ICANN has progressively strengthened requirements in its contracts with generic toplevel domain (gTLD) registry operators and registrars. These obligations, set forth in the Registrar Accreditation Agreement (RAA), the Registry Agreements (RAs) and the ICANN policies incorporated into them, include a wide range of requirements designed to preserve the security, stability and resilience of the DNS.

Since 2013, the RAA has required registrars to maintain public abuse contacts, publish a description of their abuse procedures and reasonably investigate and respond to reports of DNS abuse. The RAs have required registries to publish abuse contact information and perform technical analyses to determine whether their sponsored domain names are being used to perpetrate DNS abuse. Additional requirements such as those related to the accuracy and accessibility of registration data and taking action to remove orphan glue records42 associated with malicious activity are also present in the agreements enforced by ICANN.

In 2024, amendments introduced further enhancements: they defined DNS abuse for the purposes of the RA and RAA, required simple abuse reporting channels with timely acknowledgement and obligated providers to take mitigation actions promptly once presented with credible evidence. ICANN’s Contractual Compliance function monitors and vigorously enforces these contractual requirements. As part of its wider DNS Abuse Mitigation Program, ICANN also provides capacity development and training to community members engaged in combating DNS abuse. New transparency tools, such as the Domain Metrica platform, provide public visibility into abuse patterns across the DNS, while the Inferential Analysis of Maliciously Registered Domains (INFERMAL) project aimed to better understand attackers’ preferences regarding DNS abuse.

Looking ahead, ICANN and its stakeholders are discussing additional preventive measures. Ideas under consideration include requiring registrars to review associated domains once abuse is confirmed in one of them and adding safeguards to introduce friction to the registration process prior to domain activation, particularly for bulk domain purchases by new customers.

Europol

About

Case Studies from Europol