Get ready for thousands of new two-letter domains

New gTLD registry operators have been given the right to start selling two-letter domains that match country codes.
Potentially thousands of names could start being released next year, resulting in a windfall for registries and possible opportunities for investors.
Some governments, however, appear to be unhappy with the move and how ICANN’s board of directors reached its decision.
The ICANN board yesterday passed a resolution that will unblock all two-letter domains that match country codes appearing on the ISO 3166 list, most of which are also ccTLDs.
While the resolution gives some protection to governments worried about abuse of “their” strings, it’s been watered down to virtually nothing.
In the first draft of the rules, published in July, ICANN said registries “must” offer an “Exclusive Availability Pre-registration Period” — a kind of mini-sunrise period limited to governments and ccTLD operators.
In the version approved by ICANN yesterday, the word “must” has been replaced by “may” and the word “voluntary” has been added.
In other words, registries won’t have to give any special privileges to governments when they start selling two-character names.
They will, however, have to get registrants to agree that they won’t pass themselves off as having affiliations with the relevant government. It looks like registries probably could get away with simply adding a paragraph to their terms of service to satisfy this requirement.
Registries will also have to “take reasonable steps to investigate and respond to any reports from governmental agencies and ccTLD operators of conduct that causes confusion with the corresponding country code in connection with the use of a letter/letter two-character ACSCII domain.”
This too is worded vaguely enough that it could wind up being worthless to governments, many of which are worried about domains matching their ccTLDs being passed off as government-approved.
The Governmental Advisory Committee is split on how worrisome this kind of thing is.
For examples, governments such as Spain and Italy have fought for the right to get to pre-approve the release of “es” and “it” domains, whereas the governments of the US and UK really could not care less.
The most-recent formal GAC advice on the subject, coming out of the July meeting in Helsinki, merely said ICANN should:

urge the relevant Registry or the Registrar to engage with the relevant GAC members when a risk is identified in order to come to an agreement on how to manage it or to have a third-party assessment of the situation if the name is already registered

“It is our belief that that our resolution is consistent with GAC advice,” outgoing ICANN board member Bruce Tonkin said yesterday, noting that nobody can claim exclusive rights over any string, regardless of length.
Before and after the resolution passed, the GAC expressed “serious concern” that the board had not formally responded to the Helsinki communique.
In its Hyderabad communique, issued after yesterday’s vote, the GAC advised the board to:

• Clearly indicate whether the actions taken by the Board as referred to in the resolution adopted on 8 November 2016 are fully consistent with the GAC advice given in the Helsinki Communiqué.
• Always communicate in future the position of the Board regarding GAC advice on any matter in due time before adopting any measure directly related to that advice.

ICANN staff are now tasked with coming up with a way to implement the two-character release.
My sense is that some kind of amendment to Registry Agreements might be required, so we’re probably looking at months before we start seeing two-letter domains being released.

“Shadow content policing” fears at ICANN 57

Fears that the domain name industry is becoming a stooge for “shadow regulation” of web content were raised, and greeted very skeptically, over the weekend at ICANN 57.
Attendees yesterday heard concerns from non-commercial stakeholders, notably the Electronic Frontier Foundation, that deals such as Donuts’ content-policing agreement with the US movie industry amount to regulation “by the back door”.
But the EFF, conspicuously absent from substantial participation in the ICANN community for many years, found itself walking into the lion’s den. Its worries were largely pooh-poohed by most of the rest of the community.
During a couple of sessions yesterday, EFF senior attorney Mitch Stoltz argued that the domain industry is being used by third parties bent on limiting internet freedoms.
He was not alone. The ICANN board and later the community at large heard support for the EFF’s views from other Non-Commercial User Constituency members, one of whom compared what’s going on to aborted US legislation SOPA, the Stop Online Piracy Act.
“Regulation of content through the DNS system, through ICANN institutions and through contracted parties is of great concern and I think should be of great concern to all of us here,” Stoltz said.
He talked about a “bright line” between making policies related to domain names and policies related to content.
“I hope that the bright line between names and content is maintained because I think once we get past it, there may be no other bright line,” he said.
“If we allow in copyright enforcement, if we allow in enforcement of professional or business licensing as a criterion for owning a domain name, it’s going to be very hard to hold that line,” he said.
ICANN has long maintained, though with varying degrees of vigor over the years, that it does not regulate content.
Chair Steve Crocker said yesterday: “It’s always been the case, from the inception. It’s now baked in deeply into the mission statement. We don’t police content. That’s not our job.”
That kind of statement became more fervent last year, as concerns started to be raised about ICANN’s powers over the internet in light of the US government’s decision to give up its unique ICANN oversight powers.
Now, a month after the IANA transition was finalized, ICANN has new bylaws that for the first time state prominently that ICANN is not the content cops.
Page one of the massive new ICANN bylaws says:

