ICANN predicts flattish 2025 for domain industry

The gTLD domain industry will be pretty much flat in terms of sales next year, according to the predictions in ICANN’s latest budget.

The bean counters reckon the Org will make $89 million from transactions in legacy gTLDs (mainly .com) in its fiscal 2025, up from the $88.9 million it expects to make in fiscal 2024, which ends next June 30.

Meanwhile, it expects transactions in new gTLDs to bring in $10.1 million, up from the $9.9 million it expects in FY24.

Both of the updated FY24 estimates are actually a bit ahead of ICANN’s current budget, written in April and approved in May, which predicted $87.1 million from legacy and $9.2 million from new.

ICANN expects to lose 22 registries (presumably unused dot-brands, of which there are still plenty, with a couple hundred contracts up for renewal in 2025) and gain 40 new registrars.

This will lead to revenue from registry fixed fees to dip to $27.6 million from a predicted $28.1 million, and registrar fixed fees going up from $10.4 million from a predicted $10.1 million.

The FY24 registrar numbers are a little healthier than ICANN predicted back in April, when it expected 2,447 accredited registrars at the end of the financial year versus the 2,575 it’s expecting now. Gname’s decision to buy 150 new accreditations will have played a big role in moving this number up. ICANN expects 2,615 registrars at the end of FY25.

But ICANN is losing registries faster than it predicted back in April. Then, it had expected to end FY24 with 1,127 registries; now it thinks it will have 1,118. It expects that to drop to 1,089 by the end of June 2025.

Overall, ICANN is budgeting for funding of $148 million and the same level of expenses in FY25, the same as FY24.

Comment Tagged: budget, ICANN

Fast-growing Gname buys another 150 registrars

Gname, the fast-growing Singaporean registrar, has added 150 ICANN registrar accreditations to its drop-catching army.

The companies are named Gname 151 through Gname 300. The companies Gname 2 through Gname 150 were accredited in June 2021.

Gname’s primary accreditation has grown massively since it became a drop-catcher in the last two years, going from under 10,000 names under management at the start of 2021 to 3.9 million at the end of August this year. About 3.2 million of its names were in .com.

Its first 150 secondary accreditations had almost a million names between them.

In August, it was the fastest-growing registrar of gTLD names, growing by over 156,000 domains and becoming the 12th-largest registrar accreditation overall.

Drop-catchers use large numbers of accreditations because registries rate-limit their connections. More accreditations means more connections and a better chance to register a valuable domain when it drops.

The primary accreditation was originally Chinese, in the name of Beijing Huaqi Weiye Technology Co and doing business at iwanshang.cn, before it moved to a Singaporean company called Gname.com.

ICANN’s current budget predicts an increase of five accrediations in fiscal 2024, which ends next June. Its high estimate was an increase of 60. So it’s now getting about half a million bucks more than it was expecting.

Comment Tagged: accreditation, drop catching, gname, ICANN

GoDaddy service to let you block domains in over 650 TLDs

GlobalBlock, a domain blocking service introduced to little fanfare by GoDaddy Registry and Identity Digital in June, is planning to launch next month with support from over 650 gTLDs and ccTLDs.

Built on the successes of GoDaddy’s AdultBlock and Identity Digital’s DPML, the new service was supposed to launch last week under the banner of the Brand Safety Alliance, but was delayed until January.

GlobalBlock enables trademark owners to pay one fee to block their marks across all participating TLDs, saving money on defensive registrations. Company names and celebrity names are also covered. A premium version, GlobalBlock+ also covers typos and IDN homographs.

It’s not just gTLD registries that have signed up. Nominet is participating, as is CoCCA. BSA is promising some pretty obscure ccTLDs will be part of the service.

In what appears to be a game-changing innovation, a feature of the service called Priority Autocatch seems set to stop cybersquatters and phishers from drop-catching domains that match strings protected by the block list.

Say you’re Facebook and you see some scumbag has registered facébook.ninja, if you’re subscribed to GlobalBlock+, the AutoCatch feature will see the domain removed from the available pool when it expires, rather than dropping so a second ne’er-do-well can register it.

GlobalBlock appears to be the reason no fewer than 35 registries covering over 300 gTLDs have recently asked ICANN for permission to launch a “Label Blocking Service” via the Registry Service Evaluation Process.

There’s money in blocking services. GoDaddy is making millions from AdultBlock. Some research I’ve been doing recently suggests some registries might be making more from blocks and defensive registrations than they are from regular domain sales.

For registries with small TLD portfolios, blocking services generally offer a poor value proposition. Services like DPML, which covers hundreds of TLDs, or AdultBlock, which covers all the porny ones, have been successful.

The BSA is offering brand owners a lot of carrots to get them to sign up early.

First, if you already have an AdultBlock or DPML subscription, your marks are already pre-validated. GoDaddy is also offering a 50% discount on AdultBlock until January 30; AdultBlock and DPML subscribers get 10% off GlobalBlock until April 30.

