Summary

  • AFRINIC reported that the Board it presents as current ratified the Abuse Contact Policy Update, AFPUB-2018-GEN-001-DRAFT07, on 4 February 2026. Its public overview and proposal index establish that AFRINIC made that claim and marks the proposal ratified; they do not supply the underlying Board resolution, minutes, quorum, vote, signed instrument or an independent judgment about the Board’s broader legitimacy.
  • The ratified text makes abuse-c mandatory for inetnum, inet6num and aut-num records, permits parent inheritance for child objects, requires an unrestricted public mailbox, and envisages validation at creation, update, at least every six months and whenever AFRINIC sees fit. It also reaches beyond simple delivery into human monitoring, recipient intervention, reporter forms and response behaviour.
  • A thin rule is justified: a registry bookkeeper may require a correct contact, test objective reachability, record the result, notify the holder and support correction. AFRINIC has no sovereign, police, judicial or punitive authority, and a mailbox record cannot grant it jurisdiction over the network, customer or allegation behind an abuse report.
  • Ratification is not implementation. The checked public record leaves open the effective date, implementation notice, deployed systems, validation method, anti-phishing controls, evidence threshold for outside reports, current coverage, false-positive rate, correction time, review route and cost.
  • The strongest case for the policy is substantial: abuse reports often begin with an IP address, voluntary use of the earlier contact mechanism was historically sparse, and a dependable contact can lower search costs and speed incident routing. That case supports accurate contact infrastructure, not registry judgment of whether an operator investigated, replied or acted properly.
  • The policy will deserve confidence only if its operational state describes what AFRINIC can actually prove—record presence and technical reachability—and if every adverse flag is dated, bounded, reversible and open to swift correction.

On 4 February 2026, according to AFRINIC, the Board it presents as current ratified a proposal that had been moving through the regional policy process since August 2018. The act sounds modest. It concerns an email address intended to receive reports about abuse and security incidents associated with Internet number resources. Yet the address sits at an unusually sensitive junction. On one side is the practical need to reach someone who can examine a report. On the other is a registry whose records are relied on by operators, security teams, customers and commercial counterparties.

What the registry says about the address can therefore travel much further than the mailbox itself.

That is why the ratification should be read through its control surface rather than its label. The central question is not whether abuse is serious, or whether unreachable contacts are frustrating. Both propositions can be accepted. The question is what a number-resource registry can legitimately require, observe and conclude. A bookkeeper can insist that the book contain a usable contact. It can correct stale information. It can test whether a message can be delivered.

It cannot turn the act of maintaining a ledger into a general licence to supervise investigations, decide which allegations are valid, compel a particular response, or punish conduct on networks it does not govern.

The distinction matters immediately because the ratified proposal contains both kinds of rule. Its thin layer concerns the record: make abuse-c mandatory, attach it to the relevant resource objects, publish a working mailbox and check that the data remains reachable. Its thick layer concerns behaviour behind the record: the mailbox is to be monitored and actively managed; messages are to require intervention by the recipient; a reporter is not to be forced through a form; supporting logs, examples or headers must be receivable; and certain allegations of non-response or selective response can lead to revalidation. Those requirements move from asking, “Can a notice arrive?” toward asking, “What did the operator do after it arrived?” The second question may be important, but it is not converted into registry jurisdiction merely by placing it next to the first.

What AFRINIC reported on 4 February

AFRINIC’s ratification overview states that Draft 7 was ratified on 4 February 2026. Its current proposal index labels Draft 7, dated 17 May 2021, as ratified. A February newsletter also says the Board officially ratified the Abuse Contact Policy Update, alongside the Number Resource Transfer Policy. An 18 February communiqué attributes both acts to a Board AFRINIC describes as properly constituted and connects them to a reinstated policy group. These publications are strong evidence that AFRINIC made and maintained the ratification claim.

