Latest news of the domain name industry

Recent Posts

IRP panel tells ICANN to stop being so secretive, again

Kevin Murphy, January 9, 2023, Domain Policy

ICANN’s dismal record of adverse Independent Review Process decisions continued last week, with a panel of arbitrators telling the Org to shape up its transparency and decision-making processes.

The panel has essentially ruled that ICANN did everything it could to be a secretive as possible when it decided to remove price controls from its .org and .info registry contracts in 2019.

This violated its bylaws commitments to transparency, the IRP panel found, at the end of a legal campaign by Namecheap commenced over three years ago.

Namecheap wanted the agreements with the two registries “annulled”, but the panel did not go that far, instead merely recommending that ICANN review its decision and possibly enter talks to put the price caps back.

But the decision contains some scathing criticisms of ICANN’s practice of operating without sufficient public scrutiny.

Namecheap had argued that ICANN broke its bylaws by not only not applying its policies in a non-discriminatory manner, but also by failing to adequately consult with the community and explain its decision-making.

The registrar failed on the first count, with the IRP panel ruling that ICANN had treated registry contract renegotiations consistently over the last 10 years — basically trying to push legacy gTLDs onto the 2012-round base Registry Agreement.

But Namecheap succeeded on the second count.

The panel ruled that ICANN overused attorney-client privilege to avoid scrutiny, failed to explain why it ignored thousands of negative public comments, and let the Org make the price cap decision to avoid the transparency obligations of a board vote.

Notably, the panel unanimously found that: “ICANN appears to be overusing the attorney-client privilege to shield its internal communications and deliberations.”

As one example, senior staffers would copy in the legal team on internal communications about the price cap decision in order to trigger privilege, meaning the messages could not be disclosed in future, the decision says.

ICANN created “numerous documents” about the thinking that went in to the price cap decision, but disclosed “almost none” of them to the IRP due to its “overly aggressive” assertion of privilege, the panel says.

As another example, staffers discussed cutting back ICANN’s explanation of price caps when it opened the subject to public comment, in order to not give too much attention to what they feared was a “hot” and “sensitive” topic.

ICANN’s failure to provide an open and transparent explanation of its reasons for rejecting public comments opposing the removal of price controls was exacerbated by ICANN’s assertion of attorney-client privilege with respect to most of the documents evidencing ICANN’s deliberations…

ICANN provided a fairly detailed summary of the key concerns about removing price caps, but then failed to explain why ICANN decided to remove price caps despite those concerns. Instead, ICANN essentially repeated the explanation it gave before receiving the public comments.

The panel, which found similar criticisms in the earlier IRP of Dot Registry v ICANN, nevertheless decided against instructing ICANN to check its privilege (to coin a phrase) in future, so the Org will presumably be free to carry on being as secretive as normal in future.

Namecheap also claimed that ICANN deliberately avoided scrutiny by allowing Org to remove the price caps without a formal board of directors resolution, and the panel agreed.

The Panel finds that of the removal of price controls for .ORG, .INFO, and .BIZ was not a routine matter of “day-to-day operations,” as ICANN has asserted. The Price Cap Decision was a policy matter that required Board action.

The panel notes that prior to the renewal of .org, .info and .biz in 2019, all other legacy gTLD contracts that had been renewed — including .pro, which also removed price caps — had been subject to a board vote.

“ICANN’s action transitioning a legacy gTLD, especially one of the three original gTLDs (.ORG), pursuant to staff action without a Board resolution was unprecedented,” the panel writes.

Quite why the board never made a formal resolution on the .org contract is a bit of a mystery, even to the IRP panel, which cites lots of evidence that ICANN Org was expecting the deal to go before the board as late as May 13, 2019, a month before the anticipated board vote.

The .org contract was ultimately signed June 30, without a formal board resolution.

(Probably just a coincidence, but Ethos Capital — which went on unsuccessfully to try to acquire .org registry Public Interest Registry from ISOC later that year — was formed May 14, 2019.)