BSA says that pricing for GlobalBlock and the initial list of TLDs will be released in early January. Wholesale pricing will go up probably every six months as new TLDs are added, but customers will only pay the increased price upon renewal while benefiting from the added blocks.

General availability pricing begins February 15.

2 Comments Tagged: .brands, adultblock, blocking, globalblock, godaddy, identity digital, trademarks

Did I find a murder weapon in a zone file?

Registrars are usually very reluctant to police the content of web sites by taking down domains they manage, but they quite often make an exception when the web site in question calls for violence. But what if the site itself attempts to physically harm visitors through their screens?

It sounds a bit mad, but I think I’ve found such a site.

I recently randomly came across a domain name that caught my eye while scrolling through a zone file. I’m not going to reveal the domain here, but it consisted of three words across the dot and could be taken as an instruction to “murder” a specific, but unnamed, individual.

Expecting humor, I visited the domain out of curiosity and was confronted by a blank page that rapidly flashed between two background colors, creating a strobe effect. There was no other content.

My first impression was that the site had been created in order to trigger seizures in photosensitive epileptics. The CSS seemed to confirm that the strobe effect fell within the frequency range that the charity Epilepsy Action says can cause such seizures.

This raised an interesting question: could this be considered “DNS abuse”?

The DNS Abuse Institute’s definition (pdf) says DNS Abuse consists of “malware, botnets, phishing, pharming, and spam (when it serves as a delivery mechanism for the other forms of DNS Abuse)”.

DNSAI says registries and registrars “must” act on these five categories of abuse, but it adds that there are some categories of web content where registrars “should” take action. Its Framework to Address Abuse, which has been endorsed by dozens of registries and registrars, states:

Specifically, even without a court order, we believe a registry or registrar should act to disrupt the following forms of Website Content Abuse: (1) child sexual abuse materials (“CSAM”); (2) illegal distribution of opioids online; (3) human trafficking; and (4) specific and credible incitements to violence. Underlying these Website Content Abuses is the physical and often irreversible threat to human life.

Epileptic seizures can be fatal. A school friend of mine did not make it out of his teens due to one. Even when non-fatal, they are dangerous and clearly unpleasant.

So if a site encouraging physical violence “should” be taken down, what about a site that seems designed to actively physically attack individuals, no incitement required? That’s a reasonable question, right?

I filed an abuse report with the registrar managing the domain and was told it did not violate its acceptable use policies.

Attacking epileptics with flashing images sent online has been a criminal offence in the UK since October 26, when the controversial Online Safety Act 2023 was enacted.

A component of the Act is named Zach’s Law, after an eight-year-old boy who in 2020 was attacked with flashing images by internet wankers after he carried out a sponsored walk for the Epilepsy Society.

The Act makes it illegal to send a flashing image to somebody you know is epileptic with the intent to harm them. You can get up to five years imprisonment and a fine.

2 Comments Tagged: dns abuse

ICANN drops the “man” from Ombudsman

ICANN is looking for a new “Ombuds”, having quietly dropped the “man” from Ombudsman following the resignation of Herb Waye.

The Org said it has hired a recruitment consultant and put out a call for expressions of interest in the role last night.

The Ombuds’ job is to handle complaints independently of ICANN Org and board and be an “objective advocate for fairness”. It’s one of ICANN’s bylaws-mandated accountability mechanisms.

The Org seems to have officially made the switch from “Ombudsman” to “Ombuds” at the start of October when Krista Papac took on the job on an interim basis. The old URL icann.org/ombudsman now forwards to icann.org/ombuds.

Like many middle-aged men, I often roll my eyes at this kind of terminology change, despite my impeccable woke credentials.

I have always assumed that “Ombudsman” was etymologically a gender-neutral term, given its Scandinavian roots, but I’ve read around the topic today and it seems that that assumption is open to debate.

I’ve concluded that it doesn’t matter either way — nobody’s getting hurt by the change, so fuck it, “Ombuds” it is.

4 Comments Tagged: ICANN, ombuds

Have your say on police domain takedown powers

The UK Parliament wants your input on a new proposed law that would give the police powers to take down domain names and IP addresses.

The broad-ranging Criminal Justice Bill 2023 (pdf) would give police the ability to obtain court orders requiring registries and registrars to suspend domains believed to be used in criminal activity.

Accompanying explanatory notes say that these court orders could be applied internationally against domain companies in other countries via various means.

The clock is ticking for submissions — the Public Bill Committee of Parliament is due to sit to consider evidence from December 12 and issue its report with suggested amendments by January 30.

The committee advises submitting evidence as soon as possible to maximize the time spent considering it.

1 Comment Tagged: criminal justice bill 2023, police, suspension, takedown

Most registrars are shunning ICANN’s new Whois system

Most of the largest domain registrars are not currently participating in ICANN’s new Registration Data Request Service, according to my research.

I used the RDRS tool to check domains managed by every accredited registrar that has over a million domains under management and discovered that at least 25 out of these 40 registrars do not currently support the service.

The number may be 26, but RDRS did not recognize any domains managed by Chinese registrar Ali Baba as valid, giving instead a “domain does not exist” error message, even for alibaba.com itself.

