Summary

  • The RIPE NCC's abuse-contact regime validates deliverability, not responsiveness: the automated check never sends an email and never tests whether a human reads or acts on abuse reports.
  • Independent academic measurement found that 85.9%–92.8% of registry and WHOIS abuse contacts received no reply even when the addresses were deliverable — the only non-operator evidence of the functional gap.
  • The documented last-resort sanction — membership closure and resource deregistration over an invalid abuse contact — has never publicly fired; in 2025 the RIPE NCC ran 2,320 abuse-c validation investigations and validated 86,959 addresses, while documented closures were overwhelmingly for non-payment.
  • The only policy proposal that would have required mailboxes to actually receive messages was withdrawn on 8 September 2020 for lack of consensus, after operators argued the cost outweighed the benefit.

A control that measures the wrong thing

When a network user in Europe, the Middle East or Central Asia reports spam, phishing or another abuse originating from RIPE-region address space, the RIPE NCC's own guidance routes the complaint to the abuse-c mailbox of the responsible network operator, and states plainly that the registry cannot compel an operator to reply (RIPE NCC abuse support, abuse-c information). The obligation to respond rests with the operator. What the registry can do is defined by policy — and the policy, as this investigation traces from the primary records, was designed to verify the pipe, not the person at the end of it.

The mechanism dates from RIPE-563 in 2012, which introduced the mandatory abuse-c attribute and required role objects to carry a single abuse-mailbox attribute intended for receiving automated and manual abuse reports — but contained no validation of the abuse-c information at all (RIPE-563, policy proposal 2017-02). For six years the address on record was, functionally, a string in a database.

What the 2017 reform actually validates

Policy proposal 2017-02, accepted on 1 June 2018 and implemented on 10 October 2019 as RIPE-705, gave the RIPE NCC a mandate to validate the abuse-mailbox attribute at least annually (RIPE-705). The impact analysis is explicit about the method: a verification tool checks formatting, DNS entries and mail-server configuration, uses ping to confirm the mailbox exists, and — in the RIPE NCC's own words — "does not send any emails and won't require any action on the part of the abuse contact." In the pre-implementation analysis, roughly 70,000 distinct abuse-mailbox attributes existed in the RIPE Database, and a preliminary batch test suggested 10%–25% might be incorrect or inactive (2017-02). Over the preceding five years the RIPE NCC had investigated more than 1,000 external reports of incorrect abuse-mailbox attributes without ever triggering closure or deregistration, which the proposal frames as a last resort with a further three months to remedy.

The rollout numbers quantify the gap between the check and the function. Per the RIPE Labs implementation record, about 9,500 abuse contacts were updated out of about 67,000 checked — roughly 14% — with around 60% of cases resolved through the automated process and no members closed for uncooperativeness (RIPE Labs). At RIPE 79 the RIPE NCC reported 93% passing the automated check (RIPE 79 presentation). Each figure measures a different slice of the same question, and none of them measures what a complainant experiences.

The reform that failed, and why

The one attempt to close the functional gap is instructive. Policy proposal 2019-04 would have required the abuse-mailbox to actually receive messages — automated or manual — and prohibited forcing reporters through web forms, with validation at least every six months. It was withdrawn on 8 September 2020 after failing to reach consensus; the proposer's appeal was later upheld on procedural grounds on 26 October 2020 (2019-04 proposal, withdrawal notice, co-chair decision, archived proposals). In the review phase no messages of support were received. Opponents, including Nick Hilliard and Erik Bais, argued the effort and cost outweighed the alleged benefits; the RIPE NCC estimated the added workload at roughly ten times current levels, with three additional temporary staff already needed in 2019 for the initial validation.

The proposal's own text records the contradiction at the heart of the regime: 92.5% of abuse-mailbox addresses passed the automated check, yet the proposal argued that some resource holders may use non-responsive or fake mailboxes, making the contact ineffective for reporting abuse. The community chose cheap, verifiable compliance over receipt-testing.

What independent measurement shows

The only non-operator evidence on functional responsiveness comes from academic measurement. A 2016 USENIX Security study by ICIR researchers and a 2017 WEIS study by Cetin et al. found that 85.9%–92.8% of registry and WHOIS abuse contacts received no reply even when the addresses were deliverable (USENIX Security 2016, WEIS 2017). These studies predate the RIPE rollout and cover more than the RIPE region, so they cannot be read as a current RIPE-specific statistic. But they are the only non-operator measurements available, and they point one direction: deliverability and reply are different properties, and the registry validates only the first.

The 2025 annual record shows the scale of the measured surface: 2,320 abuse-c validation investigations and 86,959 validated email addresses, against 172 documented member closures — overwhelmingly for non-payment — and none attributed to invalid abuse-c (annual reports, RIPE-855). RIPE-858, the closure and deregistration procedure, was revised on 7 May 2026 to move notifications to email (RIPE-858).

What the record supports

Three layers must be kept distinct. Control design: RIPE-705 mandates an annual automated technical check of deliverability only. Control exercise: in 2025 the RIPE NCC ran 2,320 investigations and validated 86,959 addresses, closing no member over an invalid abuse contact. Functional outcome: independent studies found 85.9%–92.8% of abuse contacts receive no reply even when deliverable, and the RIPE NCC itself states it cannot compel an operator to respond.

Accountability attaches to the gap between exercise and outcome, and to the collective decision in 2020 to prefer cheap compliance over receipt-testing — not to any allegation of intent. The regime is not a failure of diligence; it is a documented design choice, made visible by the 2019-04 withdrawal, that a mailbox which exists is the standard a member must meet. Whether that standard protects anyone who clicks "report abuse" is a question no party in the record is currently measuring.