Summary

  • In 2010 Tobias Knecht found an awkward route for Internet abuse reports in APNIC Whois: send them to a network's technical or administrative contact and hope they reached the incident team.
  • His prop-079 required IP-address and AS-number records to point to an Incident Response Team object carrying a dedicated abuse mailbox. APNIC implemented the requirement on 8 November 2010 for new or updated records.
  • The record finally had a destination. APNIC's separate 2019 policy added six-month checks that the destination remained responsive.

The email address that belonged to someone else

A network's technical contact knows where the routers are. That does not make their inbox the incident desk. Tobias Knecht opened his February 2010 APNIC proposal with this mismatch: abuse reports in the APNIC region were commonly sent to tech-c or admin-c, because Whois had no mandatory, specialised contact for them. Organisations were creating dedicated abuse teams, while the public directory still sent complaints toward general contacts. The registry's map had the wrong door marked.

Knecht's prop-079 gave the door a proper label. An inetnum or inet6num address record, and an aut-num AS-number record, would carry a mandatory reference to an Incident Response Team, or IRT, object. That object would contain an abuse-mailbox. A reporter looking up the resource could find the channel designated for the work rather than guessing which staff member might forward the message.

The timing was measured. The requirement would apply when a holder created a new resource record or next updated an existing one. It did not order APNIC to rewrite every old record overnight. The proposal also recognised a practical option for smaller holders: APNIC's implementation notice told them to prepare their own abuse contact and process, or find a willing upstream provider or external incident team to receive reports. A named destination could match the organisation's actual capacity.

A field, then the harder question

APNIC records consensus at the Policy SIG and member meeting on 4 March 2010, Executive Council endorsement in May, and implementation on 8 November. The new IRT reference became mandatory when relevant IPv4, IPv6 or AS records were created or updated. APNIC later removed the old abuse-mailbox attribute from role objects. Knecht had moved the address for this work into a purpose-built place in the registry.

He also named the weak spot in the original proposal: a place to put an email address does not keep it accurate. That problem acquired its own policy years later. APNIC's IRT guidance says prop-125 introduced validation of IRT email contacts every six months from 30 June 2019. Prop-125 had different authors. Its arrival shows the next operational question that prop-079 exposed: once the right mailbox is listed, will anybody still be listening there?

The improvement is easy to underestimate because the policy lives in a database field. Incident response starts before a report is analysed. Somebody must be able to find the team charged with reading it. Knecht's proposal made that address part of the number-resource record instead of a piece of organisational folklore.

Source record