Summary

  • APNIC requires IRT references when inetnum, inet6num and aut-num objects are created or updated, directing incident reports to a specialized contact surface.
  • The reference proves a registry association at the observation time. It does not prove router control, live BGP origin, traffic carriage, service availability, culpability or ownership.

A mandatory pointer with a bounded job

APNIC introduced mandatory Incident Response Team references in November 2010. The policy was meant to stop abuse reports from disappearing into general administrative or technical mailboxes. A resource record therefore carries mnt-irt, and the linked IRT object contains an abuse-mailbox alongside administrative, technical, authentication and maintenance attributes.

The design matters because it creates a discoverable escalation path. It tells an investigator which registry object APNIC associated with incident response for that resource. Since 2019, APNIC policy has also required IRT contacts to be validated every six months. Invalid or unresponsive contacts can be reported for correction. The record therefore carries both an identified contact association and a time-bounded validation state.

They do not expand the field's meaning. APNIC itself describes IRTs as abuse-handling or computer-security incident-response teams distinct from network operational departments. The database pointer identifies the incident-response contact object; it does not identify the network operational department or establish a relationship between those two functions.

abuse-c is a projection, not a second witness

APNIC also publishes abuse-c on resource records. Its service documentation says the attribute points to a role object containing the same contact information visible in the member's IRT object; changes must be made through the IRT because abuse-c is generated from it.

That lineage prevents a common analytical mistake. Seeing both mnt-irt and abuse-c is not independent corroboration by two sources. They are two views of one contact model. Agreement between them confirms that the projection is internally consistent, not that the mailbox controls the network or that its holder accepted responsibility for a particular event.

The same caution applies to validation. A validation record is evidence that the registry's contact-check process succeeded at a stated time. It is not a perpetual guarantee that a human will read, understand and act on every later report. Current responsiveness requires a current test, with delivery outcome and response time recorded separately.

Nearby fields preserve different powers

The inetnum guide separates admin-c, tech-c, abuse-c, mnt-by, mnt-irt and mnt-routes. mnt-by protects updates to the database object. mnt-routes controls who may create associated route objects. tech-c identifies a technical-contact function. None of those facts is an observation of packets crossing a router.

For routing, analysts need time-aligned BGP observations. For route authorization, they need the applicable IRR and RPKI evidence. For service availability, they need active measurements. For legal or beneficial ownership, they need corporate and legal records. The APNIC contact pointer can start an investigation, but it cannot substitute for these other evidence planes.

National Internet Registry boundaries add another step. APNIC warns that some searches refer the investigator to an NIR, whose database may be needed to identify the relevant ISP. A referral is therefore a routing instruction for the inquiry, not proof that APNIC or the NIR operates the referenced network.

A defensible reading

Preserve the queried resource, the exact mnt-irt value, the linked IRT and abuse-c objects, the source database and the retrieval time. Then write: “At the observation time, this APNIC resource record referenced this IRT object as its incident-response contact path.”

Record separately whether the mailbox was tested, whether it replied, which organisation operates the network, which ASN originated the prefix, who could change route objects, and who legally holds the resource. Keeping those columns separate makes the registry data more valuable: it remains precise evidence instead of becoming an unsupported attribution.

Sources