Summary

  • The .PHARMACY eligibility regime acquired enforceable force through the 19 June 2014 Registry Agreement, not merely through NABP’s application narrative or public-health mission. Specification 12 placed pre-registration vetting, cross-jurisdiction compliance, denial or revocation, and access to an appeal process inside the contract. Specification 11 section 3(c) separately required clear, published registration policies to be applied transparently.
  • In PICDRP case QSE-367-13523, the 10 July 2018 panel report did not decide whether Canadawide Pharmacy Ltd was lawful, safe or entitled to canadawidepharmacy.pharmacy. It found that NABP’s closure record did not identify and substantiate the alleged connections on which it relied, did not explain their materiality, and did not show that the applicant’s site linked or redirected to the third-party sites cited against it.
  • ICANN’s 12 July 2018 breach notice required corrective and preventive action, milestones and publication of a separate malicious-conduct contact. The public compliance docket later recorded both breaches as cured on 3 October 2018. It published no order registering the domain, no damages award, no invalidation of NABP’s standards and no reasoned account of the cure package.

Five acts, and the one that never occurred

Canadawide Pharmacy Ltd applied for a .PHARMACY name on 27 June 2017. NABP asked for further information on 11 July. It closed the request on 21 December. The dispute became PICDRP case QSE-367-13523. A three-member standing panel found non-compliance with Specification 11 section 3(c) on 10 July 2018. ICANN issued a formal breach notice two days later. The compliance docket marked the breaches cured on 3 October.

The sequence is unusually legible because each act belonged to a different institutional layer. Canadawide asked a registry operator for admission to a restricted namespace. NABP applied its eligibility system. A three-member standing panel assessed whether the operator had complied with a contractual transparency duty. ICANN’s Contractual Compliance function converted that finding into a cure demand. The compliance docket later recorded data and documents under review before marking both breaches cured.

The conspicuously absent act is an ICANN order awarding canadawidepharmacy.pharmacy. Neither the panel report nor the breach notice directed NABP or a registrar to create the registration. The public cure entry does not say that Canadawide’s application was reopened, that an internal appeal succeeded, that the name was issued, or that the applicant received compensation. The located primary record therefore supports a narrower conclusion: ICANN enforced the quality and transparency of the decision process without replacing NABP as the substantive eligibility decision-maker.

That distinction turns what could be told as a dispute about online-pharmacy safety into a case about institutional power. Who could define eligibility? Who could supply regulatory facts? Who could deny a name? Who could complain? Who could review the denial? Who could compel a change in process? And who, despite all that authority, could not decide the applicant’s entitlement to a particular label?

The answers did not follow from NABP’s public-health expertise alone. They followed from a chain of application, contract, delegation, registry policy, registrar execution and contractual enforcement. Each link conferred a different kind of power. Collapsing them would make the 2018 outcome look either stronger or weaker than it was.

Application, evaluation, contract and delegation were not one decision

NABP’s application entered the 2012 new-gTLD programme as application 1-1040-55064. The ICANN application-status record identifies the applicant, the .PHARMACY string, an Initial Evaluation pass and a later delegated status. That page is useful as a status map, but it does not make the programme’s separate stages legally interchangeable.

The applicant-submitted filing, posted in June 2012, described a tightly restricted namespace. NABP proposed to vet every prospective registrant before registration; to assess licensure, prescription practices and drug authenticity; to test compliance not only where the applicant was based but in the jurisdictions where it conducted business; to deny or revoke access for non-compliance; and to provide an appeal route. Those statements explained the proposed model and helped evaluators assess the application. They were evidence of what NABP offered to do, not by themselves an executed set of registry obligations.

The distinction mattered because the new-gTLD application process was not a delegation instrument. ICANN’s 17 May 2013 Initial Evaluation report recorded a pass at the evaluation stage. It also preserved ICANN’s ability to revisit eligibility and conduct further due diligence before contracting. Passing evaluation meant the application had cleared that stage. It did not execute a registry agreement, add .PHARMACY to the root, guarantee operation, or confer on any future pharmacy a right to register.