ICANN shall not regulate (i.e., impose rules and restrictions on) services that use the Internet’s unique identifiers or the content that such services carry or provide

It’s pretty explicit, but there’s a catch.
A “grandfather” clause immediately follows, which states that registries and registrars are not allowed to start challenging the terms of their existing contracts on the basis that they dabble too much with content regulation.
That’s mainly because new gTLD Registry Agreements all include Public Interest Commitments, which in many cases do actually give ICANN contractual authority over the content of web sites.
Content-related PICs are most prominent in “Community” gTLDs.
In the PICs for Japanese city gTLD .osaka, for example, the registry promises that “pornographic, vulgar and highly objectionable content” will be “adequately monitored and removed from the namespace”.
While ICANN does not actively go out looking for .osaka porn, if porn did start showing up in .osaka and the registry does not suspend the domains, it would be in breach of its RA and could lose its contract.
That PIC was voluntarily adopted by the .osaka registry and does not apply to other gTLDs, but it is binding.
So in a roundabout kind of way, ICANN does regulate content, in certain narrow circumstances.
Some NCUC members think this is a “loophole”.
Another back door they think could be abused are the bilateral “trusted notifier” relationships between registries and third parties such as the movie, music and pharmaceutical industries.
Donuts and Radix this year have announced that the Motion Picture Association of America is allowed to notify it about domains that it believes are being used for large-scale, egregious movie piracy.
Donuts said it has suspended a dozen domains — sites that were TLD-hopping to evade suspension — since the policy came into force.
EFF’s Stoltz calls this kind of thing “shadow regulation”.
“Shadow regulation to us is the regulation of content… through private agreements or through unaccountable means that were not developed through the bottom-up process or through a democratic process,” he told the ICANN board yesterday.
While the EFF and NCUC thinks this is a cause for concern, they picked up little support from elsewhere in the community.
Speakers from registries, registrars, senior ICANN staff, intellectual property and business interests all seemed to think it was no big deal.
In a different session on the same topic later in the day, outgoing ICANN head of compliance Allen Grogan addressed these kinds of deals. He said:

From ICANN’s point of view, if there are agreements that are entered into between two private parties, one of whom happens to be a registry or a registrar, I don’t see that ICANN has any role to play in deciding what kinds of agreements those parties can enter into. That clearly is outside the scope of our mission and remit.
We can’t compel a registrar or a registry to even tell us what those agreements are. They’re free to enter into whatever contracts they want to enter into.
To the extent that they become embodied in the contracts as PICs, that may be a different question, or to the extent that the agreements violate those contracts or violate consensus policies, that may be a different question.
But if a registrar or registry decides to enter into an agreement to trust the MPAA or law enforcement or anyone else in deciding what actions to take, I think they’re free to do that and it would be far beyond the scope of ICANN’s power or authority to do anything about that.

