Summary

  • Prop-174 version 1 was posted to APNIC’s Policy SIG mailing list on 17 August 2026; it has not been adopted, endorsed or implemented, and no Secretariat impact assessment is shown.
  • The proposal would require a working abuse mailbox, including for automated reports, and an appropriate review, triage or escalation process rather than systematic rejection.
  • Validating a contact channel is not adjudicating an abuse allegation; any path toward resource consequences needs joined evidence, notice, cure, proportionality and review.

An automated abuse report passes through several distinct states. A receiving server accepts or rejects it. Filters inspect size, malware and sending patterns. A team decides whether it is legitimate, routes it to someone able to act and sends a response. None of those events, alone, proves the underlying allegation. Prop-174 matters because it would make parts of that operational chain explicit policy obligations.

APNIC lists version 1 as published to the Policy SIG mailing list on 17 August. The record does not show consensus, endorsement, implementation, an APNIC 62 agenda slot or a Secretariat impact assessment. The downloaded text also carries a prop-173 heading despite being served as prop-174. That is a source-label inconsistency, not evidence that the two proposals are the same.

From reachable address to review process

The draft says each resource must have an IRT object with monitored contacts, validated at least every six months. It would specify that the abuse mailbox must receive email, including automated reports, and that reports must enter an appropriate review, triage or escalation process. A web form may supplement the mailbox but may not replace it.

The text permits ordinary anti-spam, anti-malware, size and rate controls. Its boundary is systematic prevention of legitimate reports. That distinction is sensible but evidentially demanding: a rejected malicious attachment, an oversized message and a deliberately blocked report can look alike without preserved delivery and filtering records.

The proposal connects failed validation to a graduated sequence: a 15-day completion period, an invalid marker, MyAPNIC limitations after 30 days, notice and time to remedy, and potentially later referral under Membership Agreement breach provisions. It says further action may include resource revocation. No such action has occurred under prop-174, which remains only a mailing-list proposal.

Contact compliance is not abuse adjudication

APNIC can establish whether a mailbox exists, accepts ordinary messages and completes periodic validation. It can also record whether a holder responded. Those are registry-contact facts. They do not establish whether reported conduct occurred, who caused it, whether the holder controlled it or what remedy is justified.

The proposal acknowledges an audit problem: monitoring and human-review duties are hard to test proactively and may be enforced mainly through complaints. A defensible process therefore needs a joined record of the submitted message, delivery result, filter reason, triage event, response, validation request, notice and cure opportunity. Otherwise a complaint about abuse can silently become evidence of contact failure, and contact failure can silently become evidence of abuse.

APNIC’s earlier prop-125 reached consensus in 2018 and was implemented in 2019. Later, APNIC generated an abuse-c field from the corresponding IRT object. Prop-174’s stated purpose is to align policy text with such practices and consolidate obligations. That history explains the proposal; it does not settle its remaining proof and review questions.

Sources