Summary

  • AFRINIC says a purported Board ratified its Abuse Contact Policy Update on 4 February 2026. The decisive issue is not the contact-registration requirement itself, but AFRINIC staff’s statement that policy non-compliance would be considered a breach of the Registration Service Agreement and that persistent non-compliance may entail RSA revocation.
  • That statement does not create an automatic result. Contact registration, technical validation, an initial contact-and-cure period of no more than fifteen days, escalation to other LIR contacts for a second period of no more than fifteen days, a reporter’s signal, a reasonable information or cooperation request, a breach finding, written notice of intended RSA termination, a separate thirty-day show-cause or cure opportunity, termination, and the RSA’s post-termination resource consequence are distinct stages.
  • No checked public record establishes an effective implementation date, a final production procedure, a completed abuse-policy enforcement case, an RSA termination under this rule, or number-resource revocation caused solely by it. AFRINIC’s ratification account proves what AFRINIC says occurred inside the institution; it does not prove that the purported Board possessed sovereign authority or that a court or regulator has approved the possible consequence.
  • A thin registry may require a reachable contact, test objective deliverability, notify the holder, record a validation state and support correction. It has no authority to turn a mailbox defect, a disputed report or a database flag into punishment. Resource recognition must never be impaired solely because an abuse contact fails.

The sentence that changes the stakes

On 4 February 2026, AFRINIC says a purported Board ratified AFPUB-2018-GEN-001-DRAFT07, the seventh draft of its Abuse Contact Policy Update. The public proposal supplies a practical directory rule: certain number-resource records should point to a valid, monitored and actively managed mailbox so that reports have somewhere to go. Operators maintain the contact. AFRINIC staff or systems validate it. Other registered contacts may be used when the first route fails. Reporters can signal that a mailbox seems unresponsive or otherwise inconsistent with the policy.

Then the institutional register changes. In the staff legal-impact account preserved from the AFRINIC-33 discussion, policy non-compliance would be considered a breach of the Registration Service Agreement, the member would be encouraged to remedy it, and persistent non-compliance may entail RSA revocation. A field in a public directory has now entered the vicinity of the contract on which registry recognition and services depend.

That is the event and the stake. It is not evidence that the policy has been put into operation. It is not evidence that any member has failed it. It is not evidence that AFRINIC has issued a termination notice or revoked an agreement or number resource under it. It is a documented escalation theory: a contact defect could, after further acts, become contractual exposure. For a resource holder, customers and counterparties, the difference between “please repair this mailbox” and “your agreement may be terminated” is the difference between data maintenance and continuity risk.

This investigation owns that difference. It does not retell the broader case for mandatory abuse-contact registration. It does not make the three named database-object classes, unrestricted contact publication, the periodic validation cadence or the two short response periods its main subject. It is also separate from AFRINIC’s distinct compliance-dashboard discussion. Those matters may explain where a signal originates. The question here is what must happen before that signal can cross into the RSA, and what must never be presumed along the way.

Start with the narrow function

There is a strong and uncomplicated case for accurate contact data. A registry that cannot identify the recorded holder or provide a route for operational communication is less useful. Abuse complaints are often misdirected, incomplete or difficult to act upon, but an absent mailbox guarantees that even a well-supported report has no obvious destination. Requiring a contact record therefore serves contactability and registry accuracy. Testing whether an address can receive a message is also recognisably administrative.

The policy starts there. It attaches the abuse contact to three familiar kinds of resource record: autonomous-system records and IPv4 and IPv6 network records. A child record can inherit a contact from its parent. The referenced person or role object must contain at least one mailbox described as valid, monitored and actively managed. The contact is intended to be available through the public registry and associated interfaces.

Those design elements answer a limited question: where can a notice be sent? They do not answer whether the alleged traffic occurred, whether the resource holder controlled the user said to have caused it, whether the report contains usable evidence, whether a response was adequate, whether a particular law was engaged or whether any remedy is warranted. Contactability is an interface. It is not adjudication.

That distinction matters even before contractual consequences enter the picture. A mailbox may accept mail and still be badly managed. It may be actively managed and still reject an allegation after review. A transit provider may have less control over an alleged end user than a hosting provider. An operator may use a ticketing form, reject unsafe attachments, demand sufficient headers, protect customer information or prioritise urgent security reports. An automated complainant may mistake silence for indifference; a member may see an unusable submission. None of those possibilities proves the merits either way.