In the same session, Donuts VP Jon Nevett cast doubt on the idea that there is an uncrossable “bright line” between domains and content by pointing out that the MPAA deal is not dissimilar to registries’ relationships with the bodies that monitor online child abuse material.
“We have someone that’s an expert in this industry that we have a relationship with saying there is child imagery abuse going on in a name, we’re not going to make that victim go get a court order,” he said.
Steve DelBianco of the NetChoice Coalition, a member of the Business Constituency, had similar doubts.
“Mitch [Stoltz] cited as an example that UK internet service providers were blocking child porn and since that might be cited as an example for trademark and copyright that we should, therefore, not block child porn at all,” he said. “I can’t conceive that’s really what EFF is thinking.”
Nevett gave a “real-life example” of a rape.[tld] domain that was registered in a Donuts gTLD.
“[The site] was a how-to guide. Talk about horrific,” he said. “We got a complaint. I’m not going to wait till someone goes and gets a court order. We’re a private company and we agreed to suspend that name immediately and that’s fine. There was no due process. And I’m cool with that because that was the right thing to do.”
“Just like a restaurant could determine that they don’t want people with shorts and flip-flops in the restaurant, we don’t want illegal behavior and if they want to move somewhere else, let them move somewhere else,” he said.
In alleged copyright infringement cases, registrants get the chance to respond before their names are suspended, he said.
Stoltz argued that the Donuts-MPAA deal had been immediately held up, when it was announced back in February, as a model that the entire industry should be following, which was dangerous.
“If everyone is subject to the same policies, then they are effectively laws and that’s effectively law-making by other means,” he said.
He and other NCUC members are also worried about the Domain Name Association’s Healthy Domains Initiative, which is working on voluntary best practices governing when registries and registrars should suspend domain names.
Lawyer Kathy Kleiman of the NCUC said the HDI was basically “SOPA behind closed doors”.
SOPA was the hugely controversial proposed US federal legislation that would have expanded law enforcement powers to suspend domains in cases of alleged copyright infringement.
Stoltz and others said that the HDI appeared to be operating under ICANN’s “umbrella”, giving it an air of having multistakeholder legitimacy, pointing out that the DNA has sessions scheduled on the official ICANN 57 agenda and “on ICANN’s dime”.
DNA members disagreed with that characterization.
It seems to me that the EFF’s arguments are very much of the “slippery slope” variety. While that may be considered a logical fallacy, it does not mean that its concerns are not valid.
But if there was a ever a “bright line” between domain policy and content regulation, it was traversed many years ago.
The EFF and supporters perhaps should just acknowledge that what they’re really concerned about is copyright owners abusing their powers, and target that problem instead.
The line has moved.

Governments mull greater geo gTLD powers

Governments are toying with the idea of asking ICANN for greater powers over gTLDs that match their geographic features.
The names of rivers, mountains, forests and towns could be protected under ideas bandied around at the ICANN 57 meeting in India today.
The Governmental Advisory Committee held a session this morning to discuss expanding the list of strings that already enjoy extra ICANN protections on grounds of geography.
In the 2012 application round, gTLDs matching the names or ISO acronyms of countries were banned outright.
For capital city names and non-capital names where the gTLD was meant to represent the city in question, government approval was required.
For regions on the ISO 3166 list, formal government non-objection was required whether or not the gTLD was intended to represent the region.
That led to gTLDs such as .tata, a dot-brand for Tata Group, being held up indefinitely because it matches the name of a small region of Morocco.
One applicant wound up agreeing to fund a school to the tune of $100,000 in order to get Montenegro’s support for .bar.
But other names were not protected.
Notably, the string “Amazon” was not on any of the protected lists, largely because while it’s a river and a forest it doesn’t match the name of a formal administrative region of any country.
While GAC objections ultimately killed off Amazon’s bid for .amazon (at least for now), the GAC wants to close the Amazon loophole in time for the next new gTLD application round.
The GAC basically is thinking about the power to write its own list of protected terms. It would build on the existing list to also encompass names of “geographic significance”.
GAC members would be able to submit names to the list; applicants for those names would then require non-objection letters from the relevant government(s).
Some governments, including the UK and Peru, expressed concern that “geographic significance” is a little vague.
Truly, without a narrow definition of “significance” it could turn out to be a bloody big list. The UK alone has over 48,000 towns, not to mention all the named forests, rivers and such.
Peru, one of the nations that had beef with Amazon, said it intended to send ICANN a list of all the geographic names it wants protecting, regardless of whether the GAC decides to create a new list.
Other GAC members, including Iran and Denmark, pressed how important it was for the GAC to coordinate with other parts of the ICANN community, mainly the GNSO, on geo names, to avoid overlap and conflict further down the line.
The GAC has a working group looking at the issue. It hopes to have something to recommend to the ICANN board by the Copenhagen meeting next March.

Should new gTLDs be first-come, first-served?

