ICANN looking at new bulk reg rules

ICANN seems set to start creating more rules governing DNS abuse, including limits on bulk registrations and more tracking of registrants.

A small team of GNSO volunteers have put together a list (pdf) of dozens of proposed policy change areas, covering everything from registrant data accuracy to pricing to API access to getting ICANN Compliance to be more proactive.

While most of the ideas in the team’s analysis received a broad range of views, it settles on three areas, all related to bulk registration of abusive domains, that it thinks are ripest for further policy work.

The first is “Associated Domain Checks”. The small team think it’s worth looking into whether registrars should have to investigate proactively domains registered by known abusive registrants.

The group also thinks it’s worth looking into better industry information-sharing about domain generation algorithms, which bad actors use to create vast numbers of gibberish names that can be used in spam runs, phishing attacks, or botnets.

Finally, the group thinks rules around API access to registrar platforms should be looked at, given that bulk-registered abusive domains often seem to use APIs to programmatically obtain thousands of throwaway domains in seconds.

The small team thinks a Policy Development Process looking at just these three issues could be completed relatively quickly and the community could address the remaining issues later.

Whether the recommendations go to a PDP is now up to the GNSO Council, which will vote on the matter this Thursday. Assuming the vote passes, which seems likely, ICANN staff would then have to prepare a formal Issue Report, setting out the scope of future work, if any.

A PDP would likely take years to complete.

The three priority topic areas reflect closely the Governmental Advisory Committee advice coming out of June’s ICANN 83 public meeting. Both small team and GAC heavily source ICANN’s INFERMAL research and a recent NetBeacon white paper as their inspirations.

Wine producers worried about new gTLDs

American vintners are worried that someone might steal their protected regional names in the next new gTLD round.

The Napa Valley Vintners has written to ICANN to “express strong opposition to the creation of any generic top-level domain
(gTLDs) that uses our distinctive name.”

The trade association asks that the names of wine-producing areas of the States be added to the Reserved Names List in the new gTLD program’s Applicant Guidebook.

That list currently is limited to the names of intergovernmental organizations, NGOs, and Red Cross/Crescent related entities.

The NVV points out that the names of wine-producing regions are protected by US law — you can’t say your wine comes from Napa unless it was in fact made there.

According to Wikipedia, there are 276 protected American Viticultural Areas in 34 states. More than half are in California.

Some of these names actually have a small degree of protection already, but only accidentally. The string “Napa” would be considered a protected geographic string until the current AGB rules, for example, but only if somebody wanted to run .napa as a city-gTLD.

The issue of protecting wine-related geographic indicators has come up at ICANN before. While it was processing the applications for .wine and .vin in 2014, there was a protracted bust-up in the Governmental Advisory Committee about whether they should go ahead.

Several European governments pressed ICANN to ban or delay .wine, now an Identity Digital gTLD, until promises were made about protecting names like “Champagne” and “Rioja” at the second level.

France in particular got very pissed off, but ultimately objections were dropped after the registry made some kind of deal with the wine-makers.

The NVV letter is cc’d to the federal government’s Alcohol and Tobacco Tax and Trade Bureau, presumably to send the message that the group is not messing about.

The letter (pdf) is addressed to “The Honorable Sally Costerton”, under the apparent assumption that she’s still ICANN’s acting CEO. That hasn’t been true for the last eight months. Also, as lovely as she is, I’m not sure she qualifies for that particular honorific.

Goodyear tires of its dot-brand

For the record, I’m not proud of that headline. It doesn’t even work in British English. But if I hadn’t done it, some of you would have complained, and I want you to be happy.

Rubber company Goodyear has become the latest new gTLD registry operator to tell ICANN to terminate a dot-brand.

In this case, it’s not the company’s primary, .goodyear, but rather .dunlop, the brand of one of its tire-making subsidiaries.

The company did not give ICANN a reason for the self-termination; the Dunlop brand appears to be alive and well.

Neither .goodyear nor .dunlop have any registered domains. Dunlop and Goodyear both use .eu and .com domains for their primary web sites.

ICANN’s “review of reviews” kicks off

The ICANN community has kicked off its “review of reviews”, a hopefully brief exercise in navel-gazing designed to free ICANN from even more navel-gazing over the longer term.

