Summary

  • ICANN says a DNS-abuse investigation may continue for months after the reported activity on a domain is mitigated, so the compliance question can outlast the incident.
  • Its latest update reports more than 70 completed remediation plans and says 87.5% had shown no recurrence indicators to date, but it gives no plan-by-plan monitoring period or indicator definition.

The first fix is not the closeout test

ICANN Contractual Compliance’s 15 October update draws a line between stopping reported activity and resolving the compliance issue behind it. A complaint may concern one domain, the post says, while an investigation can expose broader weaknesses in a registrar’s or registry operator’s processes, tools or expertise. ICANN says it may keep the relevant case open for months after the reported activity is mitigated.

The follow-up is not described as ICANN prescribing a standard repair. Contracted parties propose measures intended to address identified root causes. Those measures may involve procedures, systems, staff training, monitoring tools or reseller oversight. ICANN says it reviews the proposals, monitors implementation and tests whether the measures work over time.

The update covers 5 April 2024 through 5 August 2026. ICANN says it opened more than 650 investigations with contracted parties and resolved more than 570. Of resolved matters, about 66% resulted in action to stop abuse and 8% in action to disrupt it. In 21%, the contracted party found no actionable evidence, explained its conclusion and supplied evidence. The figures are rounded; ICANN does not give exact counts or explain the remainder, so they should not be converted into case totals.

Contracted parties completed more than 70 DNS Abuse remediation plans, with additional plans in development. ICANN reports eight Notices of Breach and termination of one registrar’s accreditation for failing to meet mitigation requirements. The update does not identify that registrar in the metrics passage, so the termination should not be attached to a separate named case without evidence.

The headline follow-up figure has a limit. Of the more than 70 completed plans, ICANN says 87.5% had shown no indicators of recurrence “to date.” It does not publish each plan’s observation period, define the recurrence indicators in the post or provide case-level evidence. “To date” therefore describes the reporting cutoff, not proof that recurrence is impossible or that all plans have been observed for the same length of time.

Visibility is narrower still: ICANN says only plans from its formal process are public, and that process accounts for a smaller share of overall Contractual Compliance matters. The published plans cannot be assumed to represent every investigation or every outcome.

A contractual enforcement boundary

ICANN’s 2024 advisory locates these duties in the Registrar Accreditation Agreement and the base gTLD Registry Agreement. Registrars and registry operators have distinct obligations; ICANN enforces the agreements and incorporated policies. That is a defined contractual role, not general authority over every actor or every harmful item of online content. The advisory also says the appropriate actor and response depend on circumstances, including the evidence, the party’s role and potential collateral harm.

The June 2026 update covered an earlier period, through 5 April 2026, and used rounded figures of nearly 530 investigations launched and more than 480 resolved. Comparing those rounded totals with the October figures would not reveal an exact two-month increment. The later post is useful as a description of the continuing enforcement approach, not as a clean basis for calculating a trend.

ICANN says it is developing a proactive enforcement framework to complement complaints and audits. The post describes that framework as in development; it does not announce a final framework or a new rule.

Sources