Who needs rounds? The idea of allocating new gTLDs on a first-come, first-served basis is getting some consideration at this week’s ICANN 57 meeting.
Such a move could have profound implications on the industry, creating new business opportunities while scuppering others.
Whether to shift to a FCFS model was one of many issues discussed during a session today of the GNSO’s working group tasked with looking at the next new gTLD round.
Since 2000, new gTLDs have been allocated in strict rounds, with limited application windows and often misleading guidance about when the next window would open, but it’s not written in stone that that is the way it has to be.
The idea of switching to FCFS — where any company could apply for any gTLD at any time — is not off the table.
FCSC would not mean applicants would merely have to ask for a string and automatically be granted — there’d still be multiple phases of evaluation and opportunities for others to object, so it wouldn’t be just like registering a second-level domain.
Depending on how the new process was designed, doing away with rounds could well do away with the concept of “contention” — multiple applicants simultaneously vying for the same string.
This would basically eliminated the need for auctions entirely.
No longer would an applicant be able to risk a few hundred thousand bucks in application expenses in the hope of a big private auction pay-day. Similarly, ICANN’s quarter-billion-dollar pool of last-resort auction proceeds would grow no more.
That’s potentially an upside, depending on your point of view.
On the downside, and it’s a pretty big downside, a company could work on a solid, innovative gTLD application for months only to find its chances scuppered because a competitor filed an inferior application a day earlier.
A middle way, suggested during today’s ICANN 57 session, would be a situation in which the filing of an application starts a clock of maybe a few months during which other interested parties would be able to file their own applications.
That would keep the concept of contention whilst doing away with the restrictive round-based structure, but would present plenty of new opportunities for exploitation and skulduggery.
Another consequence of the shift to FCSC could be to eliminate the concept of Community gTLDs altogether, it was suggested during today’s session.
In 2012, applicants were given the opportunity to avoid auction if they could meeting exacting “Community” standards. The trade-off is that Community gTLDs are obliged to be restricted to their designated community.
If FCSC led to contention going away, there’d be no reason for any applicant to apply for a Community gTLD that could unnecessarily burden their business model in future.
For those strongly in favor of community gTLDs, such as governments, this could be an unwelcome outcome.
Instinctively, I think FCSC would be a bad idea, but I think I’d be open to persuasion.
I think the main problem with the round-based structure today is that it’s unpredictable — nobody knows when the next round is likely to be so it’s hard to plan their new gTLD business ideas.
Sure, FCSC would bring flexibility, allowing companies to apply at times that are in tune with their business objectives, but the downsides could outweigh that benefit.
Perhaps the way to reduce unpredictability would be to put application windows on a predictable, reliable schedule — once a year for example — as was suggested by a participant or two during today’s ICANN 57 session.
The discussions in the GNSO are at a fairly early stage right now, but a switch to FCSC would be so fundamental that I think it needs to be adopted or discarded fairly quickly, if there’s ever going to be another application round.

ICANN has $400m in the bank

ICANN ended its fiscal 2016 with just shy of $400 million on its balance sheet, according to its just-released financial report.
As of June 30, the organization had assets of $399.6 million, up from $376.5 million a year earlier, the statement (pdf) says.
Its revenue for the year was actually down, at $194.6 million in 2016 compared to $216.8 million in 2015.
That dip was almost entirely due to less money coming in via “last-resort” new gTLD auctions.
The growth of the gTLD business led to $74.5 million coming from registries, up from $59 million in 2015.
Registrar revenue grew from $39.3 million to $48.3 million.
Money from ccTLD registries, whose contributions are entirely voluntary, was down to $1.1 million from $2.1 million.
Expenses were up across the board, from $143 million to $131 million, largely due to $5 million increases in personnel and professional services costs.
The results do not take into account the $135 million Verisign paid for .web, which happened after the end of the fiscal year.
Auction proceeds are earmarked for some yet-unspecified community purpose and sit outside its general working capital pool. Regardless, they’re factored into these audited financial reports.
ICANN has to date taken in almost a quarter of a billion dollars from auctions. Its board recently decided to diversify how the money is invested, so the pot could well grow.

