DNS Abuse Mitigation Program

(Last updated 3 October 2024).

The Internet Corporation for Assigned Names and Numbers (ICANN) has established a Domain Name System (DNS) Abuse Mitigation Program. This program serves as a centralized platform for ICANN to address various aspects of DNS Abuse and aims to support the ICANN community in mitigating harmful activities associated with domain names.

DNS Abuse, as defined by ICANN, refers to:

1. Botnets
2. Malware
3. Pharming
4. Phishing
5. Spam (when spam serves as a delivery mechanism for the forms of DNS Abuse listed)

This set of harms was recognized by the ICANN Board as actionable elements of DNS Abuse for ICANN and aligns with the 5 April 2024 amendments to the Registrar Accreditation Agreement (RAA) and the Base Generic Top-Level Domains (gTLD) Registry Agreement regarding DNS Abuse mitigation obligations.

Addressing the Issue

ICANN org strives to combat DNS Abuse in accordance with ICANN Bylaws, and policies. An ICANN cross-functional team supports a three-pronged approach to combating DNS Abuse. This includes:

1. Contributing data and expertise to fact-based discussions
2. Providing tools to the ICANN community
3. Enforcing contractual obligations with registries and registrars

ICANN coordinates the allocation and assignment of names in the root zone of the DNS and coordinates the development and implementation of policies concerning the registration of second-level domain names in generic top-level domains for which uniform or coordinated resolution is reasonably necessary to facilitate the openness, interoperability, resilience, security and/or stability of the DNS. In performing this function, ICANN is focused on DNS-level activities and actions. ICANN's Bylaws expressly prohibit ICANN from imposing rules and restrictions on services that use the Internet's unique identifiers or the content that such services carry or provide, except in narrow circumstances set out in the ICANN Bylaws.

Contributing Data and Expertise to Fact-Based Discussions:

The Domain Abuse Activity Reporting (DAAR) system measures domain abuse and registration activity for generic top-level domains (gTLDs) and country code top-level domains (ccTLDs) that have volunteered in the program. DAAR continuously collects registration and security threat data from numerous reputation data feeds. Using the data, ICANN analysts identify and report the use of domain names for activities such as phishing, malware distribution, botnet activity, and spam (as a delivery mechanism). For more information, as well as DAAR monthly reports, visit the Domain Abuse Activity Reporting webpage.

ICANN org is working on advancing its DNS security measurement tools through a project called ICANN Domain Metrica, that will take DAAR to the next level. ICANN Domain Metrica aims to improve the way domain data is captured, measured, and analyzed. Built to evolve over time to incorporate new data sources, measurement methodologies, and metrics, the platform provides information on many aspects of domains, and groups of domains.

ICANN's Identifier Technology Health Indicators (ITHI), or ITHI Metrics, also provide a way to analyze trends in DNS security threats for the community. For more information, visit the ITHI webpage.

Capacity development and training includes the DNS ecosystem security offerings on ICANN Learn, as well as virtual and in-person training delivered by the ICANN's Office of the Chief Technology Officer (OCTO) Technical Engagement and Global Stakeholder Engagement teams, and in collaboration with community partners.

Providing Tools to the ICANN Community:

Inferential Analysis of Maliciously Registered Domains (INFERMAL) is an ICANN-funded project aimed at exploring attackers' preferences regarding DNS Abuse. Cybercriminals often register domains to launch Internet-scale attacks, including phishing, malware distribution, and spam campaigns. Various factors may influence why these bad actors prefer certain registrars over others. INFERMAL is the first study to systematically analyze these preferences.

The Special Interest Forums on Technology (SIFT) is an online discussion platform that provides an ad hoc forum for the ICANN community and org. They use this forum to engage in technical discussions and review contributions by interested technical participants on emerging technologies and trends related to the Internet's identifier system. This includes domain names and the DNS, Internet Protocol (IP) addresses, autonomous system numbers, and various protocol parameter assignments. More information about SIFT can be found here.

Resources for Registries and Registrars

• Advisory: Compliance With DNS Abuse Obligations in the Registrar Accreditation Agreement and the Registry Agreement
• Framework for Registry Operators to Respond to Security Threats
• Advisory re: Technical Analysis and Statistical Reporting of Security Threats (Specification 11 3b of the Base gTLD Registry Agreement)
• Security Response Waiver (SRW) for Registrars
• Security Response Waiver (SRW) for Registry Operators (formerly Expedited Registry Security Request)
• ICANN Monitoring System API (MoSAPI) user guide – In addition to service level agreement (SLA) performance information, registries can access daily feeds from ICANN's DAAR system via the MoSAPI.