A reachable door does not decide what happened inside the building.

Validation is an observation, not a verdict

The proposal contemplates validation when a contact is created or updated, periodically at intervals no longer than six months, and when AFRINIC considers a fresh check appropriate. The cadence and triggers establish occasions for a test. They do not establish what a finished production test looks like. The public material examined here does not close the sender identity, delivery proof, anti-phishing controls, treatment of temporary outages, definition of active monitoring, treatment of greylisting, clock pauses or correction logs.

This is more than procedural fussiness. Email failure has many meanings. A hard bounce can indicate a nonexistent address. A temporary rejection can indicate an overloaded system. A delivered message can be caught by a spam filter. A human response can be delayed by staff turnover, a merger, a weekend, a local emergency or a request that lacks enough information. A mailbox can receive an automated challenge but fail to complete it because security controls distrust the sender. If an observation is going to support a more serious institutional act, the taxonomy of failure becomes part of fairness and accuracy.

The first policy window is described as an initial validation period of no more than fifteen days. If that attempt fails, the proposal calls for AFRINIC to approach other contacts registered for the LIR and begin another validation period, also no more than fifteen days. These are two bounded contact-and-cure opportunities. They can help distinguish an abandoned address from an isolated delivery problem and can give the member a route to repair the record.

They must not be treated as a single automatic thirty-day march to termination. The two fifteen-day periods belong to the policy’s contact-validation sequence. Their starting point, delivery rules and extension conditions are not established in the checked public material. More importantly, they are not the RSA’s termination process. Arithmetic cannot merge instruments. Fifteen days plus fifteen days may equal thirty on a calendar; it does not make a validation exchange legally or institutionally identical to a thirty-day contractual show-cause period triggered by written notice of intended termination.

A validation result is therefore best understood as a data observation. “Message delivered”, “temporary failure”, “address rejected”, “challenge unanswered” and “holder corrected the field” are intelligible operational states. “Member breached the agreement” is a different kind of conclusion. It requires a defined obligation, reliable evidence, a valid request or other contractual bridge, an authorised decision-maker and the process specified by the relevant agreement. The observation may inform that inquiry. It cannot silently become the answer.

A reporter supplies a signal, not a finding

The policy also permits reports about abuse mailboxes that appear unresponsive, selectively responsive or otherwise non-compliant. Such a report can prompt revalidation and possible AFRINIC intermediation. This provides a useful safety valve: an address might pass an automated test but fail in ordinary use, and the registry should be able to check whether its directory record remains accurate.

Yet reporter escalation introduces a second evidentiary boundary. The reporter is not AFRINIC’s validation system. The reporter does not determine the resource holder’s contract. A complaint can be sincere and still incomplete. It can be technically persuasive and still concern a downstream party. It can show repeated bounces without showing why they occurred. It can allege selective responsiveness without establishing what reports were actionable. It can justify asking a question without proving its answer.

The safe sequence is modest. Record the allegation. Preserve the submitted evidence. Test the contact through a known channel. Notify the holder through other registered contacts. Give the holder the particulars necessary to reproduce and correct the problem. Distinguish a technical delivery fault from disagreement over substance. Do not let volume substitute for quality, and do not let a complainant’s characterisation become an institutional finding simply because the registry is the place where the escalation landed.

That restraint protects reporters as well as members. If every complaint carries the implied weight of asset-threatening enforcement, AFRINIC creates incentives for tactical reporting, defensive silence and procedural combat. If a report instead triggers a bounded verification of directory accuracy, it remains useful without making the registry a universal court for spam, malware, phishing, fraud allegations, copyright disputes or every other category that may be sent to an abuse address. Courts, regulators, law-enforcement bodies, operators and contractual counterparties retain their different functions under applicable law.

The missing bridge into the RSA

The proposal itself does not specify a complete sanction ladder. It says consequences of non-compliance are stated generically in the RSA. AFRINIC staff went further in describing legal impact: non-compliance would be considered a breach of the RSA, while persistent non-compliance may entail revocation of the agreement. Because those are AFRINIC staff’s words about possible impact, the modal and the attribution are indispensable.