Radix acquires .fun gTLD from Warren Buffett

New gTLD portfolio player Radix has acquired the pre-launch TLD .fun from its original owner.
The company took over the .fun Registry Agreement from Oriental Trading Company on October 4, according to ICANN records.
Oriental is a party supplies company owned by Warren Buffett’s Berkshire Hathaway.
It won .fun in a private auction in April last year, beating off Google and .buzz operator DotStrategy.
It had planned to run it as a “closed generic” — keeping all the domains in .fun for itself — but those plans appeared to have been shelved by the time it signed its RA in January this year.
Evidently Oriental’s heart was not in it, and Radix made an offer for the string it found more attractive.
Radix business head Sandeep Ramchandani confirmed to DI today that .fun will be operated in a completely unrestricted manner, the same as its other gTLDs.
It will be Radix’s first three-letter gTLD, Ramchandani said. It already runs zones such as .online, .site and .space.
.fun is not yet delegated, but Radix is hoping for a December sunrise period, he said.

Guess which registrars sell the most gTLDs

MarkMonitor has become the first accredited registrar to carry over 500 gTLDs.
Inspired by a recent Dynadot press release outlining its passing of the 500-TLD mark, I thought I’d put together a league table of gTLD registrars, ordered by which carries the most.
It will come as little surprise to most that brand protection registrars dominate the top end of the list.
MarkMonitor tops the league, with 504 gTLDs in its stable as of the end of June, up from 499 in May.
It’s closely followed by Ascio and CSC. Indeed, brand-focused registrars occupy many of the top 30 registrars, as you can see from this table.
[table id=45 /]
There’s no real correlation between the number of gTLDs carried and the total domains under management for the registrar.
GoDaddy, with 53 million names, is way down in 28th position, for example.
The list was compiled from the latest gTLD registry reports, which show how many domains were registered to each accredited registrar at the end of June.
The data does not not include ccTLDs, nor does it account for situations where registrars may retail a TLD via a gateway or as a reseller of another registrar.

Google could shake up the registry market with new open-source Nomulus platform

Google has muscled in to the registry service provider market with the launch of Nomulus, an open-source TLD back-end platform.
The new offering appears to be tightly integrated with Google’s various cloud services, challenging long-held registry pricing conventions.
There are already indications that at least one of the gTLD market’s biggest players could be considering a move to the service.
Donuts revealed yesterday it has been helping Google with Nomulus since early 2015, suggesting a shift away from long-time back-end partner Rightside could be on the cards.
Nomulus, which is currently in use at Google Registry’s handful of early-stage gTLDs, takes care of most of the core registry functions required by ICANN, Google said.
It’s a shared registration system based on the EPP standard, able to handle all the elements of the domain registration lifecycle.
Donuts contributed code enabling features it uses in its own 200-ish gTLDs, such as pricing tiers, the Early Access Period and Domain Protected Marks List.
Nomulus handles Whois and likely successor protocol RDAP (Registration Data Access Protocol).
For DNS resolution, it comes with a plug-in to make TLDs work on the Google Cloud DNS service. Users will also be able to write code to use alternative DNS providers.
There’s also software to handle daily data escrow to a third-party provider, another ICANN-mandated essential.
But Nomulus lacks critical features such as billing and fully ICANN-compliant reporting, according to documentation.
So will anyone actually use this? And if so, who?
It’s too early to say for sure, but Donuts certainly seems keen. In a blog post, CEO Paul Stahura wrote:

As the world’s largest operator of new TLDs, Donuts must continually explore compelling technologies and ensure our back-end operations are cost-efficient and flexible… Google has a phenomenal record of stability, an almost peerless engineering team, endless computing resources and global scale. These are additional potential benefits for us and others who may contribute to or utilize the system. We have been happy to evaluate and contribute to this open source project over the past 20 months because this platform provides Donuts with an alternative back-end with significant benefits.