The IRP panel notes that by avoiding a formal board vote, ICANN avoided the associated transparency requirements such as a published rationale and meeting minutes.

The panel in conclusion issued a series of “recommendations” to ICANN.

It says the ICANN board should “analyze and discuss what steps to take to remedy both the specific violations found by the Panel, and to improve its overall decisionmaking process to ensure that similar violations do not occur in the future”.

The board “should consider creating and implementing a process to conduct further analysis of whether including price caps in the Registry Agreements for .ORG and .INFO is in the global public interest”

Part of that process should involve an independent expert report into whether price caps are appropriate in .info and especially .org.

If it concludes that price controls are good, ICANN should try to amend the two registry agreements to restore the caps. If it does not conduct the study, it should ask the two registries if they want to voluntarily restore them.

Finally, the panel wrote:

the Panel recommends that the Board consider revisions to ICANN’s decision-making process to reduce the risk of similar procedural violations in the future. For example, the Board could adopt guidelines for determining what decisions involve policy matters for the Board to decide, or what are the issues on which public comments should be obtained.

ICANN is on the hook to pay the panel’s fees of $841,894.76.

ICANN said in a statement that it is “is in the process of reviewing and evaluating” the decision and that the board “will consider the final declaration as soon as feasible”.

Namecheap says it won legal fight over .org price caps

Kevin Murphy, January 5, 2023, Domain Registries

Namecheap claims to have won a fight against ICANN over the lifting of contractual price caps in .org and .info back in 2019.

The two parties have been battling it out for almost three years in an Independent Review Process case over ICANN’s decision to allow the .info and .org registries to increase their prices by as much as they want.

Namecheap now claims the decision has been delivered and “the IRP panel decided that ICANN had, indeed, violated its Bylaws and Articles of Incorporation and that ICANN’s decision to remove the price caps was invalid.”

The registrar also says it failed in its attempt to have a similar ruling with regrds the .biz TLD, but it’s not clear why.

Neither party has yet published the decision in full (ICANN is likely redacting it for publication as I type), and ICANN has yet to make a statement, so we only have Namecheap’s interpretation to go on.

It seems the IRP panel disagreed with ICANN that it was within its staff’s delegated powers to renegotiate the price provisions of the contracts without input from the board of directors.

Rather, there should be a open and transparent process, involving other stakeholders, for making such changes, the panel said according to Namecheap.

What the panel does not appear to have said is that the price caps can be unilaterally restored to the contracts. Rather, it seems to suggest a combination of voluntary reinstatements, expert competition reviews, and bilateral renegotiations.

The decision also seems to say that price controls are more important in .org than .info, due to its not-for-profit nature, which flies in the face of ICANN’s long-term push to standardize its contracts to the greatest extent possible.

The row over .org pricing emerged shortly before the ultimately unsuccessful takeover attempt of Public Interest Registry by for-profit private equity firm Ethos Capital was announced. Ethos had planned to raise prices, but PIR, still a non-profit owned by the Internet Society, to date has not.

Namecheap’s IRP claims related to ICANN’s handling of that acquisition attempt were thrown out in 2021.

.info was an Afilias TLD when the IRP was filed but is now Ethos-owned Identity Digital’s biggest gTLD following consolidation.

I’ll have more on this story after the full decision is made public.

PIR will launch .giving next month with unusual landrush rules

Kevin Murphy, September 16, 2022, Domain Registries

Public Interest Registry has revealed the launch dates for its recently acquired gTLD .giving, and it seems the former registry will also play a prominent role.

PIR has told ICANN it will run .giving’s sunrise period from October 13 to December 13. It’s an “end date” sunrise, where domains are only allocated at the end of the period, but the criteria for resolving competing claims is first-come-first-served.

