ICANN lays out new rules for navel-gazing

ICANN is set to cut back on the amount of navel-gazing it carries out, dramatically scaling back how often it reviews its own structure and performance.

The community’s unashamedly meta “Review of Reviews” has produced fruit on schedule, with a set of principles set to be opened for discussion at the ICANN 86 meeting in Seville, Spain which kicks off this weekend.

The Cross Community Group that came up with the new framework would see some reviews that are currently mandated by ICANN’s bylaws eliminated altogether and others put on a substantially longer cycle.

The CCG is recommending that only two reviews are mandatory, the Accountability & Transparency Review, which would occur every five years, and an ICANN Structural Review which would run every 15 years instead of the current five.

The Registration Directory Service Review, which according to the bylaws has to review Whois policy every five years, does not appear to feature in the new recommendations. Either does the Competition, Consumer Trust and Consumer Choice Review.

The five-yearly Security, Stability, and Resiliency Review would now be treated as an “On-Demand Review”, a new category of review that can be called for by the community if a very high voting threshold is met.

The proposals already have their detractors among the community’s constituency groups.

The Non-Commercial Stakeholders Group has concerns that they would favor highly resourced interest groups at the expense of marginalized communities, for example, while the Intellectual Property Constituency believes eliminating some of the reviews poses a risk of DNS abuse and IP infringement.

There will be a session on the proposals in Seville on Monday.

Surprising nobody, ICANN calls off Oman meeting

The bad news: ICANN has cancelled its meeting in Oman this October. The good news: you’re all going to Bali instead!

The ICANN 87 Annual General Meeting will now take place at the conference center attached to The Westin Resort Nusa Dua, Bali, Indonesia, from October 17 to 22. Those are the same dates as the scheduled meeting in Muscat.

While ICANN scrupulously avoided explicitly laying the blame at the feet of Donald Trump, from whom the Org has been cowering since his second term as US president began, the relocation of the AGM is not unexpected and certainly due to the ongoing US-Israeli war on Iran.

While the timing may be coincidental, ICANN’s announcement came less than a week after an increasingly unpredictable Trump threatened to bomb Oman, which has been acting largely as a neutral mediator to date.

But ICANN merely said:

The decision to relocate the meeting was made in consultation with the meeting hosts and local partners in Oman, with a shared focus on ensuring that the AGM can proceed on schedule and support broad global participation.

…

Accessibility, travel reliability, and the ability to participate, both in person and online, are essential to its success. In light of recent developments affecting regional airspace, ICANN has taken this step now to provide certainty for participants and ensure the meeting can move forward as planned.

Bali is of course a popular tourist destination in the Asia-Pacific region — and the beachfront Westin looks gorgeous — it is a long slog for ICANN participants from North American and Europe. But the risk of accidentally getting shot down is much reduced.

It’s the second time in less than a year ICANN has postponed a meeting in Oman due to regional instability.

Four registrars get terminated

Four companies have had their gTLD accreditations terminated, as ICANN continues to clear up its backlog of long-dormant deadbeat registrars.

The unrelated entities are US-based Domus, Finland-based Globis, Hong Kong-based Overcasts, and Wanyuhulian Technology from China. They’ve all lost their ICANN contracts as of May 29.

No domains are at risk, as none of the registrars had any gTLD names under management. Two of them never sold a single domain.

All of the companies in question were in breach for failing to pay their accreditation fees. One of them inexplicably had its accreditation renewed last year despite already being past due.

ICANN director and African internet pioneer Barrett dies

Alan Barrett, a member of ICANN’s board of directors and an internet pioneer in his home of South Africa has died, according to ICANN.

The Org said that Barrett died of recently-diagnosed cancer yesterday, May 28. An online memorial is being planned, but his family have requested privacy in the meantime, ICANN said.

Barrett was involved in setting up the first internet connections to universities in South Africa and the launch of the first commercial ISP there in the 1990s, according to his biography.

He also served as CEO of AFRINIC, the Regional Internet Registry for Africa, from 2015 to 2019.

“Alan was a kind man, who listened to others,” ICANN CEO Kurt Lindqvist wrote on social media. “When Alan spoke you listened as he was always well read, balanced and would suggest a path forward on thorny issues.”

He was the Address Supporting Organization’s two-time appointment to the ICANN board and his second term was due to expire at the conclusion of the 2027 Annual General Meeting.

More cheap new gTLD applications approved

ICANN has approved 18 more requests for reduced-fee new gTLD applications under its Applicant Support Program.

As of last week, the Org said it has conditionally approved a total of 16 requests, up by 13 on a month earlier, and fully approved 27, up by five. “Fully approved” means ICANN has received payment from the applicant.