They are not all-purpose proof. The overview can establish what AFRINIC announced and how it described the intended effect. The proposal page can establish the text AFRINIC published and the impact analysis attached to it. The newsletter and communiqué can corroborate the institution’s account of the act. None independently resolves disputes about the broader legitimacy of the Board AFRINIC presents as current. Nor does a statement that consensus was documented prove that every substantial objection was heard and answered on its merits.

The missing Board record is therefore material, not ceremonial. The checked public sources did not reveal the separate resolution, minutes, quorum, voting record or signed ratification instrument. They also did not establish whether the text transmitted to the Board was byte-for-byte identical to the published Draft 7. AFRINIC’s Bylaws locate Board ratification after proposals are discussed and agreed through the policy process; they also describe a distinct route for necessary and urgent Board adoption. AFRINIC presented the February act as ratification of documented-consensus proposals, not as use of that urgent route.

The Bylaws explain internal corporate machinery. They do not turn the company into a legislature, police force or court.

This evidence boundary allows a precise statement: AFRINIC reported a ratification, and its public status materials consistently record that position. It does not allow the broader statement that every institutional dispute was conclusively resolved, every affected party consented, or public authority arose from the vote. A corporate act can be real and consequential without acquiring sovereign character.

The record the policy seeks to change

The proposal addresses an identifiable weakness in the prior arrangement. AFRINIC’s earlier abuse-contact mechanism used a dedicated incident-response object, but reference to it from resource records was optional. The policy discussion described that model as little used. Draft 7 replaces it with the more standard abuse-c attribute and makes the reference mandatory on the principal object classes used for number-resource information: inetnum for IPv4, inet6num for IPv6 and aut-num for autonomous system numbers. For child objects, the policy permits inheritance from a parent where appropriate.

The contact points to a person or role with at least one abuse mailbox. The text describes that mailbox as valid, monitored and actively managed. It is meant to receive abuse and security reports. AFRINIC’s ratification overview says the affected population includes members holding IPv4, IPv6 or ASNs, legacy resource holders and new applicants. The mailbox is to be available without restriction through WHOIS, APIs and future techniques. In other words, this is not simply a member-account field. It is intended to be public evidence infrastructure that outside parties can discover and use.

The registration requirement can correct a real coordination failure. An incident responder often starts with an address seen in a log. Finding the right operational desk may involve searching public registration data, following delegation chains, distinguishing a holder from a downstream operator and trying outdated contacts. A common field does not solve responsibility or attribution, but it can reduce the first layer of uncertainty: where a sufficiently detailed report should be sent. A public registry is well placed to maintain that narrow mapping because connecting resource records to contact records is exactly a bookkeeping task.

Accuracy also matters to the holder. A resource record is consulted by people who may know nothing about the operator’s internal structure. If the listed mailbox is abandoned, points to a departed employee or cannot accept evidence, legitimate reports will be delayed or misdirected. A role address, maintained through staff changes, is often safer and more durable than exposing an individual. NRS operational guidance accordingly treats abuse-contact accuracy as one control in a broader audit of company number resources. It also insists on distinguishing formal policy, contracts, procedures, guidance and proposals.

That distinction is essential here: a useful data field does not erase the different authority and evidentiary weight of the instruments surrounding it.

What validation is supposed to test

Draft 7 does not stop at requiring the field. It says AFRINIC should validate abuse-c or the related mailbox when the record is created, when it is updated, periodically at least once every six months, and whenever AFRINIC sees fit. If an initial validation fails, the process is to escalate to other contacts of the local Internet registry for a further period not exceeding fifteen days. The initial period is also described as no longer than fifteen days. These are two stated periods, but they should not be collapsed into a guaranteed thirty-day legal cure. Delivery, transition and implementation rules may alter what happens in practice, and the text allows timing and frequency to be adjusted through a communicated slow start and phased implementation.