The landrush period will run from December 20 to January 20, but there’s an unusual twist requiring registrants to buy, or at least “evaluate”, an e-commerce service:

As a condition to registering a domain name in the .GIVING during Landrush (December 20, 2022 through January 20, 2023), you agree that by registering your domain name, you represent and warrant that: (a) you currently use one of Blackbaud’s digital giving solutions or will evaluate the free Giving Checkout solution offered by JustGiving from Blackbaud available at this link and (b) you acknowledge and agree that the Registry or the registrar can cancel the registration of the domain name if your warranty is found to be untrue, incomplete, incorrect, or misleading.

Blackbaud is the company that operates JustGiving, a fund-raising web site chiefly popular in the UK. It was also the original registry for .giving, although of course it never actually launched the TLD.

PIR says general availability will begin January 20. It appears there will be six premium-price tiers, but renewals will be at the regular fee.

DNSAI to name most-abused registries, registrars

Kevin Murphy, May 31, 2022, Domain Services

The DNS Abuse Institute is to start publishing monthly reports that name the registries and TLDs with the highest level of abuse.

The organization’s Intelligence service is expected to land in September, a little later than was previously expected, according to a blog post from director of policy and programs Rowena Schoo.

DNSAI has partnered with Kor Labs, a project out of the Grenoble Institute of Technology, to supply the data, which will cover phishing and malware domains and differentiate between malicious registrations and compromised sites.

The Institute doesn’t consider spam DNS abuse unless it is used as a delivery mechanism for other types of abuse, in line with ICANN’s definition.

The decision to actually name (and in some cases, we should assume, shame) registries and registrars is an unusual one. Other, similar efforts tend to keep the data anonymous.

“We want to understand abuse persistence and whether it has been appropriately mitigated by registrars,” Schoo wrote.

DNSAI is a project primarily backed by .org manager Public Interest Registry.

Three gTLDs to lose Donuts trademark protection

Three gTLDs are set to lose the trademark protection coverage at the end of the month, following their sale from Donuts to Public Interest Registry.

As noted by corporate registrar Com Laude recently, .charity, .gives and .foundation will no longer fall under Donuts’ Domain Protected Marks List service as of June 1.

DPML is a blocking services whereby the registry reserves trademarked strings across its whole portfolio of almost 300 gTLDs in exchange for a fee that is a big discount on defensive registrations.

gTLDs not in the portfolio will naturally enough no longer qualify, but Com Laude reported that existing subscriptions will be honored and PIR will offer DPML users the chance to change to a full registration.

Donuts announced the sale of the three TLDs to PIR last December.

PIR doesn’t have its own DPML equivalent. Its portfolio is small and its biggest deal is .org, where the defensive blocking horse bolted decades ago.

DNS Abuse Institute names free tool NetBeacon, promises launch soon

Kevin Murphy, April 5, 2022, Domain Services

NetBeacon has been picked as the name for the DNS Abuse Institute’s forthcoming free abuse-reporting tool.

The tool is expected to launch in early June, after software was donated by CleanDNS accelerated the development cycle, according to Institute director Graeme Bunton.

The system was previously using the working title CART, for Centralized Abuse Reporting Tool, as I blogged in February.

CleanDNS CEO Jeff Bedser is also on the board of Public Interest Registry, which funds DNSAI. Bunton wrote that PIR approved the use of the CleanDNS software under its conflict of interest policy, with Bedser recusing himself.

NetBeacon is expected to provide a way for authenticated abuse reporters to file complaints in a normalized fashion, potentially streamlining the workflow of registrars that subsequently have to deal with them.

Bunton has said that the service will be free at both ends, funded by non-for-profit PIR.

.org price caps: ICANN chair denies “secret” meetings

Kevin Murphy, March 24, 2022, Domain Policy

ICANN chair Maarten Botterman has denied that the board of directors approved the removal of price caps in .org, .biz and .info in “secret” meetings in 2019.