Resources for End Users

• Contracted Party House Publication: Guide to Abuse Reporting Practices
• Contracted Party House Publication: Minimum Required Information for WHOIS Data Requests

After a reporter has submitted an abuse complaint to the registrar of record regarding abuse of a domain name in a gTLD, and after a reasonable time, if the reporter believes the registrar did not fulfill its obligations according to the Registrar Accreditation Agreement (see Section 3.18), then the reporter may file a complaint with ICANN Contractual Compliance: abuse involving a domain name. For more information on abuse complaint handling, visit the ICANN Contractual Compliance Handling Report webpage.

Enforcing Contractual Obligations with Registries and Registrars:

ICANN Contractual Compliance (Compliance) enforces the contractual obligations set forth in ICANN's policies and agreements, including the Base Registry Agreement (Base RA) and the Registrar Accreditation Agreement (RAA). The abuse-related provisions enforced by Compliance include Specification 6 Section 4 of the Base RA and Section 3.18 of the RAA which, since 5 April 2024, contain requirements for registry operators and registrars to take mitigation actions against well-evidenced DNS Abuse. Compliance enforces these requirements, and all other obligations across all ICANN's policies and agreements, through the processing of external complaints and by conducting certain proactive monitoring activities and regularly scheduled audits. Additional information about Compliance's Audit Program can be found at the Contractual Compliance Audit Program webpage.

Additionally, Compliance publishes monthly reports with information about complaints received and related enforcement actions. These include reports dedicated to the enforcement of DNS Abuse requirements that are updated every month.

More information about the interpretation and enforcement of the DNS Abuse requirements can be found by reviewing the Advisory: Compliance With DNS Abuse Obligations in the Registrar Accreditation Agreement and the Registry Agreement.

Latest Publications

2025 Publications

• Recording: Webinar on INFERMAL - a Project Focused on Malicious Domain Registrations (February 2025).

2024 Publications

• Blog: Building Better Tools: ICANN81 Updates on ICANN Domain Metrica and INFERMAL (December 2024)
• Blog: ICANN's DNS Abuse Mitigation Program: Key Updates from 2024 (December 2024)
• Announcement: New Report: ICANN's Enforcement of DNS Abuse Mitigation Requirements (November 2024)
• Blog: INFERMAL Project: Analyzing Features of Malicious Domain Registrations (October 2024)
• Blog: ICANN Domain Metrica Project Update and Timeline (October 2024)
• Blog: Updates on ICANN's Domain Abuse Activity Monthly Reports (October 2024)
• Blog: ICANN Launches Reports on the Enforcement of DNS Abuse Requirements (June 2024)
• Blog: ICANN's Enforcement of DNS Abuse Requirements: A Look at the First Two Months (June 2024)
• Blog: ICANN's New IDN Guidelines Help Strengthen DNS Abuse Mitigation (May 2024)
• Blog: A New ICANN Project to Measure Metadata on Domain Names (February 2024)

2023 Publications

• Blog: ICANN Publishes Paper on Defense Mechanisms Against Harmful Internet Content (December 2023)
• Blog: ICANN's Contracted Parties Approve New Obligations to Mitigate DNS Abuse (December 2023)
• Blog: Update on ICANN-Funded INFERMAL Project Designed To Combat DNS Abuse (October 2023)
• Blog: ICANN Contracted Parties Set to Vote on Proposed DNS Abuse Amendments (October 2023)
• Blog: ICANN's "Day of DNS Abuse Discussions" Draws More Than 125 Participants (September 2023)
• Blog: ICANN to Hold Meeting in Vietnam on DNS Abuse (August 2023)
• Blog: ICANN and Contract Negotiations Update: Improved DNS Abuse Requirements (May 2023)
• Blog: New ICANN Project Explores the Drivers of Malicious Domain Name Registrations (April 2023)
• Blog: ICANN and Contracted Parties Negotiate About Improved DNS Abuse Requirements (18 January 2023)

2022 Publications

• Guest blog (APNIC): DNS abuse trends (14 June 2022)
• Blog: Keep Up to Date With ICANN's DNS Security Threat Mitigation Program (9 June 2022)
• Blog: ICANN Publishes DNS Abuse Trends (22 March 2022)

2021 Publications

• Announcement: The Recording is Now Available for the ICANN Informational Session on DNS Abuse (8 November 2021)
• Announcement: Informational Session on DNS Abuse: Panel Discussion with the ICANN Board (18 October 2021)
• Blog: Update on ICANN's DNS Security Threat Mitigation Program (19 July 2021)
• Announcement: Webinar: ICANN DNS Security Threat Mitigation Program Update and Community Discussion (1 July 2021)
• Announcement: Adding Linguistic Diversity to the Domain Name Security Threat Information Collection and Reporting Project (14 June 2021)

2020 Publications

• Blog: ICANN Org's Multifaceted Response to DNS Abuse (20 April 2020)

If you have questions about ICANN's program, please direct them to [email protected].

Archive

DNS Security Threat Mitigation Program (September 2024)

DNS Security Threat Mitigation Program (April 2023)