I
ICANN Content
Guest
(Last updated November 2025).
The Internet Corporation for Assigned Names and Numbers (ICANN) has established a Domain Name System (DNS) Abuse Mitigation Program. This program serves as a centralized platform for ICANN to address various aspects of DNS Abuse and aims to support the ICANN community in mitigating harmful activities associated with domain names.
DNS Abuse, as defined by ICANN, refers to:
This set of harms was recognized by the ICANN Board as actionable elements of DNS Abuse for ICANN, and aligns with the 5 April 2024 amendments to the Registrar Accreditation Agreement (RAA) and the Base Generic Top-Level Domains (gTLD) Registry Agreement regarding DNS Abuse mitigation obligations.
ICANN org strives to combat DNS Abuse in accordance with ICANN Bylaws, and policies. An ICANN cross-functional team supports a three-pronged approach to combating DNS Abuse. This includes:
ICANN coordinates the allocation and assignment of names in the DNS root zone. It also develops and coordinates the implementation of policies for registering second-level domain names in generic top-level domains when coordinated or uniform resolution is needed to help keep the DNS open, interoperable, secure, stable, and resilient. In performing this function, ICANN is focused on DNS-level activities and actions. ICANN's Bylaws expressly prohibit ICANN from imposing rules and restrictions on services that use the Internet's unique identifiers or the content that such services carry or provide, except in narrow circumstances set out in the ICANN Bylaws.
ICANN Domain Metrica aims to improve the way domain data is captured, measured, and analyzed. Built to evolve over time to incorporate new data sources, measurement methodologies, and metrics, the platform provides information on many aspects of domains, and groups of domains. Learn more in the ICANN Domain Metrica brochure.
ICANN's Identifier Technology Health Indicators (ITHI), or ITHI Metrics, also provide a way to analyze trends in DNS security threats for the community. For more information, visit the ITHI webpage.
Capacity development and training includes the DNS ecosystem security offerings on ICANN Learn, as well as virtual and in-person training delivered by the ICANN's Office of the Chief Technology Officer (OCTO) Technical Engagement and Global Stakeholder Engagement teams, and in collaboration with community partners.
Inferential Analysis of Maliciously Registered Domains (INFERMAL) is an ICANN-funded project aimed at exploring attackers' preferences regarding DNS Abuse. Cybercriminals often register domains to launch Internet-scale attacks, including phishing, malware distribution, and spam campaigns. Various factors may influence why these bad actors prefer certain registrars over others. INFERMAL is the first study to systematically analyze these preferences. After two years of rigorous research, the final report is now available, exploring key findings and recommendations that can inform registrars, registries, and the wider Internet community.
Generic Names Supporting Organization (GNSO) policy development was anticipated as an additional mitigation against DNS Abuse, as the contractual amendments were being developed. The GNSO has requested an Issue Report on DNS Abuse, the necessary first step in initiating a Policy Development Process (PDP). The data, expertise, and additional tools established by ICANN will aid the PDP in its efforts to further mitigate DNS Abuse.
The Special Interest Forums on Technology (SIFT) is an online discussion platform that provides an ad hoc forum for the ICANN community and org. They use this forum to engage in technical discussions and review contributions by interested technical participants on emerging technologies and trends related to the Internet's identifier system. This includes domain names and the DNS, Internet Protocol (IP) addresses, autonomous system numbers, and various protocol parameter assignments. More information about SIFT can be found here.
After a reporter has submitted an abuse complaint to the registrar of record regarding the abuse of a domain name in a gTLD, and after a reasonable time, if the reporter believes the registrar did not fulfill its obligations according to the Registrar Accreditation Agreement (see Section 3.18), then the reporter may file a complaint with ICANN Contractual Compliance here: abuse involving a domain name. For more information on abuse complaint handling, visit the ICANN Contractual Compliance Handling Report webpage.
ICANN Contractual Compliance (Compliance) enforces the contractual obligations set forth in ICANN's policies and agreements, including the Base Registry Agreement (Base RA) and the Registrar Accreditation Agreement (RAA). The abuse-related provisions enforced by Compliance include Specification 6 Section 4 of the Base RA and Section 3.18 of the RAA which, since 5 April 2024, contain requirements for registry operators and registrars to take mitigation actions against well-evidenced DNS Abuse. Compliance enforces these requirements, and all other obligations across all ICANN's policies and agreements, through the processing of external complaints and by conducting certain proactive monitoring activities and regularly scheduled audits. Additional information about Compliance's Audit Program can be found on the Contractual Compliance Audit Program webpage.
