Summary

  • ICANN’s working group proposes requiring a registrar to check for associated domains after it has actionable evidence that one sponsored domain is being used for defined DNS abuse. The proposal calls for an investigation, not automatic punishment of every connected name.
  • Forty-two public submissions produced 533 categorized responses, about 85% supportive across the proposal’s 13 outputs. Those responses inform the next policy stage; they are not a final rule or a vote by all registrants and Internet users.

The move beyond one name at a time

The existing Registrar Accreditation Agreement gives a registrar a duty to act when it has actionable evidence that a domain it sponsors is being used for DNS abuse. The agreement requires appropriate, prompt mitigation, taking account of the harm and possible collateral damage. ICANN’s 2024 DNS Abuse advisory explains how that obligation works in practice; the agreement’s global amendment defines DNS abuse as malware, botnets, phishing, pharming and spam when spam delivers one of those other forms.

That duty is tied to the name for which the evidence exists. A campaign, however, may use a portfolio: one domain can be reported, while other names associated with the same actor remain unexamined. The GNSO working group’s 18 August initial report proposes a new Associated Domain Check (ADC) to address that gap. After a registrar has actionable evidence that a sponsored name is being used for DNS abuse, it would have to investigate whether associated names in its own portfolio are also used for abuse.

The distinction between a check and an enforcement action is central. A link can tell a registrar where to look; it cannot settle what the next name is doing. The draft requires a reasonable investigation to determine whether associated names are being used for abuse. It does not say that a name should be suspended merely because it shares an account, registrant field, nameserver or reseller with a triggering name. Nor does it require a cross-registrar search or a central database of every registrant’s domains.

This is a proposal, not a change already imposed on registrars. The public-comment page was updated with a summary report dated 9 October. It says the working group had not adopted changes from the comments and would begin reviewing them at ICANN87 in Bali. The group must still produce a final report; the GNSO Council must consider it; and the ICANN Board would have to consider adoption before a new Consensus Policy could take effect. ICANN’s own description of its policy-development process makes those separate decision stages explicit.

Association is a hypothesis to test

The draft does not prescribe one universal identity test. Its proposed criteria include registrant or account information, signals of technical or coordinated activity, registration patterns, nameserver sharing and information reasonably available to the registrar. It recognizes that indicators differ by case, and that no single data point will determine association in every instance. The investigation is meant to be practical and proportionate to the evidence and the apparent scale of the abuse.

That flexibility reflects an operational problem. Some campaigns are coordinated across many names; others can resemble coordination because unrelated customers use the same hosting, privacy service, reseller or shared infrastructure. A common attribute may be a useful lead, but it may also be common to legitimate users. Even two domains registered through one account do not, on their own, establish that both are being used for malicious activity.

The trigger is narrower than an allegation. Recommendation 1 uses actionable evidence under the existing agreement, and excludes compromised domains from the ADC trigger. The report distinguishes a name registered for abusive use from a legitimate name later taken over or exploited without the holder’s knowledge or consent. Its guidance allows evidence of recent, intermittent or recurring activity; for a pattern that is not continuously observable, a report should supply evidence that supports the pattern.

The working group’s goal is to avoid both extremes: requiring a registrar to ignore a credible portfolio campaign, or starting a broad investigation on a speculative report.

Recommendations 2 through 4 keep the next step as an inquiry. Registrars would review information reasonably accessible in normal operations, including contractual records, technical systems and reports. The draft neither requires every data category to be checked in every case nor asks registrars to create information they do not ordinarily have. It also says a reasonable check should not become a portfolio-wide review as a matter of course. A broader search can be justified when the evidence points to a larger campaign, but the size of the investigation should follow the evidence, not precede it.

This sequence matters because association and abuse are different propositions. Evidence that two domains share an account may support asking whether the same actor controls both. It does not show that the second domain is being used for phishing, malware, pharming, a botnet or spam delivery. The proposed check is complete only when the registrar evaluates the associated name against the abuse definition, not when a matching field is found.

The registrar is accountable across a reseller chain

The proposal places the duty inside the registrar’s sponsored-name portfolio. It permits a registrar to rely on a reseller to perform parts of the check with information available to that reseller, but it leaves the registrar responsible for its contractual obligations. That arrangement preserves one accountable party for ICANN compliance while allowing the work to happen where relevant customer information may reside.

The Registrar Stakeholder Group’s submission broadly supports the draft while asking for clarifications. It argues that effectiveness should be measured by changes in the DNS-abuse threat landscape rather than by counting checks, suspended names or compliance cases. That is a material distinction: activity is not the same as impact.

