Summary

  • Prop-173 proposes a separate acceptable-use policy for ordinary WHOIS, RDAP, web and equivalent API queries; it remains under mailing-list discussion and has not been adopted.
  • The proposal would expressly permit low-volume operational and technical-research use while restricting harvesting, marketing, geolocation inference, resale and construction of substitute directory services.
  • Its durable governance test is whether APNIC can apply automated rate controls and access restrictions without making legitimate operators and researchers guess where the boundary lies or how to challenge an error.

A single directory lookup is easy to describe. The harder questions begin when the result is cached, combined with other answers, used inside a security product or requested repeatedly by an automated system. At what point does ordinary operational use become systematic harvesting? When does a useful cache become a substitute database? Which restrictions protect the directory and the people represented in it, and which merely make legitimate network work harder?

Prop-173-v001 tries to turn those questions into a public operating bargain. APNIC records that Jonathan Brewer posted version 1 to the Policy SIG mailing list on 17 August 2026. At this article's reporting freeze on 3 September, the proposal remained listed for mailing-list discussion. It was not adopted or implemented, and APNIC listed no Secretariat impact assessment.

The gap sits between a lookup and a dataset

APNIC already publishes an acceptable-use agreement for bulk Whois data. That agreement limits reproduction and onward transfer, rules out marketing and demographic or geolocation uses, and frames approved purposes around Internet operations, troubleshooting, abuse reporting and research. Prop-173 argues that ordinary users of WHOIS, RDAP and web searches do not have a separate, clearly scoped policy explaining how comparable principles apply outside the bulk-access process.

The proposed answer covers any person or system accessing APNIC-authoritative directory data through WHOIS, RDAP, web search or an equivalent registration-data API. Data mirrored or referred from another registry would remain governed by its authoritative source. High-volume access, significant extracts, mirrors and substitute databases would stay outside the ordinary-query policy and require the separately governed bulk route.

That separation is more useful than a blanket distinction between commercial and non-commercial users. Version 1 says a commercial network operator or security provider would not be prohibited merely because it operates commercially. The line is whether directory data itself is resold, republished or turned into a separate commercial product.

Permission and prohibition are designed together

The permitted-use list is broad enough to cover the work for which public registration data exists: routing-policy analysis, network troubleshooting, resource-holder identification, accurate registration, reverse DNS, abuse and incident response, technical research, lawful registration disputes and valid official requests.

The prohibited-use list targets a different set of incentives. It names advertising, lead generation, contact-list compilation, harassment, surveillance, demographic profiling, geolocation inference, resale, commercial enrichment services, systematic harvesting and attempts to evade rate limits. Reproduction and persistent storage of a substantial part of the database would require permission unless necessary for a permitted operational or research purpose. Limited temporary caching could be allowed, with future retention, refresh, security and deletion requirements.

Those are proposed rules, not current findings that particular users have caused harm. The comparisons with RIPE NCC, ARIN, LACNIC and AFRINIC are also the proposer's account in version 1; this article does not treat them as an independent audit of other registries' law or practice.

Enforcement needs an intelligible review path

Prop-173 would allow APNIC to warn, throttle, suspend, block or terminate access when it reasonably believes a user has breached the policy. Enforcement could be automated. Repeated or deliberate circumvention could lead to long-term or permanent denial of ordinary query access.

The same text calls for general principles explaining excessive querying, a way for a blocked user to identify the reason, a contact or review process, and a route to approved high-volume or bulk access. APNIC would not have to publish thresholds when disclosure would materially help evasion or threaten security.

This is the proposal's central trade-off. Exact thresholds can become an evasion manual, but an entirely opaque restriction can interrupt legitimate incident response, routing analysis or research. A review mechanism is therefore not decorative due process. It is the feedback loop that tells APNIC whether its controls are separating harmful extraction from the uses the policy expressly permits.

Sources