Registrar Advisory Concerning Whois Data Accuracy

The purpose of this advisory is to assist ICANN-accredited registrars in understanding their obligations under ICANN's Registrar Accreditation Agreement (RAA) regarding the accuracy of Whois data. Registrars are required to obtain contact information from registrants, to provide it publicly by a Whois service, and to investigate and correct any reported inaccuracies in contact information for names they sponsor. The following advisory will outline the relevant provisions of the RAA and suggest steps registrars can take to ensure they fulfill their obligations with respect to Whois data accuracy.

Relevant Provisions of the Registrar Accreditation Agreement

Several provisions of the RAA are relevant to the accuracy of registrar Whois data. They include:

A. Providing Whois Service

3.3.1 At its expense, Registrar shall provide an interactive web page and a port 43 Whois service providing free public query-based access to up-to-date (i.e., updated at least daily) data concerning all active Registered Names sponsored by Registrar for each TLD in which it is accredited. The data accessible shall consist of elements that are designated from time to time according to an ICANN adopted specification or policy. Until ICANN otherwise specifies by means of an ICANN adopted specification or policy, this data shall consist of the following elements as contained in Registrar's database:

3.3.1.1 The name of the Registered Name;

3.3.1.2 The names of the primary nameserver and secondary nameserver(s) for the Registered Name;

3.3.1.3 The identity of Registrar (which may be provided through Registrar's website);

3.3.1.4 The original creation date of the registration;

3.3.1.5 The expiration date of the registration;

3.3.1.6 The name and postal address of the Registered Name Holder;

3.3.1.7 The name, postal address, e-mail address, voice telephone number, and (where available) fax number of the technical contact for the Registered Name; and

3.3.1.8 The name, postal address, e-mail address, voice telephone number, and (where available) fax number of the administrative contact for the Registered Name.

B. Required Provisions in Service Agreements with Registrants

3.7.7 Registrar shall require all Registered Name Holders to enter into an electronic or paper registration agreement with Registrar including at least the following provisions:

3.7.7.1 The Registered Name Holder shall provide to Registrar accurate and reliable contact details and promptly correct and update them during the term of the Registered Name registration, including: the full name, postal address, e-mail address, voice telephone number, and fax number if available of the Registered Name Holder; name of authorized person for contact purposes in the case of an Registered Name Holder that is an organization, association, or corporation; and the data elements listed in Subsections 3.3.1.2, 3.3.1.7 and 3.3.1.8.

3.7.7.2 A Registered Name Holder's willful provision of inaccurate or unreliable information, its willful failure promptly to update information provided to Registrar, or its failure to respond for over fifteen calendar days to inquiries by Registrar concerning the accuracy of contact details associated with the Registered Name Holder's registration shall constitute a material breach of the Registered Name Holder-registrar contract and be a basis for cancellation of the Registered Name registration.

3.7.7.3 Any Registered Name Holder that intends to license use of a domain name to a third party is nonetheless the Registered Name Holder of record and is responsible for providing its own full contact information and for providing and updating accurate technical and administrative contact information adequate to facilitate timely resolution of any problems that arise in connection with the Registered Name. A Registered Name Holder licensing use of a Registered Name according to this provision shall accept liability for harm caused by wrongful use of the Registered Name, unless it promptly discloses the identity of the licensee to a party providing the Registered Name Holder reasonable evidence of actionable harm.

C. Registrar Obligation to Correct Inaccurate Data

3.7.8 Registrar shall abide by any specifications or policies established according to Section 4 requiring reasonable and commercially practicable (a) verification, at the time of registration, of contact information associated with a Registered Name sponsored by Registrar or (b) periodic re-verification of such information. Registrar shall, upon notification by any person of an inaccuracy in the contact information associated with a Registered Name sponsored by Registrar, take reasonable steps to investigate that claimed inaccuracy. In the event Registrar learns of inaccurate contact information associated with a Registered Name it sponsors, it shall take reasonable steps to correct that inaccuracy.

