Summary

  • AFRINIC says its Board ratified the Abuse Contact Policy Update, AFPUB-2018-GEN-001-DRAFT07, on 4 February 2026 alongside the separate resource-transfer policy.
  • Draft 7 requires a valid, monitored and actively managed abuse mailbox. It also regulates response behaviour: reports must require human intervention, must not be diverted to a compulsory form and must be capable of carrying logs, examples and headers.
  • AFRINIC may validate on creation, on update, at least once every six months and whenever it sees fit. Complaints about no response, an incorrect response or selective replies can trigger revalidation.
  • The published staff assessment says support should be offered only to compliant members and that persistent non-compliance may entail revocation of the Registration Service Agreement. This briefing found no evidence that a member has actually been revoked under Draft 7.
  • The governance issue is therefore not whether a reachable public contact is useful. It is why a correctable directory defect can enter a discretionary path toward core services and contractual survival without a published independent-review and continuity firewall.

A mailbox became a compliance gate

The public case for an abuse contact is straightforward. A bank tracing credential attacks, a network operator handling spam or a security team investigating malware needs a reachable desk associated with the relevant address block or autonomous system. A registry can help by keeping that contact current and visible. That is ordinary directory work.

AFRINIC’s newly ratified rule does more. The final proposal requires every AFRINIC-allocated or assigned inetnum, inet6num and aut-num record to point to an abuse-c contact with at least one valid, monitored and actively managed inbox. That contact must be exposed without restriction through WHOIS, APIs and future access methods.

AFRINIC presents the change as a small, continuing operational effort that will improve data quality, cybersecurity and the speed of incident handling. Those are plausible objectives, but they are institutional claims, not measured results. The decisive question is where directory accuracy ends and behaviour control begins.

The policy requires more than proof that an address accepts mail. Messages must require intervention by the recipient. A reporter must not be forced to complete a form. The mailbox must guarantee receipt of reports and associated logs, examples or email headers. Validation is meant to confirm that the holder has read the policy, monitors the inbox, takes measures and responds to reports.

That is a large jurisdictional step. Deliverability is an objective registry fact. Whether a response is correct, timely or sufficient depends on the allegation, the evidence, the customer relationship, local law, privacy duties and the network’s operational role. Draft 7 itself says it does not define “abuse” because that definition falls outside AFRINIC’s scope. Yet it allows alleged inaction or an “incorrect” response to trigger institutional revalidation.

The rule writes discretion into the clock

Draft 7 gives AFRINIC several entry points. Validation occurs when the contact is created or updated. It occurs periodically, not less than once every six months. It may also occur whenever AFRINIC sees fit.

The initial validation period is no longer than 15 days. If it fails, the matter is escalated to other contacts and a second period of no more than 15 days begins. The policy also lets AFRINIC amend the initial period, escalation period and frequency each year, provided it tells the community why.

That flexibility may help a phased rollout. It may allow staff to manage a historical data problem whose scale was substantial: the assessment recorded only 28 of 1,857 resource members using the old contact mechanism, with 232 of 139,268 inetnum objects, 33 of 31,230 inet6num objects and 32 of 1,915 aut-num objects protected by MNT-IRT at the time. Those are historical baseline figures, not current adoption numbers.

But discretion is not harmless simply because the underlying workload is real. “Whenever AFRINIC sees fit” supplies no objective trigger, frequency ceiling or false-positive standard. A third party may report an unresponsive mailbox, a mailbox that answers AFRINIC but not other messages, or failure to provide what the complainant considers a proper answer. The report can initiate revalidation even though the policy leaves the substance of abuse outside AFRINIC’s mandate.

No fact in this packet shows that AFRINIC has used that authority against a particular operator. The risk is constitutional rather than anecdotal: the rule makes the registry both designer of the test and judge of compliance.

The severe consequence sits in the RSA

The proposal says it does not specify non-compliance consequences because those consequences are generally stated in the Registration Service Agreement. The integrated staff assessment makes the bridge explicit.