Only one request has so far been rejected, because the applying entity was found not to be eligible for the program.

There are now a total of 44 applications that have been processed, with 32 more in the pipeline.

The ASP offers up to an 80% discount on the $227,000 base new gTLD application fee, along with a range of other perks, to non-profit organizations on tight budgets.

Whois about to get even more useless

Trying to get hold of a domain registrant via their Whois record? It could be about to get even more difficult following an ICANN advisory that gives GoDaddy a pass for its current practices.

The advisory could make it harder for domain buyers to contact the owners of domains they are interested in, and easier for registrars to sell their domain brokerage services.

There’s a strict requirement under the current ICANN Registration Data Policy that registrars “MUST Publish an email address or a link to a web form to facilitate email communication” in their RDAP/Whois output.

The web form option is pretty much the de facto standard; the registrant’s email address is publicly redacted, but the registrar offers to forward communications to the address it has on record.

But there’s been some controversy about what “facilitate email communication” means.

If you query a domain sponsored by the likes of Tucows or 101domain, you’ll get a form that allows you to submit free text much like you would with a regular email.

With the likes of Markmonitor or Porkbun, you’ll get the same type of form, but only after you’re verified your own email address. Namecheap provides a proxified email address in its RDAP output, no web form required.

But some registrars, notably GoDaddy and Dynadot among the largest providers, do not give a free text option. You can only select from one of three options — abuse, IP infringement, or a “research” catch-all — and hope the registrant agrees to reach out to you on that very vague basis.

If you’re a domainer, there’s no way to use the GoDaddy form to say “Hey, I like your name, I’ll give you $5k for it.”

ICANN has now clarified that the GoDaddy model is perfectly fine under the policy, which “does not include an explicit requirement that registrars provide a free text option or forwarding capabilities as the means of facilitating the communication”.

What GoDaddy and Dynadot are doing “does not violate current requirements under the Policy”, ICANN stated.

This clarification could mean that other registrars could begin to copy the GoDaddy model, if they believe it will benefit them in some way, such as by making an expensive brokerage service the most efficient way for domainers to contact prospective sellers.

Agentic AI has ICANN in a pickle

Imagine you’re in a Zoom meeting, discussing policy that will govern the future of the domain name industry, when you suddenly realize not everyone in the room is human.

Some are AI agents.

That’s the certainly intriguing, and possibly worrying, scenario under discussion in recent correspondence between ICANN and a leading community member.

ICANN currently bans, as a matter of practice rather than policy, AI agents from participating in Zoom calls. But consultant Michael Palage, a seasoned veteran ICANN tire-kicker, recently requested a waiver.

Revealing that he is living with hearing loss, Palage said (pdf) that AI agents could enable him to “participate more meaningfully” in ICANN and that the current de facto ban “places an unreasonable burden” on him and others.

General counsel John Jeffrey, responding (pdf), did not rule out carving out an exception to the current ban for community members with disabilities, but requested clarity on what specific tools Palage has in mind.

ICANN’s Zoom sessions already include one AI-based tool, the regularly incorrect and frequently hilarious transcription feature, which is useful to a limited degree for getting the gist of a conversation without having to actually go to the trouble of listening to it.

But ICANN is hesitant about allowing participants to bring their own agents to the party, judging by Jeffrey’s response, because it could quite easily bring the integrity of the entire multistakeholder policy-making process into question.

Jeffrey wrote that the agent ban is to “ensure the transparency, accountability, and integrity of discussions”, but:

ICANN’s concern is not with accessibility tools used by individuals to support their own participation, but with AI tools that may independently appear, record, transcribe, summarize, or contribute in ways that create uncertainty about identity, consent, data use, or accountability.

ICANN has for a couple of years seen its public comment periods stuffed with responses that — to this observer at least — appear to be AI-generated. Sometimes, I suspect, such comments have been generated to tick a box that secures future travel funding for a participant.

That’s one thing — emailed comments are part of an asynchronous discussion — but what if an AI agent participates in a live chat as part of a policy development process? Who would be responsible for its contributions?

As Jeffrey puts it:

Unmanaged or insufficiently governed third-party AI tools, including those that independently attend meetings, generate or submit interventions, appear as participants, or create recordings or transcripts outside ICANN-approved systems, may raise legal, privacy, and ethical concerns. This includes the processing of personal data without appropriate safeguards, lack of transparency in data use, risks related to accuracy, uncertainty regarding participant identity, concerns regarding accountability for contributions, and risks related to the preservation of meaningful human participation in ICANN’s decision-making processes.

Or, as I put it:

What if the agent misunderstood its brief and directed the conversation in completely unintended directions, either wasting everybody’s time or steering policy-making onto dangerous or idiotic paths?

