ICANN to kill off 60-day domain transfer lock

ICANN is set to kill off its unpopular 60-day transfer lock policy, following a vote at ICANN 82 in Seattle this week.

The GNSO Council yesterday voted to accept the final report of its Transfer Policy working group, a mammoth 163-page document that contains 47 recommendations affecting all areas of domain transfers.

The removal of the transfer lock is perhaps the biggest change to the 20-year-old policy for domain registrants.

Under the current policy, when you buy a domain name from another registrant or change your name, organization or email address, you trigger a lock that prevents you transferring your domain to another registrar for 60 days.

It was designed as an anti-fraud measure, stopping domain thieves bouncing their stolen names to sleazy registrars to avoid them being recovered by their victims.

But is has proved unpopular over the years with registrants that want to consolidate their portfolios under their preferred registrar and the new policy would remove the lock entirely.

It would also remove the requirement for both gaining and losing registrants (ie buyer and seller) to be notified when a change of registrant occurs, on the basis that notifications don’t provide much protection when the losing registrant’s email has already been compromised.

The whole process governing changes to registrant data is going to be spun out into a separate Change of Registrant Data Policy, because maybe it didn’t belong in the Transfer Policy in the first place.

The newly approved changes will also introduce two new locks that registrars currently may, but are not required to, impose — there’s going to be mandatory 720-hour (30-day) locks on domains that have just been created or just transferred in.

Any registrars that currently impose a longer lock will have to reduce it to 720 hours and any registrar that does not have such a lock will be required to implement one.

The GNSO says these month-long locks will help reduce credit card fraud and help comply with trademark complaints such as UDRP.

There are dozens of other changes coming that do not relate to locks.

For example, the list of reasons a registrar may deny a transfer has been updated to include a reference to DNS abuse, as currently defined in the ICANN registry and registrar contracts.

There are numerous changes of terminology, required notifications, and instructions for handling Transfer Authorization Codes, all of which registrars and registrars will have to implement if they want to stay compliant with their ICANN contracts.

There are also changes to bulk portfolio transfers, limiting registries to a charge of $50,000 for portfolios over 50,000 domains.

The changes would also incorporate an updated Bulk Transfer After Partial Portfolio Acquisition (BTAPPA) directly into the Transfer Policy, meaning registries no longer have to request it from ICANN via the Registry Services Evaluation Process.

The recommendations, unanimously approved by the GNSO Council yesterday, will now go to ICANN’s board of directors for final approval. The final updated Transfer Policy will then be written by an ICANN/GNSO team.

Registries and registrars will then presumably be given time to implement the policy before it becomes law and Compliance comes sniffing around for infractions. We’re talking about at least 18 months before the changes go live, I reckon.

If you have a high tolerance for boredom, the full list of recommendations can be read in this PDF.

Lancaster bags up its dot-brand

A French leather goods company is trashing its lightly-used dot-brand gTLD.

Lancaster has told ICANN that it wants to terminate its Registry Agreement for .lancaster.

The company added half a dozen names to the gTLD in 2016 — things like bag.lancaster and fashion.lancaster — but they always just redirected to its primary web site at lancaster.com.

Lancaster used AFNIC as its back-end registry services provider.

The string “Lancaster” has many uses, from other brands to geographic locations, so it’s not impossible .lancaster might return in another guise in a future new gTLD application round.

NomCom confirms Americans rejected from ICANN board

North American candidates for ICANN’s board of directors are having their applications politely rejected, the Nominating Committee has confirmed.

Speaking to the GNSO Council at ICANN 82 in Seattle yesterday, NomCom chair-elect Tom Barrett said ICANN’s rules forbid the committee from now considering candidates from the region.

“When we opened the application window, January 15, there were no geographic restrictions for these three positions,” he said. “As you know, that has now changed…. We’ll be maxed out terms of the geographic limitation for North America.”

The specific changes of circumstance are the recent elections of Canadian Byron Holland by the ccNSO and American Greg DiBiase by the GNSO.

ICANN’s bylaws state that no more than five voting members of the board, excluding the CEO, may be from the same region. The board already has three other North Americans.

Candidates from North America who had already applied for the three open board seats will be emailed to inform them they are no longer eligible, Barrett said.

Candidates that had identified as North American but have dual citizenship with a country in a different region are eligible to reapply under their other affiliation, he said.

Nova announces $45 million of new gTLD applications

Nova Registry, which runs .link, has announced it plans to apply for 200 new gTLDs when ICANN opens up the next application window about a year from now.

