Whois “killer” is a recipe for a clusterfuck

An ICANN working group has come up with a proposal to completely replace the current Whois system for all gTLDs.
Outlined in 180 recommendations spread over 166 pages (pdf), it’s designed to settle controversies over Whois that have raged for 15 years or more, in one fell swoop.
But it’s a sprawling, I’d say confusing, mess that could turn domain name registration and the process of figuring out who owns a domain name into an unnecessarily bureaucratic pain in the rear.
That’s if the proposal is ever accepted by the ICANN community, which, while it’s early days, seems like a challenge.
The Expert Working Group, which was controversially convened by ICANN president Fadi Chehade in December 2012, proposes a Registration Data Service that would ultimately replace Whois.
It’s a complex document, which basically proposes rebuilding Whois from the ground up based on ideas first explored by George Orwell, Franz Kafka and Douglas Adams.
Having read it, I’ll do my best in this post to explain what the proposed Registration Data Service seems to entail and why I think it seems like a lot of hard work for very little benefit.
I note in advance as a matter of disclosure that the RDS as proposed would very possibly disenfranchise me professionally, making it harder for me to do my job. I explain why later in this post.
I also apologize in advance for, and will correct if notified of, any errors. It’s taken me a week from its publication to read and digest the proposal and I’m still not sure it’s all sunk in.
Anyway, first:
What’s RDS?
RDS would be a centralized Whois database covering all domains in all gTLDs, new and old, operated by a single entity.
What’s in an RDS record?
Under the hood, RDS records wouldn’t look a heck of a lot different than Whois records look today, in terms of what data they store.
There would be some new optional elements, such as social media user names, but otherwise it’s pretty much the same data as we’re used to seeing in Whois records today.
The big difference is which of these elements would be visible by default to an anonymous internet user doing a regular Whois look-up somewhere.
Some fields would be “public” and some would be “gated” or hidden. Some fields would always be public and some could be toggled between public and gated by the registrant.
Gated fields would not be visible to people doing normal Whois look-ups. To see gated data, you’d need to be accredited to a certain role (cop, trademark owner, etc) and have an RDS account.
By default, much of the data about the “registrant” — including their name, physical address, country, and phone number — would be gated.
No, you’re not reading that wrong — the name of the registrant would be hidden from regular Whois users by default. Their email address, however, would be always be public.
There would also be up to six “Purpose Based Contacts” — an Admin Contact, a Legal Contact, a Technical Contact, an Abuse Contact, a Privacy/Proxy Contact and a Business Contact.
So, for example, a registrant could specify his registrar as his technical PBC and his lawyer as his legal PBC.
The admin, legal, technical and abuse contacts would be mandatory, and would default to the registrant’s own personal contact info.
A newly registered domain would not be activated in the DNS until the mandatory PBCs had been provided.
Each of these four mandatory PBCs would have different levels of disclosure for each data element.
For example, the Admin PBC would be able to hide their mailing address and phone number (both public by default) but not their name, email address or country.
The Legal PBC would not be able to opt out of having their mailing address disclosed, but the Technical and Abuse PBCs would be able to opt out of disclosing pretty much everything including their own name.
Those are just examples. Several tables starting on page 49 of the report (pdf) give all the details about which data fields would be disclosed and which could be hidden.
I think it’s expected by the EWG that most registrants would just accept the defaults and publish the same data in each PBC, in much the same way as they do today.
“This PBC approach preserves simplicity for Registrants with basic contact needs and offers additional granularity for Registrants with more extensive contact needs,” the EWG says.
Who gets the see the hidden stuff?
In order to see the hidden or “gated” elements, you’d have to be an accredited user of the centralized RDS system.
The level of access you got to the hidden data would depend on the role assigned to your RDS account.
The name of the registrant, for example, would be available to anyone with an RDS account.
If you wanted access to the registrant’s mailing address or phone number, you’d need an RDS account that accredited you for one or more of seven defined purposes:

• Domain Name Control (ie, the registrant herself)
• Domain Name Certification (ie SSL Certificate Authorities)
• Business Domain Name Purchase/Sale (anyone who says they might be interested in buying the domain in question)
• Academic/Public Interest DNS Research
• Legal Actions (eg lawyers investigating fraud or trademark infringement)
• Regulatory/Contractual Enforcement (could be ICANN-related, such as UDRP, or unrelated stuff like tax investigations)
• Criminal Investigation/DNS Abuse Mitigation

Hopefully this all makes sense so far, but it gets more complicated.
Beware of the leopard!
In today’s gTLD environment, Whois records are either stored with the registry or the registrar. You can do Whois lookups on the registrar/y’s site, or via a third-party commercial service.
As a registrant, you need only interact with your registrar. As a Whois user, you don’t need to sign up for an account anywhere, unless you want value-added services from a company such as DomainTools.
Under RDS, a whole lot of other entities start to come into play.
First, there’s RDS itself — a centralized Whois replacement.
It’s basically two databases. One contains contact details, each record containing a unique Contact ID identifier. The other database maps Contact IDs to the PBCs for each gTLD domain name.
It’s unclear who’d manage this service, but it looks like IBM is probably gunning for the contract.
Second, there would be Validators.
A Validator’s job would be to collect and validate contact information from registrants and PBCs.
While registrars and registries could also act as Validators — and the EWG envisages most registrars becoming Validators — this is essentially a new entity/role in the domain name ecosystem.
Third and Fourth, we’ve got newly created Accrediting Bodies and Accreditation Operators.
These entities would be responsible for accrediting users of the RDS system (that is, people who want to do a simple goddamn Whois lookup).
The EWG explains that an Accrediting Body “establishes membership rules, terms of service, and application and enforcement processes, etc., for a given RDS User community.”
An Accreditation Operator would “create and manage RDS User accounts, issue RDS access credentials, authenticate RDS access requests, and provide first-level abuse handling”.
Because it’s not complicated enough already, each industry (lawyers, academics, police, etc) would have their own different combination of Accrediting Bodies and Accreditation Operators.
Who benefits from all this?
The reason the EWG was set up in the first place was to try to resolve the conflict between those who think Whois accuracy should be more strictly enforced (generally law enforcement and IP owners) and those who think there should be greater registrant privacy (generally civil society types).
In the middle you’ve got the registries and registrars, who are generally resistant to anything that adds friction to their shopping carts or causes even moderate implementation costs.
The debate has been raging for years, and the EWG was told to:

1) define the purpose of collecting and maintaining gTLD registration data, and consider how to safeguard the data, and 2) provide a proposed model for managing gTLD directory services that addresses related data accuracy and access issues, while taking into account safeguards for protecting data.

So the EWG proposal could be seen as successful if a) privacy advocates are happy and b) trademark lawyers and the FBI are happy, c) registrars/ries are happy and d) Whois users are happy.
Are the privacy dudes happy?
No, they’re not.
The EWG only had one full-on privacy advocate: Stephanie Perrin, who’s a bit of a big deal when it comes to data privacy in Canada, having held senior privacy roles in public and private sectors there.
Perrin isn’t happy. Perrin thinks the RDS proposal as it stands won’t protect regular registrants’ privacy.
She wrote a Dissenting Report that seems to have been intended as an addendum to the EWG’s official report, but it was not published by the EWG or ICANN. The EWG report makes only a vague, fleeting reference, in a footnote, to the fact that the was any dissent at all.
Milton Mueller at the Internet Governance Project got his hands on it regardless and put it out there earlier this week.
Perrin disagrees with the recommendation (outlined above) that each domain name must have a Legal Contact (or Legal PBC) who is not permitted to hide their name and mailing address from public view.
She argues, quite reasonably I think, that regular registrants don’t have lawyers they can outsource this function to, which means their own name and mailing address will comprise their publicly visible Legal PBC.
This basically voids any privacy protection they’d get from having these details “gated” in the “registrant” record of the RDS. Perrin wrote:

the purpose of the gate is to screen out bad actors from harassing innocent registrants, deter identity theft, and ensure that only legitimate complaints arrive directly at the door of the registrants. It is also to protect the ability of registrants to express themselves anonymously. Placing all contact data outside the gate defeats certain aspects of having a gate in the first place.