“May entail” is not “automatically causes”. “Would be considered” describes how staff anticipated characterising conduct; it is not a court’s finding, nor proof that every failed check satisfies an executed contract. The bridge must be constructed in the particular case.

The public English RSA dated 27 November 2017 contains two clauses relevant to that construction. Clause 4(b) concerns information, assistance and cooperation reasonably required in the provision of services, including during a review of resource utilisation. It describes possible consequences when a member fails to comply with such a request, including service withholding or revocation, effects on future assignments, LIR closure and agreement termination. Clause 4(c) contains a broader commitment to use AFRINIC services in compliance with AFRINIC policies, AFRINIC’s mandate and applicable law.

Neither clause allows the analytical steps to disappear. Under the cooperation clause, the request must be one reasonably required in service provision or the relevant review. AFRINIC must identify what it asked for, how it sent the request, why the request was reasonable, what response was due and how the member failed to cooperate. A bounced automated validation message is not automatically a refusal to provide reasonably required information. A complainant’s dissatisfaction is not automatically non-cooperation. A holder’s rejection of unusable evidence is not automatically an unwillingness to assist.

The policy-compliance clause is general. Applying it requires the policy duty to be identified, validly incorporated and applicable to the holder in question. The observed conduct must fit that duty. The member must have a real ability to cure. The institution must distinguish a stale field from deliberate false data, a temporary outage from repetition, and a contact failure from disagreement over an abuse report. Only then could an authorised AFRINIC actor consider whether the facts amount to a contractual breach. Even that conclusion would remain subject to the RSA’s own sequence and any review by a competent court or regulator.

The public record leaves important questions open. It does not define how many failures, over what period, make non-compliance “persistent”. It does not state a required mental element. It does not provide a final evidence standard or an independent reviewer for that characterisation. It does not identify which RSA clause AFRINIC would use for each kind of contact failure. It does not establish how the rule applies to legacy holders whose contractual position may differ. Those are not blanks that staff discretion should fill invisibly. They are boundaries on what can responsibly be claimed and on how far an operational observation can travel.

The contractual thirty days are a separate gate

Even if AFRINIC reached a supportable breach finding, the RSA supplies another sequence. Clause 11(d) describes written notice of AFRINIC’s intention to terminate, an invitation to the member to show cause why termination should not occur or to take remedial measures, and thirty days for the member to state its grounds against termination. AFRINIC then assesses the response or remediation.

This gate matters because termination is not merely an emphatic version of validation. The notice should identify the contractual basis and the conduct relied upon. The member should know whether the allegation concerns an inaccurate contact, failure to answer a reasonable request, violation of an applicable policy duty or something else. The cure should match the alleged defect. AFRINIC’s assessor should have valid corporate authority and should evaluate the member’s explanation rather than treating earlier status flags as conclusive.

The two contact-and-cure windows cannot substitute for this step. Their purpose is to establish or restore contactability. The RSA’s thirty days respond to an intended termination. A member that repaired a mailbox during the policy sequence might still dispute whether any earlier conduct was persistent. A member that did not repair it might show that notice never arrived, that the test was defective or that a force beyond its control prevented response. A holder could also accept the data defect while contesting the contractual consequence.

A process that collapses these issues into one timer would make the most severe decision depend on the least examined observation.

The public RSA also contains appeal language, but its fit here is unresolved. The text is framed around an appeal from an assigning registry to a parent registry. That does not clearly establish a merits forum for an AFRINIC-issued resource holder contesting an abuse-contact finding, a breach characterisation or intended termination by AFRINIC itself. The 2022 policy appeal does not fill the gap. The Appeal Committee set that challenge aside as inadmissible because the required prior attempt at resolution was not shown, and it expressly found no need to decide the merits.

An admissibility disposition proves neither that the policy design was substantively approved nor that a member facing an RSA consequence has an effective merits appeal.

Termination and the resource consequence are not the same act

The RSA wording gives termination its extraordinary operational weight. It states that termination or expiry is followed by immediate revocation of allocated or assigned number resources and cessation of services under the clause. That is the written post-termination exposure. It is not a report that this exposure has materialised under the abuse-contact policy.

