Summary

  • Matteo Liberato told RIPE 93 that .kids had not lived up to its child-safety purpose. In the Q&A, he described a broken reporting route and a one-domain-at-a-time form that made a larger batch of notices impractical.
  • ICANN’s June 2026 .kids transaction file counts 7,176 registered names. Its public monthly archive does not show the threat counts or actions the registry contract says must be recorded and supplied to ICANN on request.

Analysis

A registry can count every name in its zone and still leave the central question unanswered: what happened when a name broke the rules?

That question followed Matteo Liberato into the RIPE 93 Security session on 27 October. The University of Twente researcher presented a study of .kids covering May 2022 through March 2026. His conclusion, as recorded in the official transcript, was blunt: the namespace had not delivered on its safety mandate. He came back to enforcement in the questions, where the abstract policy met a web form.

Liberato said he had found an abuse-reporting route that did not work and raised it with DotKids Foundation, the registry operator. He said the Foundation told him one route had been restored, while another path remained unusable. The form asked for a domain, a screenshot and an explanation one name at a time. Liberato said he had asked for a way to submit a larger set of reports; the answer he relayed at RIPE was that a bulk system was being worked on. Those are his remarks in the meeting transcript, not an independently published case log.

The contract makes the operating duty unusually concrete. ICANN’s .kids Registry Agreement requires periodic technical analysis for security threats and statistical reports on the threats found and actions taken. The operator must keep those reports for the agreement term and provide them to ICANN upon request. The same specification says the registry must publish clear registration policies. That policy-publication promise does not say the threat-and-action statistics must be public.

ICANN’s public .kids archive offers monthly transactions and activity reports, withheld until three months after the month they cover. The June 2026 transaction CSV lists 7,176 total domains. In June 2023 it listed 3,785: a gain of 3,391, or about 89.6%. That is a registration count. It says nothing by itself about active use, child suitability or enforcement.

The file is built to answer a different question. It breaks activity down by registrar and records additions, renewals, transfers, deletions, restores and attempted adds. It has no column for a security threat, an abuse report, a policy decision or the time between detection and action. A public reader can watch the namespace grow. The public file cannot show whether the safety machinery kept pace.

That gap is narrower than an accusation and more useful than one. The contract says the records exist inside the operator’s process and can be requested by ICANN. The public archive reviewed here does not provide an outcome series. It therefore cannot establish whether the operator completed its checks or whether ICANN requested and received the required records. It can establish that ordinary readers cannot inspect those outcomes in the monthly reports.

That matters because the name itself carries the promise. A parent or school cannot infer protection from the letters before the dot. The registry’s checks, reporting channel and follow-through are the work. Liberato’s presentation put that implementation question on the meeting agenda; the public ICANN table still puts domain totals in the brightest type.

A useful public record would not expose children, registrants or investigative details. It could publish monthly totals by threat category, reports received, cases assessed, actions taken, time to resolution and unresolved backlog, with small groups and personal data suppressed. That would let readers test performance without turning abuse reports into public dossiers.

The required record that would sharpen this finding is specific: an attributable, anonymised series of threat findings and resulting actions, or a public ICANN record showing where those results are already reported. Until then, a rising .kids count remains a count of registrations—not evidence that the safety promise is working.

Sources