In written testimony (pdf) recently filed as part of Namecheap’s two-year-old Independent Review Process proceeding, Botterman scoffed at the idea that ICANN secretly gave the nod to the removal of price caps in 2019:

I understand that Namecheap is claiming that the Board acted in secret when deciding to go forward with the 2019 Registry Agreements. Nothing about the Board’s conduct occurred in secret. The Board did not convene a “secret” annual, regular, or special Board meeting and did not make any “secret” formal decisions or “secret” resolutions. Instead, the Board was briefed by ICANN staff regarding contract renewals that were well within their delegated authority to negotiate and execute.

Namecheap is claiming in its IRP that ICANN broke its bylaws when it renewed the .org, .info and .biz contracts without the historical price caps that all three had in place for the better part of 20 years.

It wants those decisions annulled, potentially enabling the reinstatement of the caps.

Part of its case is that ICANN failed in its transparency obligations, with Namecheap saying that the decision to remove caps was “entirely opaque” and made with “no analysis whatsoever”.

The .info, .org and .biz contracts were renewed without the ICANN board making a formal resolution or discussing them during a session that was being recorded and minuted.

Botterman, along with declarations from with fellow director Becky Burr and VP Russ Weinstein and outside lawyers’ filings, says that the extent of the board’s involvement was two briefings that occurred at workshops in January and June 2019.

ICANN staff explained to the board why it intended to go ahead with signing the cap-free contracts, and the board “saw no reason to intervene”, Botterman wrote. Staff have delegated authority to deal with contract stuff, he said.

Now, it could be argued that these meetings were not “secret” as such — ICANN board workshops are a standard event, happening in the few days leading up to each of ICANN’s thrice-yearly public meetings.

ICANN’s chair (then Cherine Chalaby) even blogs about them, posting a rough agenda beforehand and a summary of discussions a few weeks later.

In the case of the January 2019 pre-workshop post, there’s no mention whatsoever of any contract renewals. Nor is there in the post-workshop summary.

The June 2019 post-workshop post fails to mention the fact that the board had essentially given the nod to the lifting of caps at that meeting.

The pre-workshop post makes a passing, blink-and-you’ll-miss-it reference to “Göran will update the Board on the renewal of some registry agreements”, which substantially played down what was actually going on.

At that time, ICANN was well-aware that there was huge public interest in at least the .org renewal, where over 3,300 comments had been submitted, mostly objecting to the removal of price caps.

It’s possible that the first time ICANN disclosed that the discussions had even taken place was when a spokesperson told me how the .org decision was made, in July that year.

You don’t have to be a conspiracy theorist to wonder why ICANN pretty much skimmed over the whole issue in its public disclosures, even though it was the hottest topic in town at the time.

Even now, Botterman and Burr are both invoking attorney-client privilege to limit their testimony about what happened at these two workshops.

You don’t have to think anything untoward was going on to ask whether this is all paints a picture of ICANN acting “to the maximum extent feasible in an open and transparent manner”, as its bylaws requires.

Botterman says in his declaration:

The Bylaws are clear that ICANN must “operate to the maximum extent feasible in an open and transparent manner.” But I have never understood this Bylaws provision to require that every time the Board needs to get work done, or every time the Board receives a briefing from ICANN staff on a specific topic, it must do so in public or at a annual, regular or special Board meeting. Nor would such a requirement be feasible.

PIR to offer industry FREE domain abuse clearinghouse

Kevin Murphy, February 11, 2022, Domain Registries

The DNS Abuse Institute will soon launch a free service designed to make it easier to report abuse and for registries and registrars to act upon it.

The Institute, which is funded by .org manager Public Interest Registry, is working on a system provisionally called CART, for Centralized Abuse Reporting Tool, an ambitious project that would act as a clearinghouse for abuse reports across the industry.

The plan is to offer the service for free to reporters and registrars alike, with a beta being offered to registrars late next month and a public launch hopefully before ICANN 74 in June.

DNSAI director Graeme Bunton said that CART is meant to solve the “mess” of current abuse reporting systems.

