ICANN’s anti-abuse measures look to be having the desired effect
More effective prevention of DNS abuse involving generic domain name extensions
On 5 April 2024, the Internet Corporation for Assigned Names and Numbers (ICANN) introduced new anti-abuse rules for registries and registrars. Under the new regime, registrars and registry operators are required to proactively intervene against common forms of DNS abuse, such as malware, botnets, phishing, pharming and some types of spamming. One year on, it looks as if the rules are having the desired effect: the way DNS abuse reports are dealt with has clearly improved. But does that mean the measures are working? Or is it too soon to say?
New rules on DNS abuse
ICANN defines malware, botnets, phishing, pharming and spamming as forms of DNS abuse if they exploit the DNS as a distribution medium. As the body that regulates mainly generic domain name extensions (‘gTLDs’), ICANN can require gTLD operators to take anti-abuse measures by including appropriate provisions in the contracts that registry operators and registrars have to sign. That’s what happened last year, when the following requirements were added to the contracts:
Mandatory abuse contact points
Every registrar and registry operator is required to provide an e-mail address or web form that people can use to report abuse.
Investigation and appropriate action
If an issue is reported to a registrar and there is sufficient evidence of DNS abuse, the registrar must take appropriate action immediately.
Cooperation with authorities
A registrar must have a 24/7 contact point that competent authorities can use to report illegal activities.
Impact on DNS abuse
Since introducing those rules, ICANN has actively monitored their compliance and enforcement. Over the last year, more than 4,000 malicious domain names have been disabled under the new rules. ICANN itself is particularly satisfied with the ‘mitigation rate’: the percentage of DNS abuse reports that have led to successful intervention. After the new rules came in, the rate rose from 84 to 94 per cent by the end of 2024.
Encouraging for the domain name industry
The results are very encouraging for ICANN and others who want to see more done to prevent abuse. Before the rules took effect, they received a lot of criticism. Registrars and registries were worried about an increased administrative burden. Privacy experts had concerns about the requirement to cooperate with competent authorities, while some experts feared that DNS abuse was defined too narrowly. The European Commission applies a much wider definition, for example. ICANN’s new rules don’t apply to country-code domains such as .nl. Nevertheless, we’ve introduced a number of similar anti-abuse rules, with similarly good results.
.nl Transparency Report
We have our own anti-abuse policy, under which hosting service providers and registrars play a major role. It’s partly thanks to that policy that the .nl domain is recognised as one of the world’s most secure large country-code domains. We publish information about the number of abuse reports we receive, and the outcome of them, in a quarterly Transparency Report.
More information
ICANN presented its data at its recent meeting in Seattle, and a recording of the presentation is available on line.