The six-month default implies at least two scheduled checks in a twelve-month year if implemented without adjustment. It is neither a proved operating count nor a ceiling. “Whenever AFRINIC sees fit” creates a second, discretionary channel. Outside parties may also report certain failures, including non-responsive or selectively responsive behaviour, which can cause AFRINIC to revalidate the contact. That turns validation design into the decisive institutional question.

An objective reachability test has a defensible scope. It can ask whether the address exists, whether the receiving system accepts an ordinary message, whether a verification token is returned through a specified method, and whether the result persists after reasonable retries. The registry can timestamp the test, classify a bounce, notify the holder, allow another authorised contact to correct the entry and preserve an audit trail. Each step concerns the accuracy of the registry’s own record.

Even this narrow test needs careful design. A temporary mail-provider outage, DNS error, full mailbox, greylisting rule, security gateway, spam filter, staff transition or mistyped update can look like a dead contact. An automated probe can resemble phishing. A crafted reply may fool a simplistic validator. A delayed response does not necessarily mean no human is monitoring the account, while a successful automated response does not prove that a capable human will investigate a real complaint. The validator must therefore say exactly what it measured and resist claims beyond that measurement.

The public record checked through 10 August 2026 did not disclose such an operating specification. It did not identify the sender used for checks, token design, retry logic, bounce categories, security controls, treatment of greylisting, or method for distinguishing receipt from human monitoring. It did not show how failures are communicated across multiple contacts, how an authorised holder can correct a false result, or how long correction normally takes. Without those facts, ratified intent cannot be presented as deployed capacity.

The line that a mailbox cannot cross

The policy text contains obligations that are not reducible to reachability. It says messages sent to the mailbox must require intervention by the recipient. It says the reporter must not have to complete a form. It expects the mailbox to receive reports along with logs, examples, headers or other supporting material. Its validation discussion reaches whether reports receive a response. These provisions reflect a recognisable frustration: a published address is not very useful if it leads only to a machine loop, rejects evidence, or directs every sender into a separate intake channel.

But usefulness does not decide institutional competence. A form may be an operator’s way of gathering essential facts, controlling spam, meeting privacy requirements, separating customers from outsiders or routing jurisdiction-specific complaints. An acknowledgement may be immediate while investigation takes weeks. A responsible operator may decline to discuss customer action with a reporter because of confidentiality, legal restrictions or the risk of tipping off an attacker. A report may be too vague to act on.

It may concern an address delegated to a customer, an old timestamp, a spoofed source, a compromised device or conduct that is lawful in the operator’s jurisdiction. “Response” cannot be treated as a universal, context-free measure of responsible handling.

NRS-hosted operator evidence makes the practical boundary explicit. Operators can act on sufficiently detailed, verifiable reports. That does not grant them lawful authority to monitor every user continuously or police content across jurisdictions. The same limitation applies more strongly to a number registry. AFRINIC does not become an abuse regulator because it publishes the address to which allegations are sent. It cannot determine the applicable law, allocate responsibility across a holder, network operator, downstream customer and end user, or dictate the substantive remedy.

Heng Lu’s analysis supplies the controlling division. The registry is a bookkeeper. Its useful contact rule is thin: record the correct role, publish it, test objective reachability, notify and correct. The thick version treats monitoring, response practice, discretionary validation or adverse consequence as a new jurisdiction created by the registry itself. That is an illegitimate conversion of recordkeeping leverage into operational authority. A ledger can describe an external relationship; it does not author the legitimacy of the network, the operator or the resource it records.

This is not an argument for an inert mailbox. Holders have commercial, contractual and often legal reasons to receive credible reports and address harm. It is an argument about who decides what those reasons require. Operators investigate within their technical role, customer contracts and applicable law. Public authorities and courts exercise powers granted to them. Reporters supply evidence. AFRINIC maintains number-resource records. The quality of the system depends on each actor performing its task without borrowing the authority of another.