The EWG report envisages the use of privacy/proxy services for people who don’t want their sensitive data published publicly.
But we already have privacy/proxy services today, so I’m unclear what benefit RDS brings to the table in terms of privacy protection.
It’s also worth noting that there are no circumstances under which a registrant’s email address is protected, not even from anonymous RDS queries. So there’s no question of RDS stopping Whois-based spam.
Are the trademark dudes going to be happy?
I don’t know. They do seem to be getting a better deal out of the recommendations than the other side (there were at least three intellectual property advocates on the EWG) but if you’re in the IP community the report still leaves much to be desired.
The RDS proposal would create a great big centralized repository of domain registrant information, which would probably be located in a friendly jurisdiction such as the US.
That would make tracking down miscreants a bit easier than in today’s distributed Whois environment.
RDS would also include a WhoWas service, so users can see who has historically owned domain names, and a Reverse Query service, so that users can pull up a list of all the other domains that share the same contact field(s).
Both services (commercially available via the likes of DomainTools already) would prove valuable when collating data for a UDRP complaint or cybersquatting lawsuit.
But it’s important to note that while the EWG report says all contact information should be validated, it stops short of saying that it should be authenticated.
That’s a big difference. Validation would reveal whether a mailing address actually exists, but not whether the registrant actually lives there.
You’d need authentication — something law enforcement and IP interests have been pushing for but do not seem to have received with the EWG proposal — for that.
The EWG suggests that giving registrants more control over which bits of their data are public will discourage them from providing phony contact information for Whois/RDS.
The RDS proposes a lot more carrot than stick on this count.
But if Perrin is correct that it’s a false comfort (given that your name and address will be published as Legal PBC anyway) then wouldn’t a registrant be just as motivated to call themselves Daffy Duck, or use a proxy/privacy service, as they are today?
Are the registrar dudes going to be happy?
If the EWG’s recommendations become a reality registrars could get increased friction in their sales path, depending on how disruptive it is to create a “Contact ID” and populate all the different PBCs.
I think it’s certainly going to increase demand on support channels, as customers try to figure out the new regime.
Remember, the simple requirement to click on a link in an email is causing registrants and registrars all kinds of bother, including suspended domains, under recently introduced rules.
And there’s obviously going to be a bunch of (potentially costly) up-front implementation work registrars will need to do to hook themselves into RDS and the other new entities the system relies on.
I doubt the registrars are going to wholeheartedly embrace the proposal en masse, in other words.
Is Kevin Murphy happy?
No, I’m not happy.
It bugs me, personally, that the EWG completely ignored the needs of the media in its report. It strikes me as a bit of a slap in the face.
The “media” and “bloggers” (I’m definitely in one of those categories) would be given the same rights to gated RDS data as the “general public”, under the EWG proposal.
In other words, no special privileges and no ability to access the registrant name and address fields of an RDS record.
RDS may well give somebody who owns a trademark (such as a reverse domain name hijacker or a sunrise gamer) more rights to Whois records than the New York Times or The Guardian.
That can’t be cool, can it?
Murphy, brah, why you gotta cuss in your headline?
Good question. I do use swearwords on DI occasionally, but only to annoy people who don’t like them, and usually only in posts dated April 1 or in stories that seem to deserve it.
This post is dated June 13.
I think I’ve established that the EWG’s proposal as it stands today is a pretty big overhaul of the current system and that it’s not immediately obvious how the benefits to all sides warrant the massive effort that will have to be undertaken to get RDS to replace Whois.
But the clusterfuckery is going to begin not with the implementation of the proposal, but with the attempt to pass it through the ICANN process.
The proposal has to pass through the ICANN community before becoming a reality.
The Expert Working Group has no power under the ICANN bylaws.
It was created by Chehade while he was still relatively new to the CEO’s job and did not yet appreciate how seriously community members take their established procedures for creating policy.
I think it was a pretty decent idea — getting a bunch of people in a room and persuading them to think outside the box, in an effort to find radical solutions to a a long-stagnant debate.
But that doesn’t change the fact that the EWG’s proposals don’t become law until they’ve been subject to the Generic Names Supporting Organization’s lengthy Policy Development Process.
Some GNSO members were not happy when the EWG was first announced — they thought their sovereignty was being usurped by the uppity new CEO — and they’re probably not going to be happy about some of the language the EWG has chosen to use in its final report.
The EWG said:

The proposed RDS, while not perfect, reflects carefully crafted and balanced compromises with interdependent elements that should not be separated.
…
The RDS should be adopted as a whole. Adopting some but not all of the design principles recommended herein undermines benefits for the entire ecosystem.

It’s actually quite an audacious turn of phrase for a working group with no actual authority under ICANN bylaws.
It sounds a bit like “take it or leave it”.
But there’s no chance whatsoever of the report being adopted wholesale.
It’s going into the GNSO process, where the same vested interests (IP, LEA, registry, registrar, civil society) that have kept the debate stagnant for the duration of ICANN’s existence will continue to try (and probably fail) to come to an agreement about how Whois should evolve.

Amazon snubs ICANN auction to win .coupon privately

Amazon has won the new gTLD .coupon, after Minds + Machines withdrew its application this week.
I understand that the two-way contention set was settled privately via a third party intermediary, possibly via some kind of auction, with M+M ultimately being paid off to withdraw its bid.
.coupon was the only ICANN-managed “auction of last resort” scheduled for July, following the $600,000 sale of .信息 last week.
The next batch of ICANN auctions is now not due to happen until August, unless of course ICANN rejigs its schedule in light of the .coupon settlement.
It’s not clear why Amazon has suddenly decided it prefers the idea of a private commercial settlement after all, but it appears to be good news for M+M, which will see the majority of the cash.
However, it could be related to the fact that .coupon, and dozens of other Amazon new gTLD applications, recently made the switch from being “closed generics” to more inclusive proposals.
Amazon had originally intended that itself and its subsidiaries would be the “only eligible registrants” for .coupon, but in March it changed the application, among many others.
Now, Amazon talks in vague terms about .coupon names being available to “eligible trusted third parties”, a term that doesn’t seem ready to define before the TLDs are actually delegated.
It seems to me, from Amazon’s revised applications, that .coupon and its other gTLDs will be locked down tight enough that they could wind up being effectively closed generics after all.
When Amazon publishes its first eligibility requirements document with ICANN, I expect members of the Governmental Advisory Committee will be watching closely.

.hotel avoids auction with CPE win

A new gTLD applicant backed by the hotel industry has won a Community Priority Evaluation, meaning it gets to automatically win the .hotel contention set without going to auction.
If the decision stands, no fewer than six rival applicants for the string — including the likes of Donuts, Radix, Famous Four and Minds + Machines — are going to have to withdraw their applications.
It’s a bit of a shocker.
The CPE winner is HOTEL Top-Level-Domain, which scored 15 out of 16 available points in the CPE. The minimum required to vanquish all foes is 14 points.
The company will have spent a fair bit of cash fighting the CPE, but nothing compared to the millions of dollars an auction for .hotel would be likely to fetch.
Crucially, where HOTEL prevailed was on the “Nexus” criterion — demonstrating a link between the string and the community supporting the application — where four points are available.
In the first four CPE results to come through, back in March, each applicant scored a 0 on Nexus and none scored more than 11 points overall.
Dot Registry, which failed four CPEs (.inc, .llc, .corp and .llp) this week, also repeatedly flunked on this count.
HOTEL, however, scored a 3.
Rival applicants such as Donuts and M+M had argued that HOTEL’s stated community failed to take into account smaller hoteliers, such as bed and breakfast owners.
But the CPE panelist decided that the application did not “substantially overreach”:

