This Public Comment proceeding was initially scheduled to remain open from 29 May 2023 through 13 July 2023. The Public Comment proceeding was extended by one week in response to requests for additional time to submit input. ICANN org received thirty-six (36) comments on the proposed amendments to the base generic top-level domain (gTLD) Registry Agreement (Base RA) and the 2013 Registrar Accreditation Agreement (RAA) from groups, organizations, and individuals.
Comments provided general support for the proposed amendments with some offering feedback for ICANN org to consider including in the draft ICANN Advisory and/or the proposed amendments. ICANN org reviewed the feedback and consulted with the Contracted Parties House Negotiating Team (CPH NT). Following the consultation between ICANN org and the CPH NT, the comments confirmed that the proposed amendments met their stated objective of enhancing obligations by requiring registrars and registry operators to promptly take reasonable and appropriate action to stop or otherwise disrupt Domain Name System (DNS) Abuse.
ICANN org appreciates the participation in this proceeding and is grateful to those who provided their feedback.
What We Received Input On
ICANN org and members of the gTLD Registries Stakeholder Group (RySG) and the Registrar Stakeholder Group (RrSG), collectively the Contracted Party House Negotiating Team (CPH NT), are seeking input from the ICANN community on the proposed amendments to the gTLD RA and 2013 RAA, collectively, the “Agreements.”
The proposed amendments would enhance obligations by requiring registrars and registry operators to promptly take reasonable and appropriate action to stop or otherwise disrupt DNS Abuse. For the purposes of the proposed amendments, DNS Abuse means malware, botnets, phishing, pharming, and spam (when spam serves as a delivery mechanism for the other forms of DNS Abuse, namely, malware, botnets, phishing, and pharming) as those terms are defined in Section 2.1 of the Security and Stability Advisory Committee Report on an Interoperable Approach to Addressing Abuse Handling in the DNS (SAC115).
ICANN org and the CPH NT are seeking input from the ICANN community on the proposed amendments which strengthen the existing provisions in Section 3.18 of the RAA and Specification 6, Section 4 of the RA by adding DNS Abuse mitigation and disruption obligations. The proposed revisions include the following:
- Requirements to ensure abuse contacts are readily accessible on the contracted party’s webpage and to produce receipt confirmation for reporters upon receipt of abuse reports
- Possibility for registrars and registry operators to use webforms instead of email as an abuse reporting mechanism
- A definition of DNS Abuse for purposes of the Agreements
- A new requirement to promptly take appropriate mitigation actions against domains for which the contracted party has actionable evidence demonstrating that the domains are being used for DNS Abuse
- Permits contracted parties (CPs) to exercise reasonable discretion in selecting and implementing the appropriate mitigation actions depending on the circumstances of each case
- Recognition of the different roles of the registrar and registry operator
- Focus on the target outcome of stopping or disrupting the use of gTLD domain names for DNS Abuse
In addition, amendments to Section 11.3 (b) of the RA to replace the term security threats with DNS Abuse. This clarifies that registry operators must periodically conduct a technical analysis to assess whether domains in the top-level domain (TLD) are being used to perpetrate DNS Abuse and maintain statistical reports on identified DNS Abuse. A positive benefit of this change is to expand the requirement for Registries to include Spam as a delivery mechanism for other forms of DNS Abuse as something to include their periodic analysis and reports
The proposed amendments do not specify the mitigation actions, or their timing, as such approach may not guarantee the desired outcome in all instances. The negotiation teams discussed a prescriptive approach but ultimately decided such an approach may unintentionally result in undesirable disproportionate outcomes where DNS Abuse involves compromised domain names or could result in delayed responses in situations where swift action is required. The appropriateness and promptness of the actions will depend on the specific circumstances of each case. The amendments are intended to result in prompt and reasonable mitigation actions that minimize the scope and intensity of the harm and victimization caused by DNS Abuse while limiting collateral damage caused by CP’s actions in response to the DNS Abuse. The proposed amendments contemplate that the best-equipped parties to conduct a thorough review of the matter and take the appropriate, proportionate mitigation actions may vary depending on the circumstances.