For abuse reporters, the idea is to give them a one-stop shop for their reports, across all gTLDs and registrars. CART would take their complaints, normalize them, furnish them with additional information from sources such as Whois records and domain block-lists, and shunt them off to the registrar of record.

“Registrars get boatloads of abuse reports every day,” Bunton said. “Hundreds to thousands. They’re often duplicative, often unevidenced — almost always. There’s no standardization. So they’re having to spend a lot of time reading and parsing these abuse reports.”

“They’re spending a huge amount of time triaging tickets that don’t make the internet any better,” he said. “It felt like trying to solve this problem across every individual registry and registrar was not going to work, and that a centralizing function that sits in the middle and absorbs a lot of the complexity would make a real difference, and we’ve been working towards that.”

CART reporters would be authenticated, and their reports would be filed through forms that normalized the data to make them easier for registrars to understand. There will be “evidence requirements” to submit a report.

“It’s a common lament that the abuse@ email that registrars have to publish are filled with garbage,” Bunton said. “This is intended to clean that up, as well as make it easier for reporters.”

Registrars will be able to white-label these forms on their own sites, replacing or adding to existing reporting mechanisms, which will hopefully drive adoption of the tool, Bunton said.

Registrars will be able to use an API to pull the abuse feed into their existing ticketing workflows, or simply receive the reports via email.

The plan is to send these enhanced reports to registrars’ publicly listed abuse@ addresses, whether they opt into the CART system or not, Bunton said.

One feature idea — possibly in a version 2 release — is to have a reputation-scoring function in which registrars can flag reporters as reliable, facilitating on-the-fly “trusted notifier” relationships.

While the DNSAI is focusing to the industry definition of “DNS abuse” — phishing, pharming, malware, botnets and a subset of spam — the plan is to not limit reporters to just those categories.

Copyright infringement claims, for example, would be acceptable forms of abuse report, if the registrar enables that option when they embed the CART forms on their own sites.

CART will most likely be renamed to something with “better mass-market appeal” before it launches, Bunton said, but there will be no charge to reporters or registrars.

“This is all free, with no plans to do cost-recovery or anything like that,” he said.

While Bunton didn’t want to comment, I think it’s unlikely that these projects would be going ahead, at least not for free, had PIR been turned into a for-profit company under its proposed acquisition by Ethos Capital, which was blocked by ICANN a couple of years ago.

A second project DNSAI is working on is called Intelligence.

This will be somewhat similar to ICANN’s own Domain Abuse Activity Reporting (DAAR) system, but with greater granularity, such as giving the ability to see abuse trends by registry or registrar.

The current plan is to have a preview of Intelligence available in June, with a launch in July.

Verisign and PIR join new DNS abuse group

Kevin Murphy, February 9, 2022, Domain Policy

The domain name industry has just got its fourth (by my count) DNS abuse initiative, with plans for work on “trusted notifier” programs and Public Interest Registry and Verisign as members.

topDNS, which announced itself this week, is a project out of eco, the German internet industry association. It said its goals are:

the exchange of best practices, the standardisation of abuse reports, the development of a trusted notifier framework, and awareness campaigns towards policy makers, decision-makers and expert groups

eco’s Thomas Rickert told DI that members inside and outside the industry had asked for such an initiative to combat “the narrative that industry is not doing enough against an ever-increasing problem”.

He said there’s a “worrying trend” of the domain industry being increasingly seen as an easy bottleneck to get unwelcome content taken down, rather than going after the content or hosting provider.

“There is not an agreed-upon definition of what constitutes DNS abuse,” he said.

“There are groups interested in defining DNS abuse very broadly, because it’s more convenient for them I guess to go to a registrar or registry and ask for a domain takedown rather than trying to get content taken down with a hosting company,” he said.

topDNS has no plans to change the definition of “DNS abuse” that has already been broadly agreed upon by the legit end of the industry.