The binding allocation of registry powers arrived with the Registry Agreement executed on 19 June 2014. That contract made NABP the registry operator subject to a delegated root-zone entry and imposed the agreement’s specifications. It required third-party registrations to pass through ICANN-accredited registrars. It incorporated reserved-name controls, public-interest commitments, community registration policies, data escrow, continuity and transition obligations, and contractual remedies. It was this instrument, rather than the public-health rationale in isolation, that gave ICANN a basis for the 2018 compliance action.

Root registration and delegation were separate from contracting. The IANA root-zone database records 28 August 2014 as the TLD’s registration date and names NABP as sponsoring organisation. The separate IANA delegation report dated 4 September 2014 records that the proposed sponsoring organisation matched the contracted party and that the required contact, technical and processing checks had been completed. Together, those records document the technical and administrative establishment of the top-level domain after the Registry Agreement; neither shows that a particular registrant met NABP’s criteria.

The stages can therefore be stated precisely. The application proposed a model. Initial Evaluation assessed the application at one programme gate. The Registry Agreement converted selected obligations into contract. Root registration and IANA’s delegation record followed contracting and the required checks. Only then could the registry’s eligibility workflow govern individual requests, with accredited registrars executing registrations after registry approval. A later PICDRP finding could test compliance with the contract, but it could not retroactively turn Initial Evaluation into a merits judgment on an individual pharmacy.

This separation also explains why the 2018 breach did not unsettle delegation. The complaint concerned the operator’s adherence to a registration-policy commitment. It was not a finding that NABP had never been eligible to operate .PHARMACY, that the delegation report was defective, or that the root-zone entry had to be removed. ICANN possessed escalation powers under the contract, potentially including termination, but the public record shows cure and continuation rather than redelegation or transition.

Which promises became enforceable

The .PHARMACY agreement contains a deliberate boundary between application rhetoric and contractual obligation. Specification 11 section 2 is marked “intentionally omitted” and states that application commitments, statements of intent and business plans were not thereby incorporated as additional Public Interest Commitments. That clause prevents a simple but tempting argument: because NABP described a safeguard in its application, every detail of that description automatically became enforceable through PICDRP.

The same agreement nevertheless made a defined subset of community and registration obligations binding by other routes. Section 2.19 required NABP to operate policies consistent with the community-based purpose represented in the application, including policies concerning naming conventions, eligibility, selection, content or use. It required operation of the TLD in a manner that allowed community discussion and participation in policy development, together with registry enforcement procedures, dispute-resolution arrangements and compliance with Specification 12.

Those duties gave community participants a recognised role, but not final decision power over an individual request.

Specification 12 supplied the core eligibility architecture. It required prospective registrants to be vetted before registration. The standards were to include regulatory requirements such as licensure, drug authenticity and valid prescription practices. The review extended to laws and regulatory requirements where the registrant was based and in every jurisdiction where it conducted business. The operator was to deny or revoke registration for non-compliance and provide access to an appeal process, even though the agreement noted that the detailed appeal system had not then been finalised.

Specification 11 section 3 made Public Interest Commitments enforceable by ICANN and through PICDRP, with remedies capable of extending to termination. Section 3(c) required the registry to operate transparently by establishing and publishing clear registration policies and adhering to them. The duty was not merely to possess a policy document. It was to make the policy intelligible and apply it in a way that could be followed.

The PICDRP programme page and case register identify the procedure as a mechanism for alleged non-compliance with Specification 11 and list the .PHARMACY matter as a 10 July 2018 finding under section 3(c). The panel report’s narrative refers once to paragraph 2 when describing enforceability, but the executed .PHARMACY agreement places the operative enforcement language in paragraph 3 because paragraph 2 was omitted. The contractual holding itself was clear: the panel assessed transparent adherence to registration policy under section 3(c), not the truth of every promise in the application.

This architecture created a narrow but real accountability route. ICANN did not need to become a pharmacy regulator to ask whether NABP had explained and evidenced its own application of its own published criteria. Conversely, the existence of PICDRP did not make ICANN a general appellate tribunal for every eligibility disagreement. A complainant could trigger contractual scrutiny. The panel could find compliance or non-compliance. ICANN could demand cure and escalate under the agreement. None of those powers necessarily included substituting a new eligibility decision or commanding a registrar to register a label.

