Summary

  • AFRINIC’s reference manual says notify is an optional email attribute used for normal notifications when a database object is updated.
  • The mailbox does not by itself identify an operator, abuse contact, maintainer, BGP origin, owner or responsive human.

A delivery address for a database event

The useful verb is “notify”. AFRINIC’s reference manual says a normal notification is sent when an object containing the attribute is updated. For an existing object, the address in the old version is used; for a new object, the address in the new version is used. That detail shows the field’s design: it is part of the database update workflow, not a declaration of responsibility for everything represented by the object.

The field is optional and can appear more than once. AFRINIC also exposes an inverse lookup that finds objects whose notify value matches an email address. An analyst can therefore use it to map where change notices were configured to go at the time of observation. The result remains a registry fact about notification routing.

Nearby fields do different jobs

AFRINIC documents notify separately from mnt-nfy. The latter belongs to the maintainer-based notification path when a maintained object changes. It also separates both from mnt-by, which names a maintainer involved in update protection and authorisation. The public query interface lists abuse-mailbox, admin-c, tech-c, origin and mnt-routes as distinct inverse-search keys.

Those separations are not cosmetic. A mailbox that receives a change notice has not thereby authorised the change. A notification recipient is not automatically the maintainer. It is not automatically the technical contact, administrative contact or abuse desk. Even if one organisation happens to fill several roles, each role must be established from the appropriate field and fresh evidence.

What the address cannot prove

The attribute says nothing about whether anyone reads or answers the mailbox. It does not prove control over routers, credentials or address use. It does not show who originates a prefix, who supplies transit, whether the network is reachable, or who owns the resource. A database change is also not necessarily a network-state change: contact text can change while routing remains stable, and routing can change without a Whois edit.

For incident response, use the contact surface designed for the incident and test it. For update authority, inspect the maintainer and authentication chain. For routing, use time-aligned BGP observations, route-registration data and RPKI where relevant. For ownership or corporate affiliation, use legal and corporate records. notify may provide a lead, but it cannot replace those sources.

A defensible statement

Preserve the object key, exact notify value, query method and retrieval time. Then state: “At the observed time, this AFRINIC Whois object configured this mailbox to receive database-change notifications.” Record separately whether delivery was tested, whether a response arrived, and which other fields identify contacts or maintainers.

That phrasing is intentionally narrow. It respects what the registry publishes and prevents a convenient email address from becoming an unsupported attribution of network conduct.

Sources