Openprovider’s submission supports an evidence-based baseline but identifies a harder operational boundary. In some wholesale arrangements, a registrar holds registration and technical data while a reseller holds the end-customer relationship, account structure or other information. The registrar may therefore be accountable for a process whose useful evidence is held elsewhere. Openprovider also asks how old evidence should remain relevant and who should judge whether a name was compromised rather than maliciously registered. These are the kinds of implementation questions that a headline support percentage cannot answer.

The accountability rule is sensible only if authority and capability line up. A registrar cannot demonstrate a proportionate review if the policy quietly expects access to data outside its legal or contractual reach. Conversely, the registrar cannot erase its responsibility by handing the work to a reseller. A workable final rule needs to identify the minimum evidence and records the registrar can reasonably obtain, the tasks a reseller may perform, and the point at which a missing data source limits the inquiry rather than proves guilt.

The safeguards have to survive the enforcement test

The draft includes several protections: compliance with applicable law and contracts; attention to proportionality and data minimization; caution about false association through privacy services, resellers or shared infrastructure; and a requirement to consider the registrant’s possible impact. Its proposed two-year review would look at whether the policy produces a consistent baseline, whether compliance can be assessed, and whether checks contribute to identifying and disrupting campaigns.

The draft also proposes ordinary-course documentation: what triggered a check, when it began, what information was reviewed, how many associated domains were identified, what action followed, and why the process was reasonable. It does not prescribe a single record format or require registrars to build a large new data system. Internal process descriptions would be available to ICANN on request. These controls create an audit trail, but the quality of that trail depends on preserving the difference between an association signal and a finding of abuse.

That difference affects real services. A domain may support mail, customer accounts, public information or other legitimate activity even when one part has been compromised or misused. The 2024 advisory warns that suspension can disrupt legitimate content and associated services. The proposed ADC is an additional investigative duty; it does not replace the existing requirement to choose mitigation appropriate to the particular name and the possible collateral damage. Treating a portfolio match as sufficient cause for suspension would turn a scoped check into a broader sanction than the report proposes.

The remaining weakness is measurement. The draft calls for a review after two years and anticipates aggregate information from ICANN Contractual Compliance, the Office of the CTO and registrars. It also acknowledges that DNS abuse is dynamic and that overall abuse-volume changes cannot be attributed neatly to one policy. Counts of ADCs completed or notices issued would show that a process ran; they would not show whether campaigns were disrupted, whether false associations harmed legitimate users, or whether threat actors simply shifted registrars and tactics.

What the 85% figure does—and does not—authorize

ICANN’s summary report records 42 submissions. Forty-one supplied categorized responses across eight preliminary recommendations and five guidance items, producing 533 categorized responses. Approximately 85% supported an output as written or supported its intent with wording changes; 3% called for significant change; none selected “do not support / should be deleted”; and 12% fell into “Other.” Support ranged from approximately 78% to 90% for each output.

Those numbers matter. They show broad support among the people and organizations who submitted comments, and they give the working group a substantial record to examine. But 533 is a count of responses to individual outputs, not 533 independent people, and the report itself says that the categories omit substantive qualifications. Twenty-six submissions added comments beyond the structured questions, and supporters raised issues about scope, safeguards, resellers, documentation and measurement. The comments are input to the decision; they are not themselves the decision.

The distinction is institutional, not a dismissal of participation. The GNSO working group can develop a recommendation within its charter. Public commenters can test assumptions, surface missing effects and propose text. The Council and Board occupy later decision points in the published process. A procedure that separates participation from authorization gives each act a defined role; it does not make public input irrelevant. Here, the summary explicitly states that no changes had yet been adopted from the comments.

That is why the next version should be judged by the questions the comments expose. Is “association” tied to evidence meaningful for this campaign, or to a convenient shared field? Does each investigated name receive its own abuse assessment? Can a registrar explain what it reviewed and why the scope was proportionate? Does reseller delegation preserve a realistic route to evidence and a clear line of responsibility? Can the later review distinguish useful disruption from process volume and collateral harm?

The draft’s strongest idea is not “check every name connected to a reported name.” It is a bounded escalation: actionable evidence about one sponsored name may justify a proportionate inquiry into names that evidence links to the same activity, while each further conclusion still needs its own support. If the final policy preserves that line, it can address portfolio campaigns without turning weak association into inherited guilt. If it does not, the same flexibility intended to help registrars find campaigns could make it difficult for registrants, regulators and ICANN to tell when a lead became a verdict.