In a roundabout way, Donuts is essentially saying that Nomulus could work out cheaper than its current back-end, Rightside.
The biggest change heralded by Nomulus is certainly pricing.
For as long as there has been a competitive market for back-end domain registry services, pricing has been on a per-domain basis.
While pricing and model vary by provider and customer, registry operators typically pay their RSPs a flat fee and a buck or two for each domain they have under management.
Pricing for dot-brands, where DUM typically comes in at under 100 today, is believed to be weighted much more towards the flat-fee service charge element.
But that’s not how Nomulus is to be paid for.
While the software is open source and free, it’s designed to run on Google’s cloud hosting services, where users are billed on the fly according to their usage of resources such as storage and bandwidth consumed.
For example, the Google Cloud Datastore, the company’s database service that Nomulus uses to store registration and Whois records, charges are $0.18 per gigabyte of storage per month.
For a small TLD, such as a dot-brand, one imagines that storage costs could be reduced substantially.
However, Nomulus is not exactly a fire-and-forget solution.
There is no Google registry service with customer support reps and such, at least not yet. Nomulus users are responsible for building and maintaining their registry like they would any other hosted application.
So the potentially lower service costs would have to be balanced against potentially higher staffing costs.
My hunch based on the limited available information is that for a dot-brand or a small niche TLD operating on a skeleton crew that may lack technical expertise, moving to Nomulus could be a false economy.
With this in mind, Google may have just created a whole new market for middleman RSPs — TLD management companies that can offer small TLDs a single point of contact for technical expertise and support but don’t need to build out and own their own expensive infrastructure.
The barrier to entry to the RSP market may have just dropped like a rock, in other words.
And Nomulus may work out more attractive to larger TLD operators such as Donuts, with existing teams of geeks, that can take advantage of Google’s economies of scale.
Don’t expect any huge changes overnight though. Migrating between back-ends is not an easy or cheap feat.
As well as ICANN costs, and data migration and software costs, there’s also the non-trivial matter of shepherding a horde of registrars over to the new platform.
How much impact Nomulus will have on the market remains to be seen, but it has certainly given the industry something to think about.

Donuts will cut off sham .doctors

Donuts has outlined plans to suspend or delete .doctor domain names used by fake medical doctors.
Despite protestations from governments and others, .doctor will not be a restricted gTLD when it goes to general availability next week — anyone will be able to register one.
However, Donuts said last week that it will shut down phony doctor sites:

While we are firmly committed to free speech on the Internet, we however will be on guard against inappropriate or dangerous uses of .DOCTOR. Accordingly, if registrants using this name make the representation on their websites that they are licensed medical practitioners, they should be able to demonstrate upon request that in fact they hold such a license. Failure to so demonstrate could be considered a violation of the terms of registration and may subject the registrant to registrar and registry rights to delete, revoke, suspend, cancel, or transfer a registration.

A Donuts spokesperson said that the registry will have the right to conduct spot-checks on sites, but at first will only police the gTLD in response to complaints from others.
“We have the right to spot check, but no immediate plans to do so,” he said.
In a few fringe cases, the failure to present a license would not result in the loss of a domain.
For example, a “registrant is in a jurisdiction that doesn’t license doctors (if that exists)” or a “registrant that represents him/herself as a licensed medical doctor, but uses the site to sell cupcakes”, the spokesperson said.
ICANN’s Governmental Advisory Committee had wanted .doctor restricted to medical doctors, but Donuts complained noting that “doctor” is an appellation used in many other fields beyond medicine.
It can also be used in fanciful ways to market products, the registry said.
ICANN eventually sided with Donuts, allowing it to keep an open TLD as long as it included certain Public Interest Commitments in its registry contract.
.doctor goes to GA October 26.

Rightside new gTLD renewals can top 80%

Rightside says it is seeing encouraging renewal figures from its oldest batch of new gTLDs.
The company this week revealed that renewals after two years of ownership on average stand at 81%.
In a blog post, Rightside broke out some numbers for .dance, .democrat, .ninja, .immobilien, .social, .reviews and .futbol.
Those seven are the only ones in its portfolio to have gone through two full renewal cycles.
The renewal rate after year one was a modest 69% — in other words it lost almost a third of its installed base after 12 months — but this increased to 81% after the second year.
The actual number of domains involved in quite tiny — 81% equates to just 21,000 names across all seven TLDs.
Breaking out a couple of TLDs, Rightside wrote:

Our first gTLD to market, .DANCE, saw a 70% renewal rate in year one expand to 83% in year two for that same subset of domains. Our best performing gTLD of the seven is .IMMOBILIEN, which renewed at 83% in its first year, and grew to a stupendous 87% in its second—which certainly makes sense given the permanent nature of real estate.

But Rightside reckons the numbers reflect well on the new gTLD industry. It said:

domain investors with portfolios including new gTLDs recognize the long-term value of these domain names, and rather than let them drop after the first year, are holding onto them to find the right buyer continue to earn parking revenue. Second—and likely the more significant driver—is that end users are actually picking up these domain names and putting them to use.