In total, the 25 registrars coming up blank look after over 63 million gTLD domains, about 28% of the total.

Some very recognizable brands are not in the system.

Squarespace Domains II, the new name for the old Google Domains, the fourth-largest registrar, is the largest company not participating. Together with its original accreditation, Squarespace Domains, they have over 10 million domains under management.

TurnCommerce, GMO, IONOS, NameSilo, PDR, Gname, Dynadot, Wix, OVH, Register.com, FastDomain, Name.com, Domain.com, Hostinger, Sav.com, Xin Net, West.cn, Cronon, Domain Robot, Automattic, DNSPod, and Cloudflare are also not in the system.

Oh, and neither is Markmonitor.

While I only checked 40 registrars, not the full 2,702 that were active in the July registry transaction reports, I would expect the level of support to decline the lower down the list you get, particularly as hundreds of accreditations have a trivial number of domains or are merely aliases for companies already known to not support RDRS.

It’s quite possible some of the registrars I’ve named here are planning to sign up and have just been slow to do so, but they’ve had plenty of time — ICANN has been onboarding registrars since September 20.

The level of support from the registrar industry will be critical to judging whether the RDRS project is deemed a success.

In a recent letter to the GNSO Council discussing “success criteria” for the program, ICANN chair Tripti Sinha wrote (pdf):

The Board agrees that the participation of a sufficient number of registrars with a sufficient number of domain name registrations under management will be important with respect to gathering data.

On the bright side, GoDaddy, Tucows and Namecheap are on board, and that represents about 90 million domains. GoDaddy alone accounts for 65 million, slightly more than the combined total of the 25 large registrars that are not participating.

RDRS is a system designed to simplify the process of requesting non-public Whois data by passing all such requests to the relevant registrars through a central hub.

Of course, it’s only useful if the registrars are actually in the system.

4 Comments Tagged: gdpr, ICANN, privacy, rdrs, whois

Nominet to take over .gov.uk

Nominet says it has won a competitive tender process with the UK government and will take over the registry for .gov.uk early next year.

The registry was previously being managed by Jisc, which runs .ac.uk. Nominet was already running its DNS.

The deal refers to the domains in .gov.uk, not to gov.uk, which is a government services portal site.

The .gov.uk space is a bit of a strange one as far as government domains go — rather than a sole source, it has over 180 accredited registrars government agencies can choose from.

Nominet says it plans to take a more visible role in managing and modernizing the .gov.uk namespace.

Comment Tagged: .gov.uk, jisc, nominet

ICANN picks Istanbul for 2024 meeting

The ICANN community will head to Türkiye for the Org’s 2024 Annual General Meeting, it has been confirmed.

The board of directors picked Istanbul for ICANN 81, which will kick off November 9 next year, according to a just-published resolution.

While the precise venue has not been revealed, you’d have to assume the Istanbul Congress Center is a prime candidate.

While it’s conveniently on the doorstep of Europe, Türkiye counts as Asia-Pacific under ICANN’s rules mandating meetings rotate through the world’s five geographic regions.

ICANN maintains an office in Istanbul, so it can presumably save a bit of money not having to pay for travel and lodgings for local staff who would usually travel.

Next year’s meetings also see the community travel to San Juan, Puerto Rico in March and Kigali, Rwanda in June. The first meeting of 2025 will be held in Seattle, Washington.

4 Comments Tagged: ICANN, icann 81, istanbul

ICANN’s private Whois data request service goes live

ICANN has this evening gone live with its service that enables anyone to request private Whois data on any gTLD domain.

The Registration Data Request Service lets people request contact information on registrants that would otherwise be redacted in the public Whois due to laws such as the GDPR.

The press release announcing the launch seems to have come out an hour or two before the service actually became accessible, but it’s definitely live now and I’ve tried it out.

The system is defined largely by what it isn’t. It isn’t an automated way to get access to private data. It isn’t guaranteed to result in private data being released. It isn’t an easy workaround to post-GDPR privacy restrictions.

It is a way to request an unredacted Whois record knowing only the domain and not having to faff around figuring out who the registrar is and what their mechanisms and policies are for requesting the data.

After scaling back the extremely complex and expensive original community recommendations for a post-GDPR Whois service, ICANN based the RDRS on its now decade-old Centralized Zone Data Service, which acts as an intermediary between registries and people like myself who enjoy sniffing around in zone files.

The RDRS merely connects Whois data requestors — the default settings in the interface suggest that ICANN thinks they’ll mostly be people with court orders — with the registrars in charge of the domains they are interested in.

Anyone who has used CZDS will recognize the interface, but the requesting process is longer, more complex, and requires accepting more disclaimers and Ts&Cs. That said, it’s not particularly confusing.

At first glance, it looks fine. Slick, even. I’ve used it to submit a test request with GoDaddy for my own Whois data, specifying that whoever deals with the request is free to ignore it. Let’s see what happens.

Comment Tagged: czds, ICANN, privacy, rdap, rdrs, whois