The string nexus closely describes the community, without overreaching substantially beyond the community. The string identifies the name of the core community members (i.e. hotels and associations representing hotels). However, the community also includes some entities that are related to hotels, such as hotel marketing associations that represent hotels and hotel chains and which may not be automatically associated with the gTLD. However, these entities are considered to comprise only a small part of the community. Therefore, the string identifies the community, but does not over-reach substantially beyond the community, as the general public will generally associate the string with the community as defined by the applicant.

There’s no formal appeals mechanism for CPE, but rival applicants could try their luck with more general ICANN procedures such as Requests for Reconsideration.
HOTEL Top-Level-Domain is a Luxembourg-based entity, founded in 2008 to apply for the gTLD, backed by about a dozen international hotelier associations, including the International Hotel and Restaurant Association.
The IHRA counts 50 major hotel chain brands among its members and claims to be officially recognized by the UN for its lobbying work on behalf of the hospitality industry.
HOTEL intends to keep the .hotel gTLD restricted “initially” to only hotels as defined in the international standard ISO 18513.
Registrants will be verified against hotel industry databases. This will happen post-registration, but before the domain name can be activated in the DNS.
In other words, unless you’re a member of the hotel industry, you won’t be getting to use a .hotel domain name. Domainers are apparently not wanted.
All .hotel names will also be checked a year from registration to ensure that they have a web site displaying relevant content. Redirection to other TLDs may be allowed.
I was so convinced that the CPE was designed in such a way that it would be failed by all the applicants which had applied for it, I bet $50 (to go to an applicant-nominated charity) that none would.
If HOTEL wants to let me know which charity they want the $50 to go to, I’ll get it donated forthwith. I’m just glad I didn’t offer to eat my underwear.

Three more dot-brands dumped

Two companies have yanked three bids for dot-brand new gTLDs this week.
The German financial advisor Allfinanz Deutsche Vermögensberatung withdrew its applications for .allfinanzberatung and .allfinanzberater, which mean Allfinanz “advice” and “advisers”.
As well as being a bit of a mouthful, they both appear to be unnecessary given that the company also applied for .allfinanz by itself. That application has passed evaluation and is still active.
Meanwhile, in Finland, one of the world’s biggest elevator/escalator manufacturers, KONE, has withdrawn its equally unfathomable application for .kone.
Roughly 55 dot-brand applications have been withdrawn to date. Hundreds remain.

M+M profits by losing new gTLD auctions

Minds + Machines managed to make a profit in 2013, after years of losses, due to its participation in private new gTLD auctions, some of which it “lost”.
The company today reported operating profit of £776,000 for the year to December 31, compared to a £3.07 million loss in 2012, on revenue of £4.12 million. Profit after tax was £729,000.
“Profit was primarily a result from participating three private auctions,” CEO Antony Van Couvering said in a statement.
Chairman Fred Krueger added:

As we expected, private auctions have become the key method of settling contention between applications and we have benefited from this development, as it has enabled our cash to work on a leveraged basis: the domains we have lost in private auction (for example .property and .website) have helped finance new TLDs we have acquired such as .wedding and .garden.

Minds + Machines (then Top Level Domain Holdings) said last October that it had raised £2.97 million by losing the auctions for .lawyer and .website.
Excluding the auctions, it looks like the company made just £36,000 in revenue, all of which came from its registry back-end business.