The seven supporting organizations and advisory committees have put forth a proposal, which ICANN’s top brass has accepted, for a Review of Reviews Cross Community Group (RoR CCG) that will seek to rescue ICANN from the quagmire of introspection into which it has sunk in recent years.

ICANN’s bylaws, written when the Org got divorced from the US government a decade ago, call for more than half a dozen reviews — of stuff like accountability, competition, security and Whois — most of which are on five-year cycles.

But the institutional lethargy that has consumed ICANN for the last decade, coupled with an already heavy volunteer workload, has meant that the reviews sometimes miss deadlines and still haven’t been fully implemented by the time the next cycle comes around.

The new CCG is being set up to see what can be done to terminate this vicious cycle. A charter document (pdf) sent to ICANN this week reads:

The purpose of the CCG is to manage a fundamental evaluation of the following reviews set out in the ICANN Bylaws, as a whole system, including their implementation, and propose a refreshed system of reviews.

Its timeline is ambitious. The group hopes to have some proposals ready to show the community by ICANN 86, less than a year from now. By ICANN standards that’s pretty much Ludicrous Speed.

The CCG will have a limited membership: two members from each SO and AC, two ICANN staffers and two members of the board for a total of 18. Anyone will be able to passively observe the mailing list and teleconferences.

The draft CCG charter has been accepted by ICANN chair Tripti Sinha. It’s expected that the group will hold public sessions this October in Dublin at ICANN 84.

Huge registrars flee from RDRS

Ten notable domain registrars have abandoned ICANN’s pilot Registration Data Request Service, substantially reducing its usefulness.

In June, 10 accredited registrars pulled their support for the voluntary service, which is designed to give law enforcement, IP owners, and security researchers an easier way to request unredacted Whois records.

Team Internet is out, taking with it its registrars 1API, Internet BS, Key-Systems GmbH, Key-Systems LLC, Moniker, RegistryGate and TLD Registrar Solutions.

Newfold Digital exited with Network Solutions, Register․com, and PublicDomainRegistry․com.

The sum of all this is that there are now 78 participating registrars, compared to 88 at the end of May, and they now only represent 47% of all registered gTLD domains, down from 54%.

That’s the lowest level of participation since RDRS launched in late November 2023 and the first time it’s dropped below half of all registered gTLD domains.

Usage of RDRS has dropped to a whole new low. There were only 68 requests for Whois records in June, down from the previous low of 91 in March.

Perhaps counter-intuitively, the number of searches that resulted in “Registrar Not Supported” errors remained static at 16%, tying for the lowest ratio across the entire pilot to date.

ICANN’s Governmental Advisory Committee recently said it wants ICANN to consider making RDRS mandatory for all registrars.

Aug 7 Correction: this article originally erroneously stated that Corporation Service Company had removed one registrar and added another. In fact, the registrar in question had simply changed its name. I apologise for the error.

Namecheap loses attempt to bring back .org price caps

ICANN seems to have won a big victory in its ongoing tussle with Namecheap over price caps for .org and .info domains.

A California court ruled late last week that it cannot force ICANN into pricing talks with the registries for the two gTLDs, denying a motion that Namecheap filed back in April.

The dispute dates back to 2019, when ICANN removed price caps from Public Interest Registry’s .org registry contract, which had limited PIR to 10% annual increases.

Namecheap used ICANN’s own Independent Review Process accountability mechanism to challenge this decision and won, kinda, in 2022.

The IRP panel found ICANN had breached its bylaws and issued “recommendations” such as commissioning an economic report into price caps, deciding if price caps should return, and if so then talking to the registries about bringing them back.

When there’d been little action by early 2024, Namecheap sued to get the backing of the court for the IRP decision. It was successful, with the court ruling this February that the IRP findings were valid.

In the meantime, ICANN had obtained its economist’s report and passed a resolution stating that it should not bring price caps back to the two registry contracts.

But Namecheap had a final crack at getting the court to force ICANN into price cap. In a motion this April, it asked the court to instruct ICANN to “approach the registry operators for .ORG and .INFO to agree to some form of price control”.