That is the legal centre of the case. The public-health gate was enforceable because the contract made specified features of the gate enforceable. The contract did not transfer all of NABP’s subject-matter judgment to ICANN, and it did not convert all applicant expectations into registry rights. It imposed a procedural discipline on private decision power: define the rules, publish them, adhere to them transparently, maintain an appeal route, and remain answerable to contractual enforcement.

A map of decision power

The operational chain began with NABP, but not every actor in the chain held the same kind of authority.

Licensing boards, regulators and other official sources could establish facts about a pharmacy’s licences, disciplinary history, ownership and legal authority to serve particular markets. Their records could be decisive evidence in NABP’s assessment. Yet the Registry Agreement did not give each regulator a direct vote on the allocation of a .PHARMACY name. Regulatory participation supplied inputs; NABP retained the registry decision.

Community members and policy advisers could participate in policy development under section 2.19. That participation could shape standards and expose problems. It did not create a collective veto or an entitlement to determine whether Canadawide satisfied the standards. Participation was an institutional channel, not control of the individual decision.

NABP defined and administered the eligibility process within the contractual framework. It received applications, requested information, evaluated licences and affiliations, and approved or rejected requests. Eligibility approval remained distinct from the registrar’s later registration transaction; the current terms express that present-day handoff through an electronic token. Specification 12 required ongoing safeguards and contemplated denial or revocation for non-compliance; present-day terms separately address renewal and suspension, but those current details should not be projected backwards as the precise 2017–2018 rules.

NABP’s expertise and information access gave it practical control at the gate. Its contract with ICANN constrained how that control had to be organised and explained.

Registrars occupied a narrower implementation role. Section 2.9 of the Registry Agreement required third-party registrations to be made through ICANN-accredited registrars. A registrar could execute a registration transaction after the registry’s conditions were satisfied. It could not make an ineligible applicant eligible or bypass a withheld label. Registry approval was necessary, but it was not the same act as registrar contracting, name availability or successful creation of the domain.

ICANN controlled the registry contract. Through Contractual Compliance, it could investigate a breach, require corrective action, set a cure period and use the threat of termination. Through PICDRP, it provided a procedure for testing alleged Specification 11 non-compliance. That power was substantial because the right to operate a delegated top-level domain depended on continued contractual standing. It was also bounded: ICANN’s 2018 documents did not purport to issue pharmacy licences or decide the territorial reach of medicines law.

The PICDRP standing panel performed a review function defined by the procedure. It examined whether the registry’s conduct complied with its Public Interest Commitments. It did not conduct a fresh licensing inquiry or determine who should own the domain. Its authority was to make a contractual compliance finding that ICANN could enforce.

IANA’s role was different again. The delegation process verified the sponsoring organisation, contacts and technical conformance, then implemented and recorded the root-zone change. IANA did not vet individual registrants. Its continuing database entry demonstrates that .PHARMACY remained delegated to NABP through the recorded period; it does not validate an eligibility denial, an appeal result or the cure package.

This map separates five kinds of power that are often blurred in restricted namespaces: evidentiary authority, policy participation, registry adjudication, contractual enforcement and technical implementation. The 2018 dispute sat within an architecture containing all five, but its operative path ran chiefly from registry adjudication to standing-panel review and contractual enforcement. No institution accumulated every power. That allocation allowed a specialist operator to apply health-sector criteria while keeping the operator dependent on a DNS contract and a reviewable procedural commitment.

Cross-border verification as a registry workflow

The public-health ambition of .PHARMACY was unusually demanding because an online pharmacy can be licensed in one place, serve customers in another, use affiliated sites in several jurisdictions and outsource parts of fulfilment. A registry that admitted applicants by checking only their home address would miss the conduct the restriction was designed to reach. Specification 12 therefore required attention to the jurisdictions in which a registrant did business, not merely the place of incorporation.