It’s the first time in this round a company has announced plans to build a huge TLD portfolio. It would cost around $45.4 million in application fees alone, if ICANN’s guide price of $227,000 stays true.

It would make Nova the second-largest applicant by gTLD count to date, dwarfed only by the over 300 Donuts applied for in 2012. It would be about twice as large as the 101 Google applied for last time.

In the 2026 round, only Unstoppable Domains has announced a large number of applications — more than 50 — but those are all with partners that would presumably eventually become the contracted registry.

It’s not entirely clear from today’s announcement whether Nova is financing this project, which it calls SuperNova200, alone, or whether it’s looking for business partners.

“We will apply for 200 new Generic Top-Level Domains (gTLDs),” the registry says. “A new breed of gTLDs to drive innovation, competition, and consumer choice while enhancing the utility of the DNS.”

Nova entered the market in 2022 when it acquired .link from UNR. It appears to be ultimately owned by domainer Yonatan Belousov and is managed by ICM Registry alum Vaughn Liley.

ICANN turns to AI and crowdsourcing for new gTLD program

ICANN says it will use a combination of AI and crowdsourcing to translate new gTLD program materials on the cheap.

Org said in a blog post that when a community member trying to drum up interest in new gTLDs in their local community needs some official ICANN documents in an unsupported language, ICANN will prepare a translation on demand.

The first run will be done with AI machine translation, and the draft will be posted on a community wiki for review by volunteers who can read the relevant language before ICANN finalizes and publishes a final PDF.

ICANN seems ready to post drafts of documents such as FAQs and info sheets in languages such as Hindi, Italian and Portuguese after next week’s ICANN 82 public meeting.

Program documents are usually only available in the six official UN languages — Arabic, Chinese, English, French, Spanish, and Russian — so this project should bring the new gTLD program to a much wider audience.

Using AI and volunteers should mean it costs almost nothing beyond the work hours ICANN staff put in to administer it.

ChatGPT tells me that there are 195 to 200 official national languages in the world and 3,500 to 4,000 written languages altogether, but I didn’t check whether those numbers are correct.

If the AI is wrong, let me know in the comments.

Amazon lawyer DiBiase elected to ICANN board

Greg DiBiase, senior corporate counsel at Amazon, has been elected to serve on ICANN’s board of directors, representing registries and registrars.

He beat Reg Levy, associate general counsel at Tucows, in the two-horse second round of voting, and five other candidates overall, to become the Contracted Parties House selection for Seat 13 on the board.

He will replace Becky Burr, an ICANN community lifer formerly with Neustar, who is term-limited and will leave the board after nine years at the Org’s Annual General Meeting in Muscat, Oman, this October.

DiBiase is currently chair of the GNSO Council and identifies as a registrar rather than a registry (Amazon is both).

He said in his candidate statement (pdf) late last year that ICANN today is too “risk-averse”, focussing too much on its fear of lawsuits, and that it should be more accountable when responding to community complaints.

DiBiase told DI:

I look forward to serving the Contracted Parties in this role and am honored by their trust in me. During the course of the election, my fellow candidates articulated a wealth of ideas on how to improve ICANN and multi-stakeholder model. These perspectives will guide me as a member of the ICANN Board.

The election result needs to be given the nod by the GNSO Council and the ICANN Empowered Community, both of which are usually pretty much formalities, before he can formally take on his board role.

Tucows quits ICANN’s Whois disclosure pilot

Tucows has dramatically dropped out of ICANN’s Registration Data Request Service pilot.

The company said that RDRS provides a poor user experience that harms user privacy and causes ICANN to produce misleading usage statistics that show an artificially high request denial rate.

RDRS is a bit more than half way through a two-year pilot designed to gather data that will help ICANN decide whether to deploy a more permanent and probably more expensive long-term solution.

The service is essentially a clearinghouse that connects people who want to request private Whois data with the registrars that manage domains of interest.

Tucows said in a blog post:

Given that the RDRS Standing Committee has enough data to complete its report, as well as the customer experience challenges and data privacy concerns we’ve outlined above, Tucows Domains has decided to end our participation in the RDRS.

The move makes Tucows the highest-profile registrar to pull out of the service to date. Across its various brands (such as Ascio, Enom, EPAG, and OpenSRS) it has around 10 million domains under management.

As of the end of January, RDRS had 94 registrars on board, covering 60% of all registered gTLD domains.

Tucows said it will continue to offer its TACO service, which also allows entities such as intellectual property interests to request private Whois data but charges requesters at least $3,000 a year, which it calls a “cost recovery fee”.

