ICANN rules could hamper agentic AI domain regs

Bulk registration of domain names is likely to become more difficult under policy proposals being considered in ICANN, potentially limiting the potential of agentic AI.

The Generic Names Supporting Organization is in the very early stages of a Policy Development Process that aims to “introduce friction” into bulk registration shopping carts for untrusted registrants.

The PDP was initially conceived last year as targeting API-based registrations, which are believed to be often used by Bad Guys to bulk-register domains for abusive purposes like malware and spam.

But the first version of the draft charter that will govern the PDP is now using “technology neutral” language, recognizing that APIs may not be as relevant in future. Bots and agentic AI are not directly mentioned, but it’s clearly what the authors have in mind.

The charter states:

This PDP would seek to introduce a requirement to put safeguards in place to ensure that registrants, particularly new or untrusted accounts, cannot immediately access domain name registrations at scale until they have demonstrated basic trustworthiness.

Quite how the limits would be put in place, what “at scale” means numerically, and how “trustworthiness” would be defined and earned, are all issues that would have to be hashed out by the PDP working group.

Whatever rules are created would be binding on all ICANN-accredited registrars and their resellers.

The PDP working group has yet to be created, and it seems the absolute earliest any agreed policy could be approved by ICANN would be the end of next year, with the rules coming into effect perhaps the following year.

The PDP is set to be the second of the Domain Abuse Mitigation efforts that began last year under pressure from governments and others and studies such as ICANN’s INFERMAL, which discovered that registrars with freely available APIs were far more likely to be abused by ne’er-do-wells.

1 Comment Tagged: agentic ai, bulk registrations, dns abuse, ICANN, pdp

A dot-brand walks into a bar

“He doesn’t need a VPN, his network works above the DNS. Do you know what the DNS is?”

When he said it, the 80-year-old barfly I found myself in a long conversation with at the weekend had no idea what I do for a living.

He was not a technical guy. Long-retired, his career had been in a completely different field. He was bragging about one of his high-flying relatives’ technical nous and impressive homeworking set-up.

The “above the DNS” stuff was how this set-up had been translated for him by another relative.

I told him I know a thing or two about DNS (two things!) and explained how it works and why what he just said didn’t make much sense to me. I told him about the root, Verisign, .com, ICANN, and so on.

“He doesn’t need any of that stuff,” he reiterated. “His network works above the DNS.”

About 10 minutes of head-scratching later, the penny finally dropped. Dude was talking about a dot-brand. Like working on a corporate network running a dot-brand was somehow escaping the DNS altogether.

As soon as I had that epiphany, and because I already knew what industry the relative worked in, and which country he came from, I was able to, from my knowledge of the root zone, correctly identify his employer.

I felt pretty smug about that, truth be told.

While a lot of dot-brands obtained in 2012 still remain dormant, some are in use, even if only or primarily internally, and it turns out some have their enthusiastic — proud, even — advocates in random bars at the ass-end of nowhere.

It’s only anecdotal evidence, but if even non-techie retirees in small-town ex-pat bars kinda know what dot-brands are and why they are useful, even if some of the technical details escape them, I wonder whether the concept is approaching mainstream.

Comment Tagged: dot-brands

.dot is coming very soon

New new gTLD registry Dish DBS has revealed the launch dates for its .dot gTLD, and it’s coming pretty soon.

Information filed with ICANN shows that .dot is due to go to sunrise in just a couple weeks — from July 21 to October 19 — with a 12-day Early Access Period where early adopters can pay premium prices starting the next day.

General availability is scheduled for November 2. Pricing has not been revealed.

If you’re wondering about making a play for dot.dot, forget about it — the registry is using that as its primary domain for the gTLD.

The space will be open to all, with Dish describing it as “designed for builders and the things they create… products, communities, brands, or ideas worth a name of their own”.

It’s Dish’s second gTLD launch this year after .latino, which went GA on June 12.

.latino hasn’t exactly leapt out of the gates — it has fewer than 800 names in its zone file today and Google results are showing mainly a TLD-hopping movie piracy site and a Vietnamese gambling site.

Comment Tagged: .dot, .latino, dish, launch, new gTLDs

GoDaddy may “exit India” over cybersquatting legal battle

GoDaddy has said it may be forced to leave the Indian market if a court ruling forcing it and other registrars to reveal the identities of registrants is not reversed, according to a report.