The NABP application instructions published in May 2018 show how that contractual idea was translated into intake. Applicants were asked to identify the desired domain and the websites to be evaluated; list the countries to which prescription medicines would be shipped; disclose business names, former names and relevant subsidiaries; identify the pharmacies that owned or fulfilled orders; provide pharmacy and controlled-substance licences; disclose disciplinary and legal history; list domains they owned or registered; and identify sites to which the applicant’s site linked or redirected.

Those fields created an evidentiary graph rather than a single licence check. The operator could compare the applicant’s claimed service area with its licences, connect corporate names to fulfilment entities, inspect disciplinary records, and trace relationships among websites. This was essential to a cross-border restriction. It was also the source of the procedural vulnerability exposed in 2018: once an operator relies on a network of alleged relationships, it must identify which relationships it found, what evidence supports them, which rule makes them material and whether the relationship is current.

The registry’s gate did not grant or replace legal authority. A pharmacy board could issue or withdraw a licence. A court or regulator could interpret a jurisdiction’s law. NABP could decide whether the evidence met .PHARMACY’s eligibility policies and could withhold a DNS label. These powers could reinforce one another, but they were not substitutes. Registration could signal that NABP had accepted an applicant under the registry’s rules; it could not create a legal right to dispense medicine where the applicant lacked one.

That limit matters because restricted domains can invite over-reading. A user may treat a controlled suffix as a guarantee. A registry may describe screening as a trust mechanism. Contractually, however, the operator controls admission to a namespace, not every downstream transaction. The current NABP terms, discussed only as a present-day endpoint below, expressly disclaim any warranty that registration proves legal compliance. The 2018 case shows why the disclaimer is institutionally accurate: the registry’s decision is built from external facts, changing laws and applicant disclosures, and it remains a decision about access to a label.

Cross-jurisdiction review also creates asymmetry. The operator can aggregate information from multiple regulators and affiliated websites. The applicant may not know which connection, old corporate name, fax header, redirect or third-party site drove the result. A process can therefore be substantively careful yet procedurally opaque. Specification 11 section 3(c) addressed that asymmetry not by requiring public release of every investigative technique, but by requiring clear policies and transparent adherence.

The decisive question became whether the closure record allowed the applicant and the reviewer to understand how the evidence mapped to the rule.

Two-character labels belonged to a separate control chain

The .PHARMACY record also contains a second access mechanism that should not be confused with pharmacy eligibility: the release of two-character ASCII labels. Specification 5 of the Registry Agreement initially withheld those labels. Release required either agreement from the related government and country-code top-level-domain manager or an anti-confusion proposal approved by ICANN.

NABP’s two-character release request, filed in 2015, sought the release of letter-letter labels and acknowledged that approval would become effective only through written communication from ICANN. The request itself was therefore not authorisation. It was an invocation of a contractual route.

The later anti-confusion mitigation plan proposed safeguards that drew on the restricted nature of .PHARMACY. It described regulator engagement, publication of applicable policies, inclusion of the policy in the Registry-Registrar Agreement and enforcement. It also contemplated withholding country-specific names until an appropriate regulatory relationship was established. The plan was evidence of what NABP proposed to do. It was not, by itself, proof that every relevant government or ccTLD manager agreed, that ICANN approved every requested label, that the labels were released in the registry system, or that any of them became active domains.

This separate chain illustrates why “the registry approved it” can conceal several distinct acts. NABP could request release. A government or ccTLD manager could agree through one route. ICANN could approve a mitigation proposal through another. The registry could then make a label available subject to eligibility rules. An accepted applicant could obtain a token. An accredited registrar could execute a registration if the name remained available. The resulting name could then be activated and used. Evidence of an early act does not prove the later ones.

The 2018 Canadawide dispute did not adjudicate this two-character process. Its requested label was not a two-character country code. The two records nevertheless belong in the same institutional analysis because they reveal two independent gates inside one registry: a reserved-label gate controlled by Specification 5, and an applicant-eligibility gate controlled by Specifications 11 and 12. A registry operator could satisfy one and fail the other. ICANN could authorise a class of labels without deciding who was qualified to register them. Conversely, a pharmacy could be eligible but unable to obtain a reserved or unavailable name.

