Summary

  • APNIC’s prop-171 would require an upstream holder to maintain a reliable path from a registered abuse or IRT contact to the downstream party able to investigate and resolve a report.
  • The proposal deliberately preserves several operating models and does not create a new audit, compliance or enforcement mechanism.
  • The unresolved question for the 10 September APNIC 62 discussion is what evidence will distinguish a reliable handoff from a mailbox that merely passes periodic validation.

A mailbox can be alive and an abuse-reporting chain can still be dead. A validation message proves that an address receives mail at a particular moment. It does not prove that a report about downstream-used address space reaches the team with the logs, customer relationship and authority to investigate.

That distinction is the subject of prop-171, posted to APNIC’s Policy SIG on 10 August and listed for discussion at the APNIC 62 Open Policy Meeting on 10 September. The proposal does not define abuse or direct an operator to reach a particular verdict. It addresses the path between intake and action.

Reachability is only the first control

The proposal begins from an existing APNIC rule. Resource records must carry an Incident Response Team object, and registered abuse contacts are validated as reachable at least once every six months. That control reduces stale or plainly broken contact data. It does not show what happens after a message arrives.

In a simple arrangement, the registered contact and the operating team may be the same organization. Sub-allocation makes the chain harder to see. The public record may lead to an upstream provider or central administrative desk while the network, customer account and relevant logs sit downstream. A legitimate report can therefore reach a valid mailbox and still lose time in identification, forwarding or ownership disputes.

Prop-171 would place responsibility for that seam on the upstream holder responsible for the registry record. It allows the downstream organization to operate the registered contact directly. It also allows a centralized upstream desk, provided that desk can identify the responsible downstream party and forward reports reliably. A third arrangement is permitted if legitimate reports reach the party able to act without undue delay.

This flexibility matters. A regional policy should not assume that every provider, NIR, enterprise and multi-tier reseller uses the same abuse-desk design. The proposal also says it would not require publication of every downstream customer contact. Accountability can improve without turning a registry record into a customer directory.

The proposed duty is not yet measurable

The strongest phrase in the text is also its largest unfinished part: “reliable operational path.” Version 1 does not define a delivery-time target, acknowledgement, retained routing evidence, sample test, failure threshold or exception process. It says the Secretariat would develop operational guidance after adoption in consultation with the community.

The proposal asserts that a significant share of certain reports received by APNIC concerns sub-allocated space where the registered and responsible parties differ. The packet published for this discussion gives no count, denominator, time period or method. That does not make the problem imaginary. It means the community cannot yet use the claim as a baseline against which to judge improvement.

The boundaries are equally important. Prop-171 would not change the six-month validation timetable. It would not create a new audit or compliance mechanism, change the Whois schema, or give APNIC a new investigative or enforcement role. Its official page had no Secretariat impact assessment at the time this briefing’s evidence was frozen. The policy is a proposal, not an adopted obligation.

Those limits protect against mandate expansion, but they leave a practical risk. If no one can observe whether reports complete the handoff, different upstream holders may all describe unlike processes as reliable. The rule could then improve policy language without reducing the dead ends that motivated it.

A small evidence contract can preserve flexibility

The APNIC 62 discussion does not need to prescribe one ticketing platform or expose complainants and customers. It can ask the later guidance to define a minimum operational record.

That record could name the owner of the registered intake, the method used to identify the responsible downstream party, the point at which receipt is acknowledged, the evidence retained when forwarding fails, and the route for exceptions when the downstream organization is unreachable. Periodic synthetic reports or privacy-preserving samples could test delivery without asking APNIC to adjudicate the allegation inside each report.

Aggregate results would be more useful than a public league table. APNIC could publish how many sampled paths completed, where handoffs failed by tier, how long unresolved forwarding remained open and when the guidance would be reviewed. No customer identity or incident content needs to appear in that account.

The policy choice is therefore narrower than “more enforcement” versus “no responsibility.” Prop-171 separates reception from operational delivery and assigns the seam to an upstream holder. The next step is to make completion observable. A working mailbox is a necessary endpoint. A working handoff is the service.

Sources