The TACO fee can be waived for “single-use and non-commercial requestors”, Tucows noted. It has updated its terms accordingly.

Second new gTLD contention set revealed

The first showdown between new gTLD application consultants D3 Global and Unstoppable Domains has emerged, with the announcement this week of a bid for a cartoons-themed gTLD by a D3 client.

D3 said in a press release it has partnered with outfits called Animecoin Foundation and Azuki to apply to ICANN for .anime, representing the Japanese art form, when the next application round opens a bit over a year from now.

Together, the two D3 partners provide a cryptocurrency designed to enable people to trade digital art NFTs, and the NFTs themselves.

But the expected .anime application is not the first to be publicly announced. Last June, Unstoppable said it’s planning to apply for .manga and .anime with a client called Kintsugi Global.

It’s the second likely contention set between publicly announced applicants. Freename.io and 3DNS have both separately announced bids for .chain, of course intended for blockchain-related usage.

The next application window is scheduled to open April 2026 or thereabouts. There are multiple ways contention sets can be resolved under the current rules, but the main one is expected to be an ICANN-managed auction.

No more Americans as Holland wins ICANN board seat

ICANN’s country-code registries have picked their next representative for the ICANN board of directors.

Byron Holland, CEO of Canadian ccTLD registry CIRA won the seat, which was vacated last September with the abrupt resignation of incumbent Katrina Sataki, who had already been reelected for a second term.

I believe Holland will join the board, after the formality of approval by ccNSO and the ICANN Empowered Community, immediately as Sataki’s replacement, rather that waiting for this year’s AGM as would usually be the case.

Holland comfortably beat Nick Wenban-Smith, general counsel of .uk registry Nominet, by 73 votes to 30 in a two-horse race described by one candidate as a disappointing choice between “two kind of middle-aged white guys and native English speakers”.

The election of a Canadian to replace a European as ccNSO representative means the ICANN board has topped out its quota of North Americans, which could have an impact on other election/selection processes.

ICANN’s bylaws state that each of the five geographic regions can have no more than five voting directors.

Directors Tripti Sinha, Sarah Deutsch and Miriam Sapiro all hail from North America. Term-limited Becky Burr, also American, is to be replaced later this year, but the shortlist of her replacement options are both also Americans.

This seems to mean that the Nominating Committee, charged this year with replacing term-limited European Maarten Botterman and renewing or replacing Sajid Rahman and Chris Chapman, both from Asia-Pacific, has had its field of candidates limited somewhat.

The Address Supporting Organization is also in election mode for its board seat this year, but neither of the candidates are North American.

Registries have started shutting down Whois

Nominet seems to have become the first major registry services provider to start to retire Whois across its portfolio, already cutting off service for about 70 top-level domains.

Queries over port 43 to most of Nominet’s former Whois servers are no longer returning responses, and their URLs have been removed from the respective TLDs’ records on the IANA web site.

The move follows the expiration last month of ICANN’s contractual requirements to provide Whois in all gTLDs. Now, registries must use the successor protocol RDAP instead, with Whois optional.

A Nominet spokesperson tells us the shut-off, which affects large dot-brand clients including Amazon, happened after consultation with ICANN and clients on January 29.

TLDs Nominet was supporting under ICANN’s Emergency Back-End Registry Operator program are also affected.

The registry spokesperson said that the gTLDs .broadway, .cymru, .gop, .pharmacy, and .wales are still offering Whois, due to an interoperability issue:

“The sole reason for the retention of these gTLD WHOIS services is for interoperability with the Brand Safety Alliance (BSA) service integration, which does not yet support RDAP,” she said.

The BSA is the GoDaddy-backed project that offers the multi-TLD GlobalBlock trademark-blocking service.

Nominet’s flagship .uk is also still offering Whois, because Nominet discovered that some of its registrars were still using it, rather than EPP, to do domain availability checks.

The fact that a GoDaddy service and some .uk registrars still don’t support RDAP, even after a years-long ICANN transition plan, is perhaps revelatory.

I’ll admit the only reason I noticed Nominet’s Whois coverage was patchy was that I’d neglected to update one of my scripts and it started failing. Apparently I was not alone.

While RDAP can be fairly simple to implement (if I can do it…), actually finding each registry’s RDAP server is a bit more complicated than under the Whois regime.

All gTLD registries were obliged to offer Whois at whois.nic.[tld], and IANA would publish the URLs on its web site, but RDAP URLs are not standardized.

It’s not super obvious, but it seems instead you have to head over to IANA’s “Bootstrap Service” and download a JSON file containing a list of TLDs and their associated base RDAP URLs.