The located primary record does not contain the complete written authorisation and government or ccTLD-manager correspondence needed to trace each two-character label from request to activation. Any claim that the mitigation plan itself released all labels would exceed the evidence. The proper conclusion is narrower: Specification 5 created another enforceable control point, and NABP’s request and plan show participation in that process, not completion of every downstream act.

Reconstructing the Canadawide file

The panel report identifies the complainant as Canadawide Pharmacy Ltd, represented through John Berryhill, and the requested name as canadawidepharmacy.pharmacy. Canadawide submitted its application on 27 June 2017. NABP sought further information on 11 July. The review lasted until the closure letter of 21 December, nearly six months.

NABP relied on three standards described in the panel record: licensure, legal compliance and affiliated websites. The closure stated that the applicant had, “until recently”, belonged to Medisave and that there were “several connections” among Medisave, Solaris and Candrug. It also listed eight sites said to ship into jurisdictions where they lacked required licences. These were serious allegations in a registry built around cross-border compliance. The problem found by the panel was not that such relationships could never be relevant.

It was that the final explanation did not show the evidentiary and analytical steps that made them relevant to this applicant under the published standards.

First, the closure did not identify the alleged connections with enough specificity. It did not state which corporate, ownership, operational, technical or website relationship tied Canadawide to the named entities. It did not provide or identify the documentary or public-record basis for the connections. It did not explain why each connection was material under the standards. A conclusion that several connections existed could not substitute for the chain of reasoning needed to apply a rule transparently.

Second, a more concrete Medisave rationale appeared later, during the PICDRP conference on 24 April 2018. NABP referred to material such as a fax header or reference indicating a link. That explanation was not in the December closure. The panel also regarded the phrase “until recently” as imprecise against standards framed around present affiliation. A historical relationship might be relevant, especially if it revealed continuity of control or operations, but the operator needed to explain the temporal rule and evidence rather than leave the applicant to infer them.

Third, the record did not demonstrate that Canadawide’s evaluated website linked or redirected to the eight third-party sites cited in the closure. The 2018 instructions show that linked or redirected sites were an explicit field in the review process. That made evidence of the connection particularly important. At least one panel member reported finding no such links or redirects. The panel did not say that the third-party sites were lawful. It said the operator had not shown why their conduct could be attributed to Canadawide under the affiliated-websites criterion.

The duration of the review sharpened the procedural defect. NABP’s process normally contemplated a roughly 60-day period, according to the panel record. A review taking almost six months might be justified by a complex cross-border inquiry. It also increases the need for a final decision that identifies the decisive facts and standards. Delay without a precise explanation compounds asymmetry: the applicant bears the cost of waiting but still cannot know what evidence to contest, correct or distinguish.

It is important not to convert NABP’s assertions into established regulatory findings. The located panel record is evidence that the operator cited licences, affiliations and third-party sites. It is not a judgment that Canadawide or each named entity violated pharmacy law. Nor is the panel’s criticism proof that Canadawide satisfied every eligibility standard. The panel did not reconstruct the entire application, conduct discovery or issue a merits determination. It examined whether the registry transparently adhered to clear policies in making the denial.

The panel’s narrowness protected both sides from an overbroad outcome. NABP remained able to enforce substantive health and legal-compliance criteria. Canadawide obtained a finding that the explanation and supporting record did not meet the contractual transparency standard. ICANN gained a basis to demand process correction. None received a definitive ruling on the underlying eligibility question.

What the PICDRP panel could decide

PICDRP provided review access, but review access was not the same as a remedy awarding the name. The panel report records that the complaint was filed on 9 March 2018, transmitted to NABP on 26 March, discussed in a conference on 24 April and referred to the standing panel on 25 June. On 10 July, all three panellists answered that the operator had not complied with Specification 11 section 3(c).

The test was institutional, not clinical. The panel did not ask whether a particular prescription was valid, whether a pharmacy board should license an establishment, or whether medicine could lawfully be shipped to every destination. It asked whether NABP had established and published clear registration policies and transparently adhered to them in this case.

That test required more than proof that NABP possessed standards. The operator had to show how the decisive evidence connected to the standards. A clear policy applied through unexplained facts is not transparently followed. Conversely, detailed facts assessed under an undisclosed or shifting rule would present the same problem from the other direction. The panel found a failure in the link between rule, evidence, materiality and decision.