It says support services, including the help desk and resource applications, shall be offered only to members that comply with the policy. Its legal-impact section says non-compliance will be treated as breach of the RSA, that the member will be encouraged to remedy the breach and that persistent non-compliance may entail revocation of the agreement.

That final step matters because the RSA is not a newsletter subscription. It is the contract through which a resource member receives registry services and recognition. Termination can carry consequences for number resources and service continuity. NRS argues that this practical registry power exists alongside a liability cap that may fall as low as US$100; LARUS makes the same power-versus-downside comparison in its public contract analysis. Those are their attributed positions, not a court’s judgment about Draft 7.

The fact pack does not show an actual Draft 7 termination, resource revocation or denial of support. Nor does it establish that AFRINIC will interpret every failed validation maximally. The governance concern is narrower and stronger: the published architecture permits a correctable contact problem to enter a pathway whose outer consequence is contractual extinction, while the same public materials do not state an independent review requirement or an automatic stay preserving essential services.

Two appeals ended before the merits

The proposal did not reach ratification without objection. A 2021 appeal and another disposition in 2022 challenged the declaration of consensus. Both first-party reports rejected the challenges on admissibility grounds and expressly declined to examine the merits.

The 2022 submission argued that abuse differs across jurisdictions, that the existing contact mechanism was sufficient, that response duties imposed costs and that the registry was moving beyond bookkeeping into network management. Those were the appellant’s arguments, not findings. But the appeal decisions cannot fairly be cited as proof that the substance was disproved, because the committees said they did not reach it.

This procedural boundary matters when AFRINIC describes the policy as community-developed and consensus-based. A process may satisfy internal steps while leaving a substantive power question unresolved. Participation is not the same as authorization from every operator whose contract can be affected.

Ratification occurred inside an unresolved authority setting

AFRINIC’s live policy page says the Board ratified Draft 7 on 4 February after what it called restoration of functional governance structures. That page establishes what the institution did and how it describes the act.

AFRINIC’s own 12 March update also said that the directors elected in September 2025 had resumed duty, that the court-appointed receiver remained in place pending formal discharge and that proceedings sought to invalidate those appointments. This briefing does not decide those cases and does not declare the Board unlawful. It records that a consequence-heavy policy was ratified while the authority environment AFRINIC itself described was not finally settled.

The timing sharpens the accountability test. A narrow contactability rule would be easy to defend even during institutional repair. A rule that can touch support and contract survival needs a clearer mandate, published safeguards and remedy proportional to its effect.

What a narrow, reviewable rule would look like

AFRINIC does not need to abandon abuse contacts. It needs to prevent contact verification from becoming an all-purpose enforcement lever.

A bounded rule would test whether mail can be delivered, not whether staff approve of a holder’s substantive response. It would publish fixed triggers, allow multiple contacts and authenticated forms, give at least 30 days and two notices to cure, and report aggregate validation, false-positive and correction statistics. During correction, the member would retain the dashboard, help desk and registry services needed to fix the record. RPKI, reverse DNS, ordinary maintenance and recognition of the last verified holder would continue.

Termination or resource revocation would require a separate serious ground, written reasons, independent review and a continuity stay. Fraud, duplicate claims or a binding court order may justify stronger measures. A broken mailbox, by itself, should produce a data-quality flag and correction process, not operational jeopardy.

This is the distinction Heng Lu’s doctrine makes central. A registry earns legitimacy by protecting uniqueness, accurate records and running networks. It does not acquire sovereignty over an operator merely because the operator depends on its ledger. When practical power expands while liability and remedy remain thin, the system transfers risk downward to the member.

AFRINIC’s 4 February act therefore deserves to be described precisely. It ratified a useful directory requirement with a much thicker compliance tail. The record does not prove enforcement or illegality. It does show that the path from mailbox to contract now exists on paper. Operators should demand the missing firewall before the first disputed validation makes that path real.

For a fuller treatment of notice, cure, review and continuity in adverse registry decisions, see BTW’s separate research: AFRINIC adverse decisions under notice, cure and appeal.

Sources