Keeping termination separate from its consequence serves two purposes. First, it prevents a warning about possible RSA revocation from being retold as direct resource confiscation by the policy text. The policy describes contacts and validation; staff connected persistent non-compliance to possible RSA revocation; the contract describes what follows termination or expiry. The consequence depends on the agreement first being terminated through an authorised and supportable process.

Second, separation reveals where practical impact arises. Number resources are embedded in routing arrangements, customer services, access-control lists, security systems, commercial commitments and financing expectations. An adverse registry record or service action can create uncertainty for operators, customers, lenders and counterparties even before packets stop moving. Renumbering can be complex. Recognition, reverse DNS, security publication and update access can matter independently. These exposures need not be quantified to be material. They explain why a supposedly minor contact rule demands institutional restraint.

The registry does not bear those consequences in the same manner as the operator. The holder has built services and relationships around the identifiers. Customers may have configured systems around them. Counterparties may have priced continuity into agreements. AFRINIC maintains the coordinating record and services, but it does not absorb every downstream loss if recognition is impaired. When the decision-maker can create broad continuity risk while much of the cost lands elsewhere, the incentive to use a convenient administrative shortcut is structurally too strong.

That asymmetry is why procedure alone is not enough. A perfectly formatted notice does not grant a private registry sovereign power. A contractual clause does not turn a registry into a legislature, police service, regulator or court. The agreement can define relations between AFRINIC and a member, subject to the governing law and the particular executed terms. It cannot manufacture public authority over every network, customer or asset interest affected by the result.

Ratification is an institutional statement, not a sovereign warrant

AFRINIC’s current policy index and ratification overview describe the seventh draft as ratified on 4 February 2026. That is strong evidence of AFRINIC’s own stated status and act. It should be reported precisely: AFRINIC says a purported Board ratified the proposal.

The announcement does not resolve the authority of that body in every contested corporate respect. No Board resolution, quorum record or vote record examined here closes that question. Nor does ratification convert an internal policy process into legislation. PDWG participation, a co-chair consensus determination, an appeal period and a Board act can explain how AFRINIC says a proposal moved through its procedures. They do not create sovereign jurisdiction over absent principals.

The history is relevant but bounded. The first version entered the policy process in August 2018. Draft 7 was submitted in May 2021 and discussed at AFRINIC-33 in June. Last Call extended into January 2022. Co-chairs announced consensus on 14 January 2022. The later appeal was disposed of on admissibility grounds in July, without a merits decision, and the second appeal period is recorded as closing in August. Four years later came AFRINIC’s ratification account.

This chronology establishes institutional steps. It does not demonstrate affected-holder consent to every consequence. It does not prove the policy was technically deployed on a particular date. It does not identify the officer who could authorise an RSA investigation, termination notice or termination under the present governance arrangement. Most importantly, it does not give AFRINIC the authority of Mauritius’s courts or a competent regulator. Those sovereign bodies can decide contractual enforceability, corporate authority, procedural fairness, interim relief and applicable public-law questions in a concrete dispute.

AFRINIC cannot borrow their authority in advance.

The controlling rule is straightforward. AFRINIC is a bookkeeper and coordinator. Its legitimate power is to keep the number-resource ledger accurate, preserve uniqueness, publish useful contacts and administer defined services. It may correct the book. It may not treat reliance on the book as proof that it owns the operational world the book describes. Ratification can make a rule an internal institutional act according to AFRINIC’s account. It cannot make punishment sovereign.

What the public record does not show

As of 10 August 2026, the checked material does not identify a final effective date for production use of the policy. It does not publish a complete validation procedure, message templates, authorised sender domains, delivery rules, anti-phishing design or a definitive taxonomy of failure. It does not provide object-coverage figures, pass and fail rates, false-positive rates, cure rates, escalations or repeat-failure statistics.

It also does not close the enforcement half of the chain. There is no named standard for persistent non-compliance, no final mapping from each failure type to an RSA clause, no clearly established merits appeal for an abuse-contact sanction, no documented continuity rule for WHOIS or RDAP status, reverse DNS, RPKI and update access during a challenge, and no public resolution of how legacy holders would be treated.