This was not a general invalidation of standards 1, 5 or 10. The panel did not hold that licensure, territorial legal compliance or affiliated websites were improper criteria. Those subjects were central to Specification 12’s purpose. The finding was that NABP’s final closure did not adequately substantiate and explain their application to Canadawide.

It was also not a decision that every historical affiliation must be ignored. A past ownership or operational relationship could be relevant to present eligibility. The panel’s concern was that the closure used vague temporal language and did not set out the rule by which the past relationship remained material. That is a procedural distinction with substantive consequences: an operator may rely on history, but it must reveal enough of its reasoning for the applicant and reviewer to understand the basis.

Nor did the panel direct a registrar to act. Registrars were not the adjudicators of Specification 12 eligibility. Even an applicant accepted by NABP would still need the registry’s token, an authorised accredited registrar, an available label and a completed registration transaction. PICDRP did not collapse those acts into the compliance finding.

The panel’s power was therefore consequential but incomplete. It could create an authoritative finding of contractual non-compliance that exposed NABP to ICANN enforcement. It could not grant a pharmacy licence, award damages, rewrite the agreement, transfer the registry, guarantee registration or settle the merits of every disputed factual allegation. The case demonstrates why a review body’s jurisdiction must be read from the remedy it can produce, not merely from the seriousness of the dispute it hears.

From finding to breach notice

ICANN’s Contractual Compliance function moved quickly after the panel report. The notice dated 12 July 2018 identified non-compliance with Specification 11 section 3(c). It required NABP to provide corrective and preventive actions, with implementation dates and milestones, addressing both the complaint and the panel’s findings and ensuring transparent adherence to clear registration policies.

That demand was more specific than a request to promise better behaviour. A corrective action addresses the identified failure. A preventive action addresses recurrence. Dates and milestones make the response capable of verification. The notice therefore required an operational response rather than a bare statement of disagreement, but it did not reveal whether the remediation involved process, documentation, training, decision records, policy application or some combination of them.

The notice also identified a separate breach of Specification 6 section 4.1: failure to publish the primary contact required for reports of malicious conduct in the TLD. ICANN required publication of that contact. This second issue did not arise from Canadawide’s eligibility merits, but it belonged to the same compliance notice because it was another unmet registry obligation.

The notice set a cure deadline of 11 August 2018 and warned that failure to cure could lead ICANN to commence the Registry Agreement termination process. That warning gave the notice its enforceable character. ICANN was not merely advising a voluntary standards body. It was acting as counterparty to a contract on which operation of a delegated TLD depended.

Termination was possible, not automatic. The agreement included challenge mechanisms and transition provisions. ICANN would still have had to follow the contractual route. The notice did not say that one defective denial immediately cancelled the Registry Agreement, removed .PHARMACY from the root or invalidated existing registrations. Its immediate remedy was cure.

Most importantly, the notice did not tell NABP to register Canadawide’s name. It required a response to the complaint and findings, but that could take several forms: a better reasoned decision, reconsideration under corrected procedures, policy clarification, training, record-keeping changes, or another measure accepted by ICANN. The public notice does not reveal which combination was used. An order to cure a decision process is not necessarily an order to reverse the decision produced by that process.

This distinction may frustrate an applicant seeking the label, but it follows from the contract’s allocation of power. PICDRP supplied the compliance finding under Specification 11; ICANN enforced that finding through the breach process. NABP retained Specification 12 eligibility authority. ICANN could insist that the authority be exercised transparently; it did not publicly assume the authority itself.

Cure without a published remedy

The ICANN compliance docket records data and documents under review, an extension of the cure period to 1 October 2018, and both breaches marked cured on 3 October.

That entry records a documented endpoint: ICANN closed the cited breaches as cured. It also proves less than a reasoned cure decision would have proved. The docket does not publish the corrective and preventive action plan, the implementation milestones, the supporting correspondence, any revised closure template, any training material, any policy change or the evidence ICANN used to verify completion.