A report is an input, not a verdict

The external revalidation channel sharpens the issue. If a security team receives a bounce from the published address, notifying AFRINIC may be the fastest way to correct the directory. A credible, reproducible delivery failure is evidence about the record. AFRINIC can retest using its own objective method. It can compare timestamps, account for temporary faults, notify authorised contacts and update a stale address. That is a proper feedback loop for public data.

A claim of selective or insufficient response is different. It may require access to the original message, evidence attachments, delivery logs, the recipient’s systems, the history of interaction and the operator’s reasons. A competitor or hostile actor can manufacture repeated complaints. Automated scanners can create noise. A reporter may confuse disagreement with silence or demand information that the operator cannot disclose. If the mere existence of such a report changes registry status, the complaint channel becomes a strategic control point rather than a data-quality input.

Safeguards must therefore precede reliance. A public operating rule should specify what evidence can trigger a recheck, what the recheck measures, how reporter identity and automated volume are handled, how confidential material is protected, and how the holder sees and answers the allegation. The resulting status should distinguish “delivery failed under the published test” from “a reporter alleges inadequate handling.” Only the former is a direct registry-data observation. The latter remains contested information unless determined by a body with the relevant jurisdiction and process.

BTW’s existing research on the path from complaint to administrative punishment is a warning against collapsing these stages. Allegation, verification, notice, correction and consequence are different events. For this policy, the crucial point is earlier in the chain: an external message may justify an objective revalidation of the mailbox, but it does not prove abuse, responsibility or misconduct. The merits of any Resource Services Agreement or revocation consequence are outside this article.

The strongest case for a mandatory rule

The contrary case should be stated at full strength. Abuse reports often begin with an IP address. Victims and incident responders need a predictable route to the network that may be able to help. Without a standard contact, they incur search costs, send notices to generic addresses, burden AFRINIC’s own service queues or give up. A voluntary field can remain sparse because each holder bears the maintenance cost while the benefits are distributed among outsiders and the wider network. Mandatory registration solves that collective-action problem. Periodic validation prevents a one-time entry from becoming permanent fiction.

Human monitoring makes the channel useful rather than decorative. Standardisation may also reduce confusion for operators working across regions.

The historical figures explain why proponents did not consider encouragement enough. The staff analysis reported 139,268 inetnum objects, of which 232 were protected by MNT-IRT, approximately 0.1666 percent. It reported 31,230 inet6num objects, with 33 protected, approximately 0.1057 percent. For 1,915 aut-num objects, 32 were protected, approximately 1.6710 percent. It also reported that 28 of 1,857 resource members had adopted the existing mechanism, approximately 1.5078 percent, and that 27 of 42 IRT objects were referenced, approximately 64.2857 percent. Those figures describe the prior mechanism at the time of the staff assessment. They demonstrate low recorded uptake in the measured categories; they do not demonstrate why each holder had not adopted it.

An AFRINIC-33 record separately referred to 1,738 resource members with ASNs in May 2021 as expected to provide abuse-c. That number cannot be subtracted from or trended against the 1,857-member figure because the dates, categories and source contexts differ. Neither historical denominator is a 2026 membership total. None is evidence of present compliance, bad faith, current mailbox failure or the success of a system that may or may not yet be deployed.

Properly bounded, the strongest case prevails. A mandatory, role-based contact field and predictable objective delivery checks are a proportionate response to a persistent directory failure. Voluntariness had not produced a sufficiently useful contact map. The holder receives value from accurate registration, and maintaining a reachable channel is a reasonable incident-readiness practice. The conclusion changes only when this valid kernel is used to carry claims it cannot support: that a registry can judge response substance, regulate operational conduct, or expand validation at will without a published constraint and correction architecture.

The right response is not to abandon the field. It is to separate the field’s functions. Presence, correct attachment, inheritance, deliverability, last-test date and authorised correction can be registry facts. Human investigation, evidentiary sufficiency, customer action, legal responsibility and outcome are not. A policy that displays that boundary would retain almost all of the contactability benefit while removing the most serious authority error.