Additionally, Compliance publishes monthly reports with information about complaints received and related enforcement actions. These include reports dedicated to the enforcement of DNS Abuse requirements that are updated every month.
More information about the interpretation and enforcement of the DNS Abuse requirements can be found by reviewing the Advisory: Compliance With DNS Abuse Obligations in the Registrar Accreditation Agreement and the Registry Agreement.
Compliance has also published "Submitting DNS Abuse Complaints To ICANN: A Step-by-Step Guide", which provides clear instructions for submitting actionable DNS Abuse complaints to ICANN. We invite you to read it and learn more about how to engage with ICANN's enforcement processes.
If you have questions about ICANN's program, please direct them to [email protected].
DNS Abuse Mitigation Program (October 2024)
DNS Security Threat Mitigation Program (September 2024)
DNS Security Threat Mitigation Program (April 2023)
Continue reading...
The Internet Corporation for Assigned Names and Numbers (ICANN) has established a Domain Name System (DNS) Abuse Mitigation Program. This program serves as a centralized platform for ICANN to address various aspects of DNS Abuse and aims to support the ICANN community in mitigating harmful activities associated with domain names.
DNS Abuse, as defined by ICANN, refers to:
- Botnets
- Malware
- Pharming
- Phishing
- Spam (when spam serves as a delivery mechanism for the forms of DNS Abuse listed above)
This set of harms was recognized by the ICANN Board as actionable elements of DNS Abuse for ICANN, and aligns with the 5 April 2024 amendments to the Registrar Accreditation Agreement (RAA) and the Base Generic Top-Level Domains (gTLD) Registry Agreement regarding DNS Abuse mitigation obligations.
Addressing the Issue
ICANN org strives to combat DNS Abuse in accordance with ICANN Bylaws, and policies. An ICANN cross-functional team supports a three-pronged approach to combating DNS Abuse. This includes:
- Contributing data and expertise to fact-based discussions.
- Providing tools to the ICANN community.
- Enforcing contractual obligations with registries and registrars.
ICANN coordinates the allocation and assignment of names in the DNS root zone. It also develops and coordinates the implementation of policies for registering second-level domain names in generic top-level domains when coordinated or uniform resolution is needed to help keep the DNS open, interoperable, secure, stable, and resilient. In performing this function, ICANN is focused on DNS-level activities and actions. ICANN's Bylaws expressly prohibit ICANN from imposing rules and restrictions on services that use the Internet's unique identifiers or the content that such services carry or provide, except in narrow circumstances set out in the ICANN Bylaws.
Contributing Data and Expertise to Fact-Based Discussions
ICANN Domain Metrica aims to improve the way domain data is captured, measured, and analyzed. Built to evolve over time to incorporate new data sources, measurement methodologies, and metrics, the platform provides information on many aspects of domains, and groups of domains. Learn more in the ICANN Domain Metrica brochure.
ICANN's Identifier Technology Health Indicators (ITHI), or ITHI Metrics, also provide a way to analyze trends in DNS security threats for the community. For more information, visit the ITHI webpage.
Capacity development and training includes the DNS ecosystem security offerings on ICANN Learn, as well as virtual and in-person training delivered by the ICANN's Office of the Chief Technology Officer (OCTO) Technical Engagement and Global Stakeholder Engagement teams, and in collaboration with community partners.
Providing Tools to the ICANN Community
Inferential Analysis of Maliciously Registered Domains (INFERMAL) is an ICANN-funded project aimed at exploring attackers' preferences regarding DNS Abuse. Cybercriminals often register domains to launch Internet-scale attacks, including phishing, malware distribution, and spam campaigns. Various factors may influence why these bad actors prefer certain registrars over others. INFERMAL is the first study to systematically analyze these preferences. After two years of rigorous research, the final report is now available, exploring key findings and recommendations that can inform registrars, registries, and the wider Internet community.
Generic Names Supporting Organization (GNSO) policy development was anticipated as an additional mitigation against DNS Abuse, as the contractual amendments were being developed. The GNSO has requested an Issue Report on DNS Abuse, the necessary first step in initiating a Policy Development Process (PDP). The data, expertise, and additional tools established by ICANN will aid the PDP in its efforts to further mitigate DNS Abuse.
The Special Interest Forums on Technology (SIFT) is an online discussion platform that provides an ad hoc forum for the ICANN community and org. They use this forum to engage in technical discussions and review contributions by interested technical participants on emerging technologies and trends related to the Internet's identifier system. This includes domain names and the DNS, Internet Protocol (IP) addresses, autonomous system numbers, and various protocol parameter assignments. More information about SIFT can be found here.
Resources for Registries and Registrars
- Advisory: Compliance With DNS