Summary

  • The .kids Registry Agreement gives DotKids Foundation a child-safety mandate and a route to suspend or cancel violating names. At RIPE 93, a researcher described a web reporting button that had failed and a restored form that still accepted one domain, screenshot and explanation at a time.
  • A four-year measurement found that blocklist-flagged .kids names remained in the zone for a median of 34 days. ICANN's monthly transaction report counts domains and deletions, but it cannot show when a warning reached the registry, what was verified or which action followed.

A safety promise meets the ticket window

A top-level domain that promises a safer space for children is making more than a branding choice. It is offering a rulebook and an operator with a hand on the switch. The 2021 .kids Registry Agreement filed with ICANN does put that switch in reach: Specification 12 requires registrants to follow child-appropriate guiding principles, covers the domain name as well as content, and makes violations grounds for suspension or cancellation. The operator is DotKids Foundation Limited. There is a named decision-maker, not a vague hope that the extension will police itself.

DotKids' own anti-abuse policy supplies a reporting address, a reporting address, and reserves the power to deny, cancel, transfer, lock or hold a registration in specified circumstances. It explicitly names phishing and malware among abusive uses. The document gives no case-resolution clock. A power to remove a name is useful; a visitor looking at a suspect .kids address needs to know how a warning becomes a decision, and how long that conversion takes.

At RIPE 93 on 27 October 2026, University of Twente researcher Matteo Liberato brought the sort of evidence that makes a policy book sweat. His team's longitudinal study followed roughly 1,400 daily snapshots from May 2022 through March 2026. The published abstract identifies 176 apparent violations visible in domain-name strings alone. It also says names appearing on abuse blocklists persisted in the .kids zone for a median of 34 days. That interval measures continued presence after a flag; it is not a measured response time to a report submitted to DotKids. The distinction matters because the problem is precisely the missing handoff between detection, receipt, verification and action.

The RIPE Security Working Group transcript supplies a more prosaic scene. Liberato told the room that a website abuse-report button had not worked when his team tried it. He said they alerted DotKids roughly two weeks earlier, received a quick reply and saw a route to the form restored. The working form, he explained, required a domain, screenshot and explanation for each submission. His team had about 300 candidate names it wanted to send and had asked for a bulk channel or a list the operator could process. According to his account, DotKids said it was working on that. The transcript records a researcher's report of the exchange; the registry has not published the case log that would show the eventual decisions.

This is the point at which governance becomes a user interface with consequences. A community TLD can write an excellent paragraph about children's rights. A researcher can find a pile of suspect names. If the reporting path demands one handcrafted packet for every name, a large measurement set arrives at the safety desk as a clerical marathon. That design makes throughput part of the safety policy. The repair of the button is welcome; the ability to receive a documented batch, triage it, reject false positives and act on confirmed cases is the actual work.

ICANN's spreadsheet counts the wrong clock

The March 2026 ICANN .kids transaction file reports 6,666 domains in its total row and 100 deletions outside the grace period that month. These are useful registry-stock and transaction figures. Their columns do not say whether a deletion followed a phishing report, an expired registration, a registrar action or a policy decision. They do not record the date a complaint arrived or the time a domain was put on hold. One cannot turn those hundred deletions into a child-safety success rate by waving a spreadsheet in front of the contract.

The registry also has discretion under its policy. Discretion is appropriate when an external blocklist can be wrong and a domain name string requires context. The article's claim is narrower and harder: discretion needs an operational trail. For each alleged violation, record the signal, receipt, evidence check, decision, action and final zone status. Publish aggregated timings and outcomes without exposing children, complainants or investigative details. Then the public could distinguish a bad flag, a quick dismissal, a slow investigation and a domain that kept resolving after a confirmed violation.

Heng Lu's Note 73 asks who may turn participation into mandate. Here the mandate is unusually explicit in a contract; the researcher's participation supplies evidence, while DotKids holds the power to act. ICANN holds the agreement and receives monthly operational reports. The weak link is the publicly visible chain between those layers. A community-safety label cannot answer an abuse report. A suspension clause cannot tell a parent when a case was reviewed. A monthly totals CSV cannot reconstruct the decision.

The academic team used several external signals in its measurement. Each has a different error rate and purpose, and no automated flag should be promoted to a final registry verdict. That is precisely why the registry's decision record matters more than a bigger pile of accusations. The written RIPE abstract says 176 apparent name-string violations; the spoken presentation gives a rounded figure. The public agreement is the standard against which a verified case must be judged. The public record does not yet show that judgement case by case.