No checked record identifies a member whose RSA was terminated, or whose number resources were revoked, solely because of persistent non-compliance with this abuse-contact policy. That is a bounded negative finding, not proof that no private notice or unpublished event exists. It forbids a claim of occurrence; it does not warrant a claim of metaphysical impossibility. The honest description is that public evidence of such an event was not found by the cutoff.

There is likewise no checked court or regulatory judgment approving or rejecting an abuse-contact revocation under this policy. It would be equally unsound to pronounce the entire design lawful or unlawful in every possible case. The public documents identify a policy, a staff interpretation and contractual wording. A concrete dispute would require the relevant executed agreement, evidence, notices, corporate authority and applicable law. Courts and regulators decide those sovereign questions.

The strongest case for escalation—and its limit

AFRINIC’s strongest case deserves to be put without caricature. A public abuse contact is useful only if it works. An unreachable mailbox externalises search and delay costs onto reporters, affected networks and security teams. A selectively responsive contact can make a formally correct registry entry practically useless. Members already operate within agreements that refer to policies and reasonable cooperation. A standard validation method, repeated attempts through different registered contacts and an opportunity to cure can be fairer than sporadic manual pressure.

If an operator repeatedly ignores clear requests despite reliable notice and ample ability to correct the field, some institutional response is understandable.

That case fully supports contact registration, objective validation, notice, correction support and an accurate status. It does not support the punishment leap. Repeated contact failure still does not create duplicate numbering. It does not by itself damage uniqueness. It does not prove the underlying abuse allegation. It does not prove fraud, intentional avoidance or refusal to cooperate with a reasonable request. It does not answer which contract applies, who can make a breach finding or what review is available.

The proportionate remedy should track the proved defect. A bad contact calls for contact through another route, correction assistance and a validation flag. Deliberately false registration data may justify a distinct investigation with its own evidence and process. A proven duplicate claim requires protection of uniqueness. A binding court order requires compliance with sovereign authority. These categories should not borrow one another’s remedies merely because they all touch the same database.

The phrase “persistent non-compliance” cannot be allowed to do all the work. Without a definition, it compresses a series of institutional judgments into an adjective. Persistence could mean repeated bounces, two unanswered validations, refusal after confirmed delivery, failure across several cycles or something else. Compliance could refer to the contact field, a substantive response expectation, cooperation with AFRINIC or an abuse allegation. Before the phrase can support a consequence, every component must be specified and contestable.

The bookkeeper’s proper stopping point

A sound abuse-contact system has a clear end. The holder provides a reachable address. AFRINIC tests objective deliverability through a predictable method. When the test fails, AFRINIC notifies other registered contacts and preserves the evidence. The holder receives time and practical access to correct the field. The registry records the last validation state and date. Reporters can request revalidation, but their submissions remain signals. Support needed for correction remains available.

The system should also distinguish failure states. A bounce is not the same as no acknowledgement. No acknowledgement is not the same as a slow response. A slow response is not the same as rejection of a complaint. Rejection is not the same as deliberate false data. None is automatically the same as a failure to answer a reasonable and properly delivered cooperation request. Clear labels reduce conflict because operators can cure the defect actually proved.

Then comes the firewall: abuse-contact failure alone must not cause deregistration, resource reassignment, impaired registry recognition, RPKI interruption, reverse-DNS removal, transfer denial or RSA termination. If separate evidence indicates fraud, duplicate claims, explicit abandonment or an urgent threat to the registry’s own integrity, the institution can refer that separate issue into a narrowly defined process. Binding court orders and independently adjudicated outcomes have their own authority. A mailbox flag cannot impersonate them.

This is not leniency toward abuse. It is accurate institutional design. The operator remains responsible for obligations created by applicable law and its own contracts. Reporters remain free to use the appropriate operator, provider, law-enforcement, regulatory or judicial route. AFRINIC remains useful because its records are accurate and its contacts work. What disappears is the claim that the registry should use recognition of number resources as a general enforcement lever.

The practical result is stronger contactability with less fear. Members have an incentive to correct records because the system helps them do so and labels the result accurately, not because every technical fault carries an existential threat. Reporters gain a route that can be checked. AFRINIC gains better data. Courts and regulators retain the authority to decide wrongdoing and punishment. The registry remains what the Internet needs from it: a truthful ledger, not a sovereign.