How NetSol opts you in to cybersquatted .xyz names

Clear-cut cases of cybersquatting seem to be among those .xyz domain names that Network Solutions has registered to its customers without their explicit request.
Some of the domains I’ve found registered in .xyz, via NetSol to the registrants of the matching .com or .net names, include my-twitter.xyz, facebook-liker.xyz and googledia.xyz.
Domains including other brands, such as Rolex, Disney, iPhone, Amazon and Pepsi can also be found registered to third parties, via NetSol, in .xyz’s zone today.
They’re all registered via NetSol’s Whois privacy service, which lists the registrant’s “real” name in the Whois record, but substitutes mailing address, email and phone number with NetSol-operated proxies.
I think the chance of these names being paid for by the registrant is slim. It seems probable that many (if not all) of the squatty-looking names were registered via NetSol’s promotional program for .xyz.
As previously reported, NetSol has been giving away domain names in .xyz to owners of the matching .com names. Tens of thousands of .xyz names seem to have been registered this way in the last week.
The “registrants” did not have to explicitly accept the offer. Instead, NetSol gave them the option to “opt-out” of having the name registered on their behalf and placed into their accounts.
The effect of this has been to propel .xyz into the leading spot in the new gTLD league table. It had 82,236 names in today’s zone file. a clear 15,000 names ahead of second-place .club.
But it’s not clear how much, if any, support NetSol has received from the registry, XYZ.com. CEO Daniel Negari told Rick Schwartz, in a coy interview last week:

The Registry Operator is unable to “give away” free domain names. I never even saw the email that the registrar sent to its customers until I discovered it on the blogs.

The opt-out giveaway has also prompted speculation about NetSol’s right to register domains without the explicit consent of the registrant, both under the law and under ICANN contract.
Under the Registrar Accreditation Agreement, in order to register a domain name, registrars “shall require” the registrant “to enter into an electronic or paper registration agreement”.
That agreement requires the registrant to agree to, among many other things, the transfer or suspension of their domains if (for example) they lose a UDRP or URS case.
But that doesn’t seem to be happening with the opt-out names,
Barry Shein, president of The World, had shein.xyz registered on his behalf by NetSol on Saturday. He already owns shein.com, also registered with NetSol.
NetSol’s email informing him of the registration, which Shein forwarded to DI, reads as follows:

Dear Valued Network Solutions Customer,
Congratulations, your complimentary SHEIN.XYZ domain has arrived!
Your new .XYZ domain is now available in your Network Solutions account and ready to use. To go along with your new .XYZ domain, you have also received complimentary access to Professional Email and Private Registration for your .XYZ domain.
If you choose not to use this domain no action is needed and you will not be charged any fees in the future. Should you decide to keep the domain after your complementary first year, simply renew it like any other domain in your account.
We appreciate your business and look forward to serving you again.
Sincerely,
Network Solutions Customer Support
www.networksolutions.com
http://www.networksolutions.com/help/index.jsp

Importantly, a footnote goes on to describe how NetSol will take a refusal to opt out as “continued acceptance” of its registration agreement:

Please note that your use of this .XYZ domain name and/or your refusal to decline the domain shall indicate acceptance of the domain into your account, your continued acceptance of our Service Agreement located online at http://www.networksolutions.com/legal/static-service-agreement.jsp, and its application to the domain.

So, if you’re a NetSol customer who was picked to receive a free .xyz name but for whatever reason you don’t read every marketing email your registrar sends you (who does?) you’ve agreed to the registration agreement without your knowledge or explicit consent, at least according to NetSol.
I am not a lawyer, but I’ve studied enough law to know that this is a dubious way to make a contract. Lawyers I’ve shown this disclaimer to have laughed out loud.
Of course, because each registrant already owns a matching .com, they’ve already accepted NetSol’s registration agreement and terms of service at least once before.
This may allow NetSol to argue that the initial acceptance of the contract also applies to the new .xyz domains.
But there are differences between .com and .xyz.
Chiefly, as a new gTLD, .xyz registrants are subject to policies that do not apply to .com, such as the Uniform Rapid Suspension policy.
URS differs from UDRP in that there’s a “loser pays” model that applies to complaints involving over 15 domains.
So these .xyz registrants have been opted into a policy that could leave them out of pocket, without their explicit consent.
Of course, we’re talking about people who seem to be infringing famous trademarks in their existing .com names, so who gives a damn, right?
But it does raise some interesting questions.
Who’s the registrant here? Is it the person who owns the .com, or is it NetSol? NetSol is the proxy service, but the .com registrant’s name is listed in the Whois.
Who’s liable for cybersquatting here? Who would Twitter file a UDRP or URS against over my-twitter.xyz? Who would it sue, if it decided to opt for the courts instead?