In summary, based on the above provisions, a registrar must:

• Require each registrant to submit (and keep updated) accurate contact details (3.7.7.1);
  
  
  
  
• Provide both a web-based and Port 43 Whois service providing access to complete contact information for all TLDs covered under the RAA (3.3.1);
  
  
  
  
• Require registrants to agree that willfully submitting inaccurate contact details (or failing to respond within 15 days to an inquiry regarding accuracy) shall be a basis for cancellation of the registration (3.7.7.2); and,
  
  
  
  
• Take reasonable steps to investigate and correct the contact details in response to any reported inaccuracy (3.7.8).

Requiring Registrants to Provide Accurate Data

Subsection 3.7.7.1 of the RAA requires registrars to include in their registration agreement with each registrant a provision under which the registrant promises to "provide to Registrar accurate and reliable contact details and promptly correct and update them ... ." Although 3.7.8 envisions that ICANN may develop a policy requiring registrars to verify the contact details at the time of registration, ICANN has not yet done so. Nonetheless, registrars will find that implementing readily-available techniques to verify the format of data in the registration process (such as screening for blank fields or checking that addresses have valid post codes) will diminish the need for manual processes that would later be necessary to comply with the requirement to investigate reported inaccuracies.

Obligation to Investigate and Correct Reported Inaccuracies

Subsection 3.7.8 of the RAA obliges registrars to "take reasonable steps to investigate" any inaccuracy in Whois data upon notification from "any person." In order to facilitate compliance with this responsibility, registrars should establish a clear mechanism for receiving, investigating, and tracking reported inaccuracies in their Whois data. In the absence of a clearly designated contact or channel for receiving complaints about inaccurate Whois data, registrars are responsible for acting upon "notifications" that may be received by diverse, and even informal, means. This may make it difficult for registrars to fulfill their obligations.

Once a registrar receives notification of an inaccuracy, Subsection 3.7.8 requires the registrar to take "reasonable steps" to investigate and correct the reported inaccuracy. The term "reasonable steps" is not defined within the agreement; precisely what constitutes reasonable steps to investigate and correct a reported inaccuracy will vary depending on the circumstances (e.g., accepting unverified "corrected" data from a registrant that has already deliberately provided incorrect data may not be appropriate). At a minimum, "reasonable steps" to investigate a reported inaccuracy should include promptly transmitting to the registrant the "inquiries" concerning the accuracy of the data that are suggested by RAA Subsection 3.7.7.2. The inquiries should be conducted by all commercially practicable means available to the registrar: by telephone, e-mail, and postal mail.

Cancellation of Registrations in the Event of Material Breach by the Registrant

If the registrant fails to respond "for over fifteen calendar days to inquiries by Registrar concerning the accuracy of contact details", then pursuant to RAA Subsection 3.7.7.2 the registrant is in "material breach" of its registration agreement with the registrar. That subsection also provides that "willful provision of inaccurate or unreliable information" shall constitute a material beach of the registration agreement. Under either of these circumstances, the RAA provides that the material breach of the registration agreement shall be "a basis for cancellation of the Registered Name registration." Accordingly, if the registrar's investigation results in a determination that the registrant is in material breach of its registration agreement, then in the absence of extenuating circumstances the registrar should cancel the domain registration.

Applicability to Resellers

The registrar obligations outlined above (as well as all other registrar obligations under the RAA) apply with equal force to all registrations sponsored by a registrar in any TLD for which it is accredited by ICANN, whether those registrations were placed directly with the registrar or through some agent or reseller. In other words, registrars are responsible for providing Whois data (and correcting any reported inaccuracies in that data) for all names under their sponsorship, including the data pertaining to customers of their resellers.

Conclusion

This advisory is being published to promote registrar and community understanding about registrar's current obligations under ICANN's Registrar Accreditation Agreement with respect to Whois data accuracy. Interested members of the community should also be aware that ICANN's Domain Name Supporting Organization has convened a Whois Task Force to review and possibly suggest improvements to current ICANN policy and agreements relating to Whois. Anyone interested in contributing to the development of such policies through ICANN's bottom-up, consensus-based policy development system is invited to visit <http://www.icann.org/participate/> to learn how to participate.

Please contact ICANN's Registrar Liaison department, with any questions or comments relating to ICANN registrar accreditation and Whois requirements.