What if the agent went batshit and started espousing Nazi ideology, calling the host a bitch, doxxing its opponents, or ranting about goblins? We all know how much AI loves goblins…

Identity Digital takes over 25-year-old TLD

Identity Digital’s recent acquisition spree has continued, with the company recently taking over as registry operator for a sponsored gTLD that made its debut in 2001.

The registry’s affiliate, Jolly Host, has taken over .aero from aerospace trade group SITA, the Societe Internationale de Telecommunications Aeronautique, according to ICANN records.

.aero was one of the original “test-bed” new gTLDs that prevailed in the 2000 application round.

It’s a little different to a normal gTLD acquisition — .aero is a sponsored gTLD designed to serve a specific community, and there are registration restrictions in place.

The main barrier to registration is the requirement to be a member of the industry and have a SITA Membership ID, obtainable from the registry web site, before you can go to a registrar to get your name.

As such, SITA is not washing its hands entirely of the TLD. It will continue as .aero’s “Sponsor”, responsible for setting policy, with Identity Digital now contractually designated as “Registry Operator”.

.aero is cheaper to run that your typical gTLD. The registry contract calls for annual payments to ICANN of just $5,000, rather than the standard $25,000, as long as it has fewer than 50,000 domains under management.

It currently has about 13,000 domains in its zone file and renewals retail starting at about $40 per year.

The fact that .aero is currently sponsored and restricted doesn’t necessarily mean it will stay that way. There’s plenty of precedent, from .xxx to .med, of sponsored registries casting off their roots to broaden their appeal.

It’s the sixth gTLD contract Jolly Host has taken over so far this year after, .safety, .dot, .jot, .circle and .onl.

ICANN throws a bone to its most stubborn new gTLD applicant

ICANN has offered an olive branch to a new gTLD applicant that refuses to accept defeat well over a decade after it was rejected.

The Org has offered one last chance for Indian applicant Nameshop to get some of its money back for an application that fell at the first hurdle back in the 2012 application round.

Nameshop applied for .idn, apparently not understanding the rule that strings matching protected three-letter country codes are banned under ICANN rules. IDN is the code for Indonesia.

The company filed a request to change its applied-for string to .internet, using a process ICANN had put in place to allow applicants to correct typos (such as correcting .dotafrica to .africa).

When it was explained to Nameshop that it was trying to misuse the process and its only option was to request a refund of its application fee, the company decided instead to fight fruitlessly for the best part of a decade and a half to get ICANN to change its mind.

ICANN has not changed its mind.

The Org informed all remaining failed 2012-round applicants late last year that they had 90 days to withdraw their applications and get a partial refund or lose their money.

Nameshop evidently chose to reject or ignore that offer, missing the deadline for requesting the refund. Because it used ICANN’s Applicant Support program, its refund would be of the lower $47,000 fee.

But ICANN has offered the company one final attempt to leave the process with at least something. It’s given Nameshop until May 15 to withdraw its application and get its money back.

This appears to be special treatment. Eleven other unsuccessful applications, including those for .hotel, .shop, .africa and .salon, were recently flagged as “Terminated” — as opposed to “Withdrawn” — by ICANN.

I would be remiss if I did not point out that applicants in the current application round, which is open until August, can avoid making silly string selection mistakes by using DI’s free Stringtel tool.

Cops get special Whois access rights

Law enforcement agencies will be able to get access to private Whois records in under 24 hours under ICANN policy introduced yesterday, but the powers are toothless for now.

ICANN has updated its Registration Data Policy to add a section handling “urgent requests” for Whois data, normally redacted in the public RDAP databases due to privacy laws and ICANN policy.

Normally, registrars have as much as 30 days to respond to disclosure requests, but they will only have 24 hours when the request relates to “circumstances that pose an imminent threat to life, of serious bodily injury, to critical infrastructure, or of child exploitation in cases where disclosure of the data is necessary in combatting or addressing this threat”.

Because it’s a formal Consensus Policy, it’s already binding on all contracted parties.

But it’s currently pretty useless. The policy only requires the fast disclosure when the requestor is an “authenticated” law enforcement agency, and as of today ICANN has no mechanism to authenticate LEAs.

Figuring out how to authenticate requestors has been under discussion privately in the Governmental Advisory Committee’s Public Safety Working Group for some time, with ideas about domain-based authentication being floated.

But it seems the real work will be carried out by the GNSO Council’s forthcoming Supplementation Recommendations on the EPDP Phase 2 working group, which will be tasked with revisiting earlier, subsequently rejected, work on Whois access.

The pencilled-in deadline for that working group to reach recommendations is January 2027, a lot faster (but critics say less democratic) than a full-blown Policy Development Process, which would take years.