.xyz is now the biggest new gTLD (kinda)

The controversial new gTLD .xyz is now officially the biggest, with 67,504 domains under management.
That’s according to today’s zone files, which see former number ones .club at 65,630 and .guru at 60,480.
Due to what appears to be an ICANN screw-up, there were no zone files available for any new gTLDs via the Centralized Zone Data Service yesterday, so I can’t tell you what the daily growth numbers are.
But .xyz had 36,335 names in its zone on Wednesday. It’s grown by 85% in two days.
That’s a shocking, unprecedented growth spurt.
The question is, of course, how many of these registrations are legit?
.xyz has come under a great deal of fire from domainers the last few days, after it emerged that the majority of its growth in the first days of general availability was questionable.
Network Solutions, it transpired, had seriously inflated .xyz’s numbers by registering .xyz names matching existing .coms on behalf of its customers without their permission and for no charge.
NetSol seems to have paid .xyz a few hundred thousand dollars for domain names its customers have not requested.
Data from today’s .xyz zone file is likely to reinforce the perception that most of .xyz’s apparent popularity is bogus.
I see that 56,019 domain names in .xyz today — 82% of the gTLD’s total — are using register.com name servers.
Those name servers belong to Web.com, NetSol’s parent company.
There were 27,000 such names on Wednesday. While .xyz as a whole has grown by about 31,000 names in two days, NetSol’s .xyz share has grown by about 29,000 names.
Nobody believes that NetSol, with its $40 retail price for .xyz (with a wholesale price I peg at around $6 to $7), could have obtained this market share with actual, paid-for sales.
I believe that the large majority of NetSol’s roughly 56,000 .xyz names are freebies, not reflective of buyer demand.
Many domainers are incandescent about this.
They look to registration numbers as a measurement of demand, which could be a predictor of the resale market for a TLD, so they’re upset at anything that looks like a manipulation of that number.
Daniel Negari, the charismatic CEO of .xyz, has borne the brunt of this criticism, despite the fact that there’s no evidence out there yet that .xyz supported or had prior knowledge NetSol’s mass giveaway.
Negari has so far refused to comment on the situation (he hasn’t responded to several inquiries from yours truly), which has only served to reinforce the suspicion that the registry was somehow complicit in NetSol’s promotion and used the registrar to artificially inflate its numbers.
I have no evidence one way or the other.
NetSol refused to even confirm the existence of the promotion when DI inquired earlier this week.