From ratified text to operational systems

The staff impact analysis anticipated changes across WHOIS, MyAFRINIC, resource issuance and updates, sub-allocation and assignment forms, validation tools and the Number Resource Management Portal. That list shows the policy is not merely a sentence added to a manual. It affects public data, member accounts, application steps and the machinery by which resource records are created and changed. It also creates recurring operational work: sending tests, receiving results, escalating failures, managing exceptions and maintaining evidence.

The same assessment labelled the financial effect as no impact. That is a statement made by the assessment, not verification that implementation is costless. AFRINIC would need software changes, monitoring, support and dispute handling. Holders would need role mailboxes, resilient mail services, staffing, spam filtering, evidence intake, customer escalation and maintenance through organisational change. The burden is likely to differ sharply. A large operator may already maintain a round-the-clock abuse desk. A small network may rely on a few staff and an outsourced mail service.

A legacy holder may have old records and unclear account access. A new applicant may supply the field as part of an established onboarding process.

The policy allows phased implementation and changes to validation periods through a communicated slow start. That flexibility could reduce transition shocks and allow testing on small cohorts. It could also make the obligation difficult to understand if the current phase, object population, test method and exception rules are not published. Discretion is not inherently abusive; undisclosed discretion is hard to distinguish from inconsistency.

As of the evidence cutoff, the public material did not close the effective date, implementation circular, production release, current forms or validation procedure. It did not show how parent inheritance is applied in deployed records, how legacy resources are treated in practice, or whether new applicants face a different path from existing holders. It did not provide current denominators, coverage rates, validation outcomes, false-positive counts, correction performance or an independent review route. The proposal’s “ratified” label therefore answers only one question in a sequence. It says how AFRINIC classifies the policy.

It does not show which software is running, which holders have been contacted, what tests have occurred or what the results mean.

This distinction protects both supporters and critics from overclaiming. A supporter cannot cite the date as proof that the directory is now complete or abuse handling has improved. A critic cannot cite the broad text as proof that every discretionary possibility has already been used against a member. The operational claims remain open until implementation evidence exists.

Procedure, appeal and the unresolved merits

The proposal’s history matters because AFRINIC later described it as supported by documented consensus. Version 1 was submitted on 12 August 2018. AFRINIC-30 discussed the mandatory contact, validation and transition from the older mechanism in June 2019. AFRINIC-31 considered Draft 5 later that year and recorded the proposed fifteen-day validation and escalation periods, the six-month cycle and questions about consequences. Draft 7 arrived on 17 May 2021 with clarifications and flexibility for phased implementation. The AFRINIC-33 record noted that change and described the expected population of members with ASNs at that time.

The public record also contains challenges. A 2021 appeal disputed the confirmation of consensus and preserved objections concerning duplication, the undefined scope of abuse, operator policing, response compulsion, burden and reach. The appeal proves that those objections were raised. It does not, by itself, prove that the proposal was invalid. On 29 November 2021, the Appeal Committee set the challenge aside as inadmissible because the matter had not first been discussed with the chairs or policy group and because the supporters had not participated in the policy discussions. The committee said it did not need to reach the merits.

A second appeal in 2022 challenged the extended-last-call consensus determination. On 13 July 2022, the Appeal Committee again set the appeal aside for failure to show a prior effort to resolve the matter with the chairs or policy group. Again, it said there was no need to delve into the merits. These dispositions can establish procedural closure within the committee’s stated rules. They cannot be recast as findings that the substantive scope objections were examined and rejected. Conversely, the absence of a merits decision does not establish that every objection was correct or legally decisive.

That separation is especially important because the best objection does not deny the entire proposal. It accepts the contactability problem and the legitimacy of a mandatory field. It challenges the move from record accuracy to response supervision. A process can end while that conceptual objection remains unanswered. Board ratification can complete an internal step while still leaving the authority boundary available for public analysis.