The difference is one between transparency and accountability. The public can see that a complaint produced a panel finding, a breach notice, a cure period and a closure status. The registry was accountable to ICANN because failure could have escalated to termination. Yet the public cannot evaluate the substance of the accepted cure from the docket alone. An accountability event occurred; the basis for closing it remained largely opaque.

The record is especially incomplete for Canadawide. It does not show whether the applicant used NABP’s internal appeal procedure, whether the request was reopened, whether NABP issued a new explanation, whether it reached the same result on a better record, whether the name became available, whether a registrar created it, or whether the applicant pursued a court, regulatory or other remedy. The absence of a public order awarding the domain is affirmative evidence against claiming ICANN granted it, but it is not proof of every later event.

The safe conclusion is therefore bounded. By 3 October 2018, ICANN considered the identified contractual breaches cured. The Registry Agreement remained in force, and the public root record shows continued sponsorship by NABP. The located public materials do not establish the applicant-specific consequence.

This opacity matters because a cure can operate at several levels. A registry might fix only the immediate letter. It might reopen the application. It might revise its standards. It might improve internal evidence logging without changing the standards. It might create a review checklist that links each allegation to a source and provision. It might retrain staff. ICANN’s notice was broad enough to require corrective and preventive action, but the docket does not reveal which level was accepted.

The cure entry also did not validate every other registry practice. It did not approve all two-character releases, certify that every .PHARMACY registrant remained compliant, or insulate future denials from PICDRP. A cured breach closes the identified compliance matter. It is not a general warranty of the registry’s governance.

Appeal access was not a guaranteed reversal

Specification 12 required access to an appeal process, but the 2014 agreement recorded that the detailed appeal procedure had not been finalised. That wording created an obligation to provide a route without fixing every element of the route in the contract. It did not promise that an appeal would be independent of NABP, costless, de novo, public or capable of ordering a registrar to register a name.

The 2018 primary record does not establish whether Canadawide invoked the internal appeal process or what version of the appeal rules applied. Archived 2017–2018 terms and the effective texts of the standards are therefore essential before attributing current procedures to the dispute. Any account that imports today’s deadlines, fees or panel composition into 2017 would exceed the evidence.

The current NABP terms can be used only as a bounded endpoint. They presently distinguish rejection from acceptance, permit an appeal of rejection or revocation within a stated period, charge a fee, limit the record and place review within NABP. They state that suspension is not appealable. They also make clear that acceptance produces a token and an opportunity to register through an authorised registrar, not a guarantee that the requested name remains available.

Those current terms show why “appeal” cannot be treated as a synonym for “remedy”. The current commission may affirm the decision or reverse it and restore the appellant to the position before rejection or revocation. Name availability, registrar contracting and technical registration remain separate. Even a court- or policy-ordered transfer recipient must, under the current terms, be accepted by NABP before obtaining a .PHARMACY registration. The eligibility gate survives the external transfer command.

The current registry process page likewise describes a sequence: satisfy the prerequisite credential, submit a request, obtain NABP approval, receive an electronic token, register through an authorised registrar and connect the approved site. That is strong evidence of the present operational separation between eligibility and registration. It is not proof that the same prerequisite credential, exact workflow or remedial consequences applied during the Canadawide matter.

The historical gap should remain visible. The contract promised access. The panel reviewed contractual transparency. The breach notice required cure. The located documents do not show that any forum ordered the substantive result Canadawide sought. Review access existed; an enforceable applicant-specific remedy is not documented.

What continuity protected

The 2018 breach occurred after .PHARMACY had been delegated and was operating. That timing raises a different question from eligibility: what would have happened to the namespace and its registrants if NABP had failed to cure?

The Registry Agreement included emergency transition, continued-operations, data-escrow and termination-transition provisions. Those mechanisms were designed to preserve critical registry functions and operational data if the operator could not continue or the agreement ended. They reduce the risk that a contract dispute immediately disables resolution for existing domains.

They do not guarantee continuity of every policy judgment. A successor operator could preserve zone data, registration records and DNS service while still needing authority, expertise and procedures to administer a specialised pharmacy eligibility regime. Technical continuity answers who keeps the namespace functioning. Policy continuity answers who decides which pharmacies may enter, renew, transfer or remain.