Reuters has scooped 5,000 pages of documents the company filed as part of its appeal of a December 2025 court ruling, which said that registrars must hand over Whois info to parties with “legitimate interests” within 72 hours.

In its High Court appeal, GoDaddy said it has no way to determine who has a legitimate interest to such data, and that to hand it over would put its customers privacy and security at risk, Reuters reported.

Namecheap and Hosting Concepts (Registrar.eu) have also challenged the ruling, the report said.

The December ruling came as a result of lawsuits filed by 20 companies including Amazon, McDonald’s and Microsoft, which are worried about cybersquatters, phishers and fraudsters impersonation their brands.

ICANN already has policies in place that deal with when registrars have to hand over Whois/RDAP records, but they largely concern DNS abuse like phishing and malware rather than IP infringement and fraud.

Comment Tagged: godaddy, privacy, rdap, whois

Verisign will kill off 37 Kevins (and 22,000 others), complaint claims

Verisign’s plans to shut down a bunch of legacy services in the .name gTLD has been challenged by a registrant who believes he will lose his domains and email addresses if the registry goes ahead.

Doytchin Spiridonov, who works for Bulgarian registrar Dom.bg, has filed a Request for Reconsideration with ICANN, asking it to reverse its approval of Verisign’s Registry Service Evaluation Process requests that would enable it to turn off services that have been running for over 20 years.

As I reported in May, Verisign wants to stop selling third-level domains and related email services in .name, bringing the zone into line with virtually ever other gTLD, and delete existing names and emails in the process.

Spiridonov, who owns at least three third-level names, did the legwork on the .name zone file and discovered 22,288 domains would be affected. That includes 37 of my fellow Kevins!

His RfR (pdf) makes the case that ICANN’s approval of Verisign’s request was pretty opaque, involving private meetings between company and Org over several months.

“The approvals may adversely affect my ability to continue holding these registrations, may require migration to alternative services, may result in financial loss associated with prepaid registration periods, and may cause operational disruption and loss of continuity of internet identity associated with the affected registrations,” he wrote.

He further claims that Verisign misrepresented the impact of the changes in its RSEP, in which it stated that “There will not be any effect on the life cycle of domain names”.

Spiridonov says that the deletion of 22,000 domains makes this claim plainly untrue.

His RfR will be handled by ICANN’s board of directors.

Comment Tagged: .name, bgc, dom.bg, reconsideration, rfr, verisign

Google names the dates for .fly launch

Google seems to have accelerated its launch plans for .fly, one of the 2012-round gTLDs it’s been sitting on for over a decade.

The company’s registry division has notified ICANN that it plans to open its mandatory sunrise period for .fly on September 1 and keep it open until November 9.

General availability for the gTLD, which according to its 2012 application will be open to all with no eligibility restrictions, seems to have been scheduled for November 10.

Earlier documentation filed with ICANN showed early 2027 launch dates.

The original application states that the namespace is intended for, as you might expect, airlines and the travel industry. As such, it would compete with the likes of .travel and .aero.

Google has already registered get.fly to itself, but the name does not yet appear to resolve.

Comment Tagged: .fly, google, ICANN, launch, new gTLDs, sunrise

Harassment down, bitchiness up at ICANN

ICANN’s Ombuds dealt with 50% more cases in its last-reported year, with most of the growth attributable to community members who just can’t seem to get along.

In a recently published annual report (pdf), covering the period to the end of June 2025 (yes, it really is published a whole year after the fact), the Ombuds said that it opened 248 tickets in the year.

But 212 of those — basically the same as the previous year — were ruled “out of scope”, perhaps because they were requests for information or help rather that outright complaints.

The remaining 36, up from 24 in the prior year, were ruled “in-scope”. Eight of those cases were complaints.

The Ombuds splits cases into two buckets — “unfairness” and “interpersonal and relational”. Unfairness cases were flat at 16, but down as a percentage from 67% to 44% due to the interpersonal category growing from seven cases to 20.

The interpersonal bucket refers to how community members interact in their working groups and such. It covers harassment, conflict, uncivil language and behavior.

Combined, cases concerning these behaviors accounted for 56% of the total, but the Ombuds reported that only two of those were at the level of claims of harassment.

Comment Tagged: harassment, ICANN, ombuds

A free, ethical new gTLD? Shurely shome mishtake

Another new gTLD applicant has revealed its plans, this time for a namespace where domains are given away for free and the enemy is Big Tech.

The Human-Centered Computing Foundation, a non-profit founded in Colorado last November, says it plans to apply for .self in the current ongoing ICANN application round.

It says it has already been approved under ICANN’s Applicant Support Program, meaning its application costs will be deeply discounted from the $227,000 standard base fee.

The organization has published little information about its plans, other than to say .self will be “designed and implemented from the ground up to support self-hosting”.

HCCF says it opposes the “prevailing economic models of the digital age — surveillance capitalism and entrapping SaaS platforms” that “prioritize corporate shareholder value over the fundamental needs, privacy, and autonomy of the individual.”

Because the domains will be free, domain investors are not welcome.

The organization’s web site lists Riley O’Donnell and Lucas Silva as CEO and COO respectively.

A search on DI’s Stringtel tool show domains ending in “self” occur about as frequently as existing gTLDs “contractors”, “bike” and “tattoo”, with “yourself” and “myself” counting for about half of the volume.

Comment Tagged: .self, hccf, Human-Centered Computing Foundation, ICANN, new gTLDs

Blacknight acquired by Your.Online

Blacknight Solutions, Ireland’s first ICANN-accredited registrar, has been bought by Your.Online for an undisclosed sum.

The registrar joins dozens of brands, mainly but not exclusively in the hosting space, under the Your.Online umbrella.

Your.Online describes itself as a “group of founder-led digital service providers”, and as such Blacknight founders Michele Neylon and Paul Kelly are expected to stick around in their current leadership roles.

Neylon said on social media that the existing staff will also be retained and that customers should not notice anything different due to the transaction.

Other registrar brands in the group include Gandi, Heart Internet, and DI sponsor Realtime Register.

Your.Online formed a few years ago from the merger of Gandi and Total Webhosting Solutions.

Comment Tagged: acquisitions, blacknight, your.online

“Bulletproof” registrar gets an ICANN bollocking

ICANN has slapped an intensely privacy-focused registrar that compares its stance on takedowns to Elon Musks with a lengthy breach-of-contract notice, claiming that the company is disregarding legitimate abuse reports for no good reason.

Estonia-based Fewmoretaps, which changed its brand to Trustname.com not long after its accreditation was approved in early 2024, has been friendly to malware distributors that use its services, according to ICANN.

The breach notice claims that Trustname, after it had discovered that an abuse report was valid and that one of its customers’ domains was being used to spread malware, did not suspend the domain as required.

Rather, it gave the registrant a three-day headsup to move their domain to another registrar, according to ICANN.

It additionally ignored multiple abuse reports, often for spurious reasons, the notice claims, often only taking action on abusive domains after ICANN Compliance itself got it touch.

Trustname says it is a “registrar built for businesses in competitive niches that often face false or bad-faith abuse reports” and makes hay out of the fact that it offers “bulletproof” privacy by masking registrants details behind two different proxy services located in different jurisdictions.

While the company’s web site claims ad nauseam that its services are not to be used for illegal purposes such as child abuse material and opioid sales, it boldly states that it “disregards” copyright infringement notices.

“Like Elon Musk, we have a strong aversion to individuals who exploit the DMCA, as we believe it lacks legal authority for the vast majority of the world’s population,” the site states.

IP matters are not covered by ICANN contracts, which defined abuse as malware, pharming, phishing and a subset of spam, of course.

Trustname’s site states that it will only take action against domains in “extreme scenarios”.

Such scenarios include “using your website to host illegal content (that we have confirmed after thorough investigations) and getting court orders from all three jurisdictions.”

The three jurisdictions are the US and Saint Kitts & Nevis, where its proxy partners are located, and its home nation of Estonia. Saint Kitts-based Harakiri (Perfect Privacy LLC) was specifically chosen because court orders are hard to come by there.

The company additionally states, in what could be interpreted as an admission of guilt by ICANN Compliance standards:

We will never take any action against a domain name simply because someone filed a complaint – even if your report indicates a violation of our terms. We will only be obligated to take action when we get the relevant court orders.

Trustname, which had fewer than 1,500 gTLD domains under management at the last count, has been given until July 1 to come back into compliance or risk losing its accreditation.

Comment Tagged: abuse, breach, compliance, ICANN, trustname