Summary

  • ICANN reports that 87.5% of more than 70 completed DNS-abuse remediation plans had shown no indicator of recurrence by its 15 October update. The figure describes plans, not all investigations or domains.
  • ICANN monitors new complaints, test reports and response times after a case's initial abuse is stopped, but has not published each plan's follow-up duration or the exact count behind the percentage.

The first fix to a malicious domain is not the end of a compliance case. ICANN says it can keep an investigation open for months to see whether a registrar or registry has repaired the process that let abuse persist. That is the right question. The published score, though, has no clock attached.

In its 15 October compliance update, ICANN says contracted parties completed more than 70 DNS-abuse remediation plans between 5 April 2024 and 5 August 2026. Of those completed plans, 87.5% had shown no indicator of recurrence to date. The remainder received expedited compliance action, including breach notices and possible termination. ICANN describes reviewing new complaints, filing test reports, checking response and mitigation times, and considering other data before closing a matter. The update does not give the number of completed plans exactly, when each began monitoring, how long each stayed under observation, or the case-level test for recurrence.

Those missing fields change what the percentage can tell an operator. A plan completed late in the period has had less time to fail than one completed near the start. Both are counted as clean if no indicator had appeared when ICANN reported the result. A reader cannot separate a short clean interval from a lasting improvement. Nor can the reader reconstruct 87.5% from “more than 70” plans. One decimal place looks precise; the public denominator is not.

ICANN's other counts answer different questions. It says it opened more than 650 investigations with contracted parties during the period; more than 570 were resolved. Of the resolved matters, about 66% led to action to stop the abuse, 8% to disrupt it, and 21% to a documented finding of no actionable evidence. ICANN issued eight Notices of Breach and terminated one registrar accreditation for failing DNS-abuse mitigation requirements. These are investigation outcomes and enforcement steps, not the recurrence rate for plans. The 2024 registrar contract amendment requires prompt, appropriate action on actionable evidence to stop or disrupt abuse; it does not require every reported name to be suspended.

The publication rule narrows what outsiders can check. ICANN says plans may be made in informal or formal compliance stages, but only formal-stage plans are public. It does not state what fraction of completed plans is public. Its rolling DNS-abuse trend reports track complaints and enforcement over twelve-month windows; they are not a plan-by-plan recurrence ledger. A privacy-safe table of plan start dates, observation windows, recurrence criteria and current status would make the 87.5% claim testable without exposing abuse victims or confidential case files. ICANN has not supplied that table in the cited update.