The court didn’t buy its arguments, however, last week denying Namecheap’s requests on the grounds that ICANN had in fact considered the IRP panel’s recommendations:

Namecheap provides evidence that ICANN in fact did consider the Panel’s recommendations, and thus Plaintiff admits that ICANN did not reject any of the Panel’s findings, so as correctly stated by ICANN, “there is nothing for this Court to enforce.”

In the six years since the price caps were lifted, non-profit PIR has not raised .org prices, while for-profit Identity Digital has raised .info prices every year, from $10.84 in 2019 to $19 today.

Registrar shamed for alleged crypto abuse neglect

ICANN has given a warning to Malaysian registrar WebNic, claiming that it has turned a blind eye to abuse reports in breach of new Registrar Accreditation Agreement rules.

ICANN Compliance says the company, a subsidiary of Kuala Lumpur-based Qinetics, failed to take action to resolve abuse reports made against several domains it manages.

Online reports and databases suggest the names in question were used in phishing attacks attempting to steal cryptocurrency wallet credentials.

Compliance said it “has observed a concerning pattern regarding DNS Abuse mitigation”, saying WebNic continually drags its feet on responding to abuse reports, often only taking action after ICANN gets involved.

The breach notice adds:

The Registrar frequently issued repeated requests for evidence to abuse reporters – even when the original reports appeared actionable – and failed to fully consider information or clarifications provided by the abuse reporter, ICANN or otherwise reasonably accessible to the Registrar. In other cases, the Registrar requested evidence from the abuse reporters that did not appear to be relevant to the reported activity, causing additional delays.

WebNic is not a young, fly-by-night registrar. It’s been around a quarter century and has over 800,000 domains under management just in the gTLDs. Its parent also offers registry back-end services.

The company has until August 19 to make Compliance happy or risk termination proceedings.

Poblete’s ICANN board seat safe

Patricio Poblete seems set to serve a third and final term on ICANN’s board of directors, after nobody else put themselves forward as an alternative.

Poblete, of Chilean ccTLD registry NIC Chile, was nominated to continue in the role as one of the two ccNSO representatives on the board after his current term expires October 2026.

Nobody else stepped up as an alternative, so Poblete now appears to be a shoo-in, assuming he passes due diligence. The ccNSO said “if only one candidate is nominated, no election is required”.

His third term would end in late 2029.

ICANN settles $77 million sexual harassment suit

ICANN has settled another sexual harassment lawsuit filed against it by a former employee.

An ICANN spokesperson said the case, filed last August by 22-year meetings-team veteran Tanzanica King, “has been resolved”. King did not immediately respond to a request for comment.

King had asked for $77 million in damages, approximately half of ICANN’s annual budget, alleging she was the victim of a widespread “frat boy culture” that contributed to her being sexually harassed by her boss, passed over for promotions, and paid less than male colleagues.

The settlement, any financial component of which will no doubt be for a tiny fraction of what was demanded, seems to have come just a few weeks after ICANN lost its attempt to get the case thrown out and referred instead to arbitration.

A Los Angeles judge in June ruled that King was protected by a post-#MeToo law, the Ending Forced Arbitration of Sexual Assault and Sexual Harassment Act (EFAA), even though her employment contract dated back to 2002.

ICANN said last year that the allegations were “untrue” and that it “strives to create a positive, safe, and inclusive work and community environment, and is committed to the highest possible standards of ethical, moral, and legal business conduct.”

It’s at least the third time ICANN has had to settle sexual harassment suits in recent years.

Registrars agree to higher ICANN fees

Domain registrars have agreed to pay more in ICANN fees, after a supermajority vote.

ICANN said today that registrars representing over two thirds of fees voted in favor of the increases, part of a package which Org reckons will add $4.6 million to its annual budget at first.

The package of increases also comes with an increase of the per-transaction fee, typically added by registrars at the checkout and sometimes called the “ICANN tax”, from $0.18 per domain to $0.20.

But the vote related to the variable fees, which will now go up from $3.42 million to $3.8 million per year. That sum is split equally between registrar accreditations, with a deep two-thirds discount for registrars with under 350,000 domains.

The fixed annual $4,000 per-accreditation fee is not changing.

The increases were proposed last October, along with registry fee increases, to plug budget shortfalls caused by macroeconomic factors such as inflation, lumpy registration patterns, and the post-Covid slump in registered names.

These are the first price increases ICANN has implemented in well over a decade.