lookups in December.
Afilias has many more TLDs that did not report identical data.
An Afilias spokesperson told DI: “Afilias has submitted data to ICANN that addresses the anomaly and the update should be posted shortly.”
SSAC’s second beef is that one particular operator may have reported numbers that “were altered or synthesized”. SSAC said in its letter:

In a given month, the number of reported WHOIS queries for each of the operator’s TLDs is different. While some of the TLDs are much larger than others, the WHOIS query totals for them are close to each other. Further statistical analysis on the number of WHOIS queries per TLD revealed that an abnormal distribution. For one month of data for one of the registries, the WHOIS query counts per TLD differed from the mean by about +/- 1%, nearly linearly. This appeared to be highly unusual, especially with TLDs that have different usage patterns and domain counts. There is a chance that the numbers were altered or synthesized.

I think SSAC could be either referring here to Donuts or Verisign
Looking again at December’s data, all but one of Donuts’ gTLDs reported port 43 queries between 99.3% and 100.7% of the mean average of 458,658,327 queries.
Is it plausible that .gripe, with 1,200 registrations, is getting almost as much Whois traffic as .live, with 343,000? Seems unlikely.
Donuts has yet to provide DI with its comments on the SSAC letter. I’ll update this post and tweet the link if I receive any new information.
All of the gTLDs Verisign manages on behalf of dot-brand clients, and some of its own non-.com gTLDs, exhibit the same pattern as Donuts in terms of all queries falling within +/- 1% of the mean, which is around 431 million per month.
So, as I put to Verisign, .realtor (~40k regs) purportedly has roughly the same number of port 43 queries as .comsec (which hasn’t launched).
Verisign explained this by saying that almost all of the port 43 queries it reports come from its own systems. A spokesperson told DI:

The .realtor and .comsec query responses are almost all responses to our own monitoring tools. After explaining to SSAC how Verisign continuously monitors its systems and services (which may be active in tens or even hundreds of locations at any given time) we are confident that the accuracy of the data Verisign reports is not in question. The reporting requirement calls for all query responses to be counted and does not draw a distinction between responses to monitoring and non-monitoring queries. If ICANN would prefer that all registries distinguish between the two, then it is up to ICANN to discuss that with registry operators.

It appears from the reported numbers that Verisign polls its own Whois servers more than 160 times per second. Donuts’ numbers are even larger.
I would guess, based on the huge volumes of queries being reported by other registries, that this is common (but not universal) practice.
SSAC said that it approves of the practice of monitoring port 43 responses, but it does not think that registries should aggregate their own internal queries with those that come from real Whois consumers when reporting traffic to ICANN.
Either way, it thinks that all registries should calculate their totals in the same way, to make apples-to-apples comparisons possible.
Afilias’ spokesperson said: “Afilias agrees that everyone should report the data the same way.”
As far as ICANN goes, its standard registry contract is open to interpretation. It doesn’t really say why registries are expected to collect and supply this data, merely that they are obliged to do so.
The contracts do not specify whether registries are supposed to report these numbers to show off the load their servers are bearing, or to quantify demand for Whois services.
SSAC thinks it should be the latter.
You may be thinking that the fact that it’s taken a decade or more for anyone to notice that the data is basically useless means that it’s probably not all that important.
But SSAC thinks the poor data quality interferes with research on important policy and practical issues.
It’s rendered SSAC’s attempt to figure out whether GDPR and ICANN’s Temp Spec have had an effect on Whois queries pretty much futile, for example.
The meaningful research in question also includes work leading to the replacement of Whois with RDAP, the Registration Data Access Protocol.
Finally, there’s the looming possibility that ICANN may before long start acting as a clearinghouse for access to unredacted Whois records. If it has no idea how often Whois is actually used, that’s going to make planning its infrastructure very difficult, which in turn could lead to downtime.
Rasmussen told DI: “Our impression is that all involved want to get the numbers right, but there are inconsistent approaches to reporting between registry operators that lead to data that cannot be utilized for meaningful research.”