For more information, please read the draft ICANN Advisory, that would come into effect if the proposed amendments are approved. The draft Advisory further explains the new requirements, provides guidance, and sets out expectations for action by CPs to establish compliance. The draft Advisory also elaborates upon terms like “mitigation actions,” “appropriate,” “stop” (contributing to stop), and “disrupt” (contributing to disrupt). Additionally, the draft Advisory contains examples of DNS Abuse, actionable evidence, and corresponding appropriate and prompt mitigation actions, considering the circumstances of each case.
Note: The RAA and RA versions included for your comment in the Proposals for Your Input Section below are those recently approved by the ICANN Board of Directors on 30 April 2023. The Agreements contain a bracketed date that will be updated when ICANN sends out the notification of the effectiveness of the RDAP global amendments.
Additionally, please note that the Registrar Information Specification attached to the RAA includes cross-reference typographical errors that will be corrected when the RDAP global amendments become effective. To review all of the changes from the 2023 RDAP Global Amendment, please see here.
Update: 14 June 2023 ICANN org updated the Proposed REDLINE 2013 Registrar Accreditation Agreement and Proposed CLEAN 2013 Registrar Accreditation Agreement included for your Public Comment in the Proposals for Your Input Section below. These two documents were missing the following sentence in section 3.18.1: “Upon receipt of such reports, Registrar shall provide the reporter with confirmation that it has received the report.” This sentence is included in the Proposed Global Amendment to the Registrar Accreditation Agreement, but was inadvertently omitted in the full versions of the RAA.
ICANN org contracts with registries to operate generic top-level domains (gTLDs) through the RA. The RA specifies the responsibilities of the registry operator, which include maintaining the authoritative database of all registered domain names in the gTLD and publishing the DNS zone for the gTLD. The RA also requires registry operators to assess whether domain names in the TLD are being used to perpetrate DNS Abuse.
ICANN also enters into an RAA with each registrar, which allows the registrar to offer domain name registration services in gTLDs. The RAA outlines the responsibilities of the registrar, such as verifying registrant information and maintaining accurate records and investigating abuse reports. The roles and obligations of registrars and registries are distinct and are reflected in their respective agreements, the RAA and the RA. ICANN has the authority to enforce rules related to domain registration services and domain names as outlined in the Agreements.
In November 2022 the RrSG and RySG, collectively the Contracted Parties House (CPH), proposed to ICANN org the idea of collaborating to enhance the existing contracts by creating clear obligations to stop or otherwise disrupt DNS Abuse. With their proposal, they suggested and ICANN agreed to certain guideposts for the amendments:
- The focus of the new provisions will be on DNS Abuse as set forth in the existing ICANN contracts;
- The amendments will not include matters pertaining to website content abuses nor access to registration data;
- Any new provisions should appropriately reflect the roles and responsibilities of registrars and registries in each agreement, respectively, and will not seek to impose pass-through requirements on either group.
In January 2023, ICANN org responded to letters from the RrSG and RySG to formally initiate the process to amend the Agreements to strengthen the existing obligations related to DNS Abuse. ICANN org expects the proposed amendments will aid in enforcement efforts by ICANN’s Contractual Compliance function for those registrars or registry operators who fail to promptly and appropriately take action reasonably necessary to address DNS Abuse. Current language in the Agreements is perceived to lack specificity and would benefit from a more explicit obligation for CPs to take mitigation actions.
Taking this approach to make specific improvements to the existing obligations in the Agreements and adding a clear obligation for registrars and registry operators to mitigate DNS Abuse is an important building block in a longer journey that could include policy discussions open to the full ICANN community, and potentially future negotiations between the CPH and ICANN org. Further policy development could also be pursued in the Generic Names Supporting Organization (GNSO) to broaden the examination of what additional obligations should exist and define in more detail what is expected of registrars and registry operators in a community-wide process.