.xyz launch inflated by massive NetSol giveaway

Network Solutions gave away thousands of .xyz domain names for free to people who hadn’t requested them, artificially inflating the new gTLD’s launch day numbers.
As of last night, there were 36,335 domains in the .xyz zone, with something like 27,000 listed as having name servers belonging to NetSol and its parent, Web.com.
Before .xyz launched, only 1,287 new gTLD domains used NetSol name servers.
What this means is that for some reason thousands upon thousands of .xyz domain names were registered via one of the industry’s more expensive registrars.
That reason, as Mike Berkens at The Domains scooped, is that many names were given away for free to existing NetSol customers.
Not only that, but the giveaway was opt-out — if you were selected for the promotion you had to click a link in an email in order to prevent NetSol registering the .xyz that matches your .com.
So not only did the registrants of a significant portion of .xyz’s new registrations not pay for their names, they didn’t even request them.
A lot of garbage strings — some of which have matching .coms I suspect are being used for nefarious purposes — have therefore made it into .xyz’s zone alongside many decent-enough names.
When I asked NetSol, a spokesperson refused to confirm the giveaway, calling it a “market rumor”. This is apparently the kind of promotion you don’t want anyone hearing about.
It’s not clear how many of these 27,000 names were genuine registrations and which were part of the promotion, but I suspect, given NetSol’s prior performance in new gTLDs, that the vast majority were freebies.
This has happened before.
About 10 years ago, Afilias temporarily dropped its first-year price for .info to zero dollars, hoping to attract more registrations and paying renewals.
Instead, eNom decided to register a million .info names matching its customers’ .com names, put them in its customers’ accounts, and park the lot.
A year later, over 99% of those names were allowed to expire by registrants who hadn’t requested them in the first place.
The difference in this case seems to be that .xyz itself is still getting paid its registry fee for each of the names NetSol gave away.
But if history is any guide, .xyz’s numbers could be in for a big drop 15 months from now.

Ten more new gTLD contests settled in auction

Applicant Auction helped resolved 10 new gTLD contention sets last week, and the first results started trickling through today.
Of the six results we have so far, Uniregistry and Famous Four Media won two auctions, while Minds + Machines and Donuts both won one each.
According to our database, the following five contention sets have been closed:

• .pizza — Donuts won after withdrawals from Asiamix Digital, Uniregistry and Minds + Machines.
• .fashion — M+M won after withdrawals from Donuts, Uniregistry and Famous Four Media.
• .diet — Uniregistry won after withdrawls from Donuts and Famous Four.
• .cricket — Famous Four won after withdrawals from M+M and Donuts.
• .help — Uniregistry won after withdrawals from Donuts and Dot Tech.
• .racing — Famous Four won after withdrawals from Donuts and Uniregistry.

We’ve also seen a withdrawal from Momentous in the .rip competition, suggesting that that gTLD was also settled at auction last week. It’s not yet clear from the database who won.

Was I wrong? .xyz claims 31,000 regs on day one

.xyz’s first full day of general availability saw it total 31,119 registrations, suggesting that it’s not doing as badly as I suggested in a post earlier today.
Today’s .xyz zone file shows 14,924 names, up 14,829 on the day, but Gavin Brown, CTO of .xyz back-end CentralNic, just commented that the 24-hour number is actually 31,119.
The zone files for each new gTLD are made available by ICANN — assuming the Centralized Zone Data Service is working — at 0100 UTC every day. Brown said that .xyz’s file today was generated an hour later.
That means the 14,924 total represented the first 10 hours of GA, as indicated in my original piece today.
For a new gTLD to sell more domains in the second half of its first GA day than during the first is unusual, because gTLD launches to date have tended to rely quite heavily on pre-orders.
Pre-orders, a decent measure of demand, generally hit the registry within the first few minutes of general availability, as registrars try to secure the names their customers want.
That has the effect of stacking first-day registrations heavily towards the first few hours of GA.
Take .club, for example. It sold 25,776 names in its first 10 hours. But 24 hours later that number had crept up to just 30,680, an increase of just 4,904.
Similarly, TLD Registry’s .在线 moved just shy of 20,000 names in its first 12 hours of general availability, but had sold only 1,000 more names a full 24 hours later.
I didn’t think it unreasonable to assume that .xyz would follow the same pattern, but this front-loading doesn’t seem to have happened in .xyz’s case.
Did I make a faulty assumption?
If registrations are indeed coming in at a more measured pace than preceding launches, then .xyz may not be falling behind CEO Daniel Negari’s aggressive growth targets at all.
Was I wrong to say that .xyz hasn’t lived up to the hype? Maybe. We’ll need some more days of data to be sure.