The impact mechanism for operators and relying parties

The first-order benefit is lower search and coordination cost. A security team can use a standard resource lookup, find a role mailbox and send evidence without guessing among corporate contacts. A holder can receive credible notices sooner. AFRINIC’s support staff may face fewer requests asking where a report should go. A timestamped delivery status can help everyone distinguish a current contact from a visibly stale one.

The first-order costs are also concrete. The holder must maintain a mail service that can accept unpredictable volume and potentially large evidence attachments. It must defend the address against spam, phishing, malware and harassment while ensuring those defences do not cause a validation failure. It may need to triage multiple jurisdictions and distinguish reports about its own infrastructure from reports about customers or delegated networks. Unrestricted publication improves discoverability but increases exposure. Role addresses and data minimisation can reduce unnecessary personal risk, but they do not eliminate operational cost.

The dangerous transmission begins when a limited technical result becomes an ambiguous status. A bounced validation email may arise from a transient fault. If the status is read only as “this address did not accept this test at this time,” the problem is correctable. If it is read as “this holder ignores abuse,” the status becomes a reputational claim. If other registry services or counterparties rely on it, the claim can affect transactions, support, customer confidence and continuity.

LARUS analysis identifies this registry-layer chain: an error or discretionary action in an operator-critical record can propagate into asset value and business dependency even when the original data fault is small. No quantified loss from this particular policy is established, but the mechanism is credible.

BTW’s prior research on abuse-contact economics and public registration records reinforces two limits. First, the cost of a rule is not only the price of creating a mailbox; it includes human monitoring, evidence intake, false positives, escalation and reputational exposure. Second, a public record is consumed by parties far beyond the registry-member relationship. Its fields can be treated as signals of identity, control or risk. That makes semantics a form of governance. A validation label must be narrow enough that a relying party cannot reasonably mistake technical reachability for a verdict on the network.

The role-aware problem is especially acute in leased, suballocated or delegated networks. The name associated with a resource may not be the actor controlling every packet. A parent contact may be a useful escalation route without being the first responder for every child object. The policy’s inheritance option can improve coverage, but it can also funnel reports to a party with limited operational knowledge. A better contact model would distinguish holder, operator, downstream customer and authorised proxy where the record can do so reliably.

It would preserve multiple escalation routes without turning the first listed name into presumed liability.

What can responsibly be concluded now

The reported ratification is significant because it converts a long-running proposal from debate into AFRINIC’s declared policy status. The exact text creates a mandatory contact field, broad public availability, recurring validation, escalation and a systems-change agenda. It reaches members, legacy holders and applicants according to AFRINIC’s overview. Its potential benefit is genuine: a common and maintained contact can improve the routing of incident evidence.

The same record requires restraint. Official AFRINIC material proves AFRINIC’s acts, texts and assertions. It does not independently prove sovereign authority, universal representation, implementation success or the lawfulness of a consequence. The appeals document procedural challenges and procedural dispositions, not a merits judgment. The historical counts show sparse use of an earlier mechanism, not current non-compliance. The policy text describes intended validation, not the algorithm or performance of a deployed service.

The bookkeeper boundary gives the most practical test. AFRINIC may require a field, preserve the relationship between resource and contact, publish the address, test objective reachability, date the result, notify authorised parties and support correction. It may accept outside evidence that the record could be stale, provided it independently rechecks the record. It may not infer wrongdoing from silence, decide whether an operator’s investigation was sufficient, dictate an outcome, or convert its internal status into public power.

Until implementation evidence appears, confidence should attach to the announced act and published text, not to unobserved results. A defensible system would publish what was tested, when, with what retry logic; distinguish delivery from response; record corrections and overturned flags; protect role contacts from unnecessary exposure; and provide review independent enough to correct the registry itself. The success measure is not the number of compliance labels produced.

It is whether more public records are accurate and reachable, fewer legitimate reports are misdirected, and false states are corrected quickly without governing conduct beyond the ledger.