The DNS Abuse Framework, which was signed by 11 major registries and registrars (now, it’s up to 48 companies) in 2019 defines it as “malware, botnets, phishing, pharming, and spam (when it serves as a delivery mechanism for the other forms of DNS Abuse)”.

This is pretty much in line with their ICANN contractual obligations; ICANN itself shudders away from being seen as a content regulator.

The big asterisk next to “spam” perhaps delineates “domains” from “content”, but the Framework also recommends that registries and registrars should act against content when it comprises child sexual abuse material, illegal opioid sales, human trafficking, and “specific and credible” incitements to violence.

Rickert said the plan with topDNS is to help “operationalize” these definitions, providing the domain industry with things like best practice documents.

Of particular interest, and perhaps a point of friction with other parties in the ecosystem in future, is the plan to work on “the development of a trusted notifier framework”.

Trusted notifier systems are in place at a handful of gTLD and ccTLD registries already. They allow organizations — typically law enforcement or Big Content — a streamlined, structured path to get domains taken down when the content they lead to appears to be illegal.

The notifiers get a more reliable outcome, while the registries get some assurances that the notifiers won’t take the piss with overly broad or spammy takedown requests.

topDNS will work on templates for such arrangements, not on the arrangements themselves, Rickert said. Don’t expect the project to start endorsing certain notifiers.

Critics such as the Electronic Frontier Foundation find such programs bordering on censorship and therefore dangerous to free speech.

While the topDNS initiative only has six named members right now, it does have Verisign (.com and .net) and PIR (.org), which together look after about half of all extant domains across all TLDs. It also has CentralNic, a major registrar group and provider of back-end services for some of the largest new gTLDs.

“Verisign is pleased to support the new topDNS initiative, which will help bring together stakeholders with an interest in combating and mitigating DNS security threats,” a company spokesperson said.

Unlike CentralNic and PIR, Verisign is not currently one of the 48 signatories of the DNS Abuse Framework, but the spokesperson said topDNS is “largely consistent” with that effort.

Verisign has also expressed support for early-stage trusted notifier framework discussions being undertaken by ICANN’s registry and registrar stakeholder groups.

PIR also has its own separate project, the DNS Abuse Institute, which is working on similar stuff, along with some tools to support the paperwork.

DNSAI director Graeme Bunton said: “I see these efforts as complementary, not competing, and we are happy to support and participate in each of them.” He’s going to be on topDNS’s inaugural Advisory Council, he and Rickert said.

Rickert and Bunton both pointed out that topDNS is not going to be limited to DNS abuse issues alone — that’s simply the most pressing current matter.

Rickert said issues such as DNS over HTTP and blockchain naming systems could be of future interest.

.org back-end deal will come up for re-bid, PIR says as it acquires four new gTLDs

Kevin Murphy, December 8, 2021, Domain Registries

The industry’s most lucrative back-end registry services contract will be rebid, Public Interest Registry said today.

The deal, which sees PIR pay Afilias $18.3 million a year to run .org, according to tax records, will see a request for proposals issued in the back half of 2023, according to PIR.

Given that’s two years away, it’s strange timing for the announcement, which came at the bottom of a press release and blog post announcing that the company is acquiring four new gTLDs, three of which belong to Afilias’ new owner, Donuts.

PIR said Donuts is to transfer control of .charity, .foundation and .gives, which will be “reintroduced” to the market. .foundation currently has about 20,000 registered domains; the other two have a few thousand each.

It’s also acquiring the unlaunched gTLD .giving from a company called Giving Ltd.

All four are on-message for PIR’s not-for-profit portfolio, which also includes the barely-used .ngo and .ong for non-governmental organizations.

Those two gTLDs are getting decoupled, allowing registrants to register one without having to buy the other, PIR also said today.

The last time the PIR back-end contract came up for renewal, in 2015, Afilias was also the incumbent but increased competition — it was up against 20 rivals — meant that its slice of .org revenue was cut in half.