The contractual architecture made both operational continuity and community-registration obligations relevant, but it did not specify the transfer of specialised policy capability with the same detail as the transfer of data and registry functions.

The IANA root-zone record, last updated on 28 May 2025, continues to identify NABP as sponsoring organisation and lists current administrative and technical contacts. This is reliable evidence of root-zone continuity through that recorded endpoint. It does not establish that every registrant experienced uninterrupted service during the cure period, that no backend arrangement changed, or that all eligibility practices remained identical.

A stronger continuity finding would require monthly registry reports, zone or transaction data, registrar notices and any backend-provider records. The absence of termination supports the inference that the registry continued rather than entering an ICANN transition. It does not, by itself, prove the experience of every registrant or applicant.

Continuity also did not create entitlement. An existing registrant’s interest in stable DNS service is different from an applicant’s claim to an unregistered label. Transition safeguards can preserve critical operations without awarding a disputed name. The Registry Agreement’s public-interest function was therefore double-sided: it constrained NABP’s eligibility process and protected the namespace from sudden operational failure, but it did not promise a particular eligibility judgment would survive a transition or that a disappointed applicant would prevail.

The contract’s bounded achievement

The .PHARMACY system joined four institutional functions that usually operate apart. Pharmacy regulators controlled licences and legal facts. NABP controlled admission to a specialised DNS namespace. ICANN controlled the registry contract and access to a compliance mechanism. IANA implemented and recorded delegation. The arrangement made a public-health screen enforceable without making ICANN a health regulator.

The 2018 case tested that design at its most vulnerable point: the reasoned connection between evidence and denial. NABP could contractually treat affiliations, websites, territorial licences and shipping practices as relevant. It could not satisfy Specification 11 section 3(c) merely by announcing that connections existed. The panel required an intelligible account of what the connections were, how they were evidenced, why they mattered and how they fit the published standards.

ICANN then used contractual leverage. Its breach notice required correction, prevention, dates and milestones, backed by the possibility of termination. The public docket records ICANN’s conclusion that both cited breaches had been cured. That is a documented contractual outcome, not a voluntary recommendation.

Yet the public outcome remained incomplete. ICANN did not publicly re-adjudicate the pharmacy evidence. It did not award the domain. It did not abolish the standards. It did not alter the root-zone delegation. It did not publish the cure package. The notice required a clearer, contract-compliant process, while the absence of a substitution order left substantive eligibility with NABP.

Without Specification 11 section 3(c) and PICDRP, the located ICANN record supplies no equivalent ICANN process for testing whether this denial transparently applied a published rule. Canadawide might still have used an NABP appeal or pursued an external legal claim, but those routes would have involved different decision-makers, standards and remedies. The contractual commitment created the institutional opening.

Without cure, ICANN could have escalated towards termination, subject to the agreement’s challenge and transition mechanisms. That counterfactual shows why the panel’s procedural finding had force even without an order awarding the name. The registry’s authority depended on a contract, and the contract made transparent adherence a condition of continued operation.

The unresolved questions are material. The public record does not disclose the corrective and preventive plan or what ICANN verified. It does not establish Canadawide’s post-cure result. It does not provide the archived appeal rules needed to assess the remedy available in 2017–2018. It does not trace each two-character label from request to approval, release and activation. It does not prove registrant-level continuity through the cure period. Those are evidentiary gaps, not invitations to fill the narrative with assumptions.

The most defensible conclusion is therefore neither that .PHARMACY’s gate failed nor that ICANN vindicated it. The gate was contractually real. NABP retained the authority to define and decide eligibility within that contract. The panel found one exercise of that authority procedurally non-compliant. ICANN compelled a response through its breach process and recorded both cited breaches cured. The domain remained unordered.

That missing order is the case’s institutional lesson. A system can make private gatekeeping reviewable without turning review into substitution. It can create accountability without publishing every remedial detail. It can preserve technical continuity without guaranteeing policy continuity or applicant entitlement. In .PHARMACY, contract law made the gate enforceable, but it also marked the edge of ICANN’s remedy.