Abuse & Legal Requirements

DNS Abuse: Industry Definition

DNS Abuse defined

Malware, botnets, phishing, pharming, and spam (when used as a delivery mechanism for the other four). These five categories constitute DNS Abuse. Activities that do not fall within this definition may still be illegal but are addressed through other mechanisms (hosting provider takedown, law enforcement, court orders).

Key distinction

DNS Abuse vs content abuse: DNS Abuse involves the domain name system itself being used as the vehicle for harm. Content-level issues (defamation, copyright infringement on a webpage, objectionable content) are the responsibility of the hosting provider, not the domain registrar. Registrars act on the domain layer (DNS resolution, registration data), not the content layer.

2024 contract amendments

ICANN's April 2024 amendments to the Base gTLD Registry Agreement and RAA created new obligations for registrars and registries to promptly take reasonable and appropriate action to stop or otherwise disrupt DNS Abuse.

Abuse Contact Requirements

Published contact

Registrar must publish an abuse contact email in WHOIS/RDAP and on the registrar website. Contact must be consistent across all registries where the registrar is accredited.

24/7 availability

Abuse contact must be reachable around the clock. Single-person dependency is a structural risk; at least two named individuals should be able to process inbound abuse outside business hours.

Acknowledgement

ICANN RAA requires timely response to abuse complaints. Best practice: automated acknowledgement confirming receipt, providing a reference number, and stating expected response time.

ICANN compliance

ICANN's compliance team may send complaints directly to the registrar's abuse contact. The RAA requires registrars to respond to ICANN abuse complaints in a timely manner. Failure to respond creates procedural risk with ICANN compliance.

Complaint Handling

Automated detection

Registrars should implement automated detection for known abuse patterns (phishing, malware, brand impersonation) across all TLDs in portfolio.

Response SLAs

Best practice response times: phishing/malware (4 hours initial response), law enforcement requests (24 hours), general abuse complaints (48 hours). SLAs should be documented and measurable.

Determination

Abuse determinations must be documented: what was reported, what was found, what action was taken, and why. Consistency across agents requires documented criteria.

Mitigation tools

Registrar has two primary tools: ClientHold (suspends DNS resolution, domain stops working) and DNS changes (redirect to warning page or null route). Per-TLD rules for when each can be applied vary by registry.

Abuse Mitigation by TLD Type

gTLDs (.com, .net, .org)

Registrar can apply ClientHold directly. DNS changes possible via registrar zone management. Standard ICANN RAA obligations apply.

EU ccTLDs (.de, .fr, .nl)

ClientHold may be subject to registry-specific rules. DENIC (.de) has specific procedures for abuse-related holds. Some registries require the registrar to notify the registrant before applying ClientHold.

Restricted ccTLDs (.hr, .bg)

Mitigation actions may require registry coordination. Document per-TLD what the registrar is permitted to do unilaterally vs what requires registry intervention.

UDRP (Uniform Domain Name Dispute Resolution Policy)

Scope

Mandatory for all gTLDs and some ccTLDs. Trademark holders may file complaints against infringing domain registrations.

Process

Complaint filed with approved dispute resolution provider (WIPO, NAF, ADR.eu, etc.). Registrar must lock the domain during proceedings (serverDeleteProhibited, serverTransferProhibited).

Deadlines

UDRP deadlines are strict. Respondent has 20 days to respond. Decision enforced by registry within 10 business days unless court action filed within 10 business days of decision.

Registrar role

Registrar must: verify and provide registrant data to the dispute provider, lock the domain, implement the decision (transfer or cancellation) within 10 business days.

URS (Uniform Rapid Suspension)

Scope

Available for new gTLDs only (not legacy gTLDs or ccTLDs). Faster process for clear-cut trademark infringement.

Action

If URS complaint succeeds, domain nameservers are redirected to an informational page. Domain is not transferred or deleted; it remains registered but non-functional for the registrant.

Duration

URS suspension lasts for the remainder of the registration period.

EU Digital Services Act (DSA)

Scope

Applies to intermediary service providers operating in the EU, including domain registrars. Establishes obligations for handling illegal content notices and authority orders.

Authority requests

Registrars must process orders from judicial or administrative authorities to act against illegal content. Requests must be processed without undue delay.

Contact point

Registrars must designate a single point of contact for authorities and for recipients of the service. Contact must be accessible electronically.

Transparency

Registrars must publish annual transparency reports on content moderation activities, authority orders received, and actions taken.

Authority & Law Enforcement Requests

Police/law enforcement

Registrar must have a defined process for handling law enforcement requests for domain data, domain suspension, or domain seizure. Requests must be authenticated and documented.

Data requests

Under GDPR, registrars must process legitimate data access requests. Under NIS2 Article 28, registrars must respond within 72 hours. Data disclosure policies must be published.

Court orders

Registrar must comply with valid court orders for domain suspension, transfer, or data disclosure. Orders must be verified for authenticity and jurisdiction.

Copyright/trademark

DMCA notices (US), EU Copyright Directive notices, and trademark infringement notices must be processed according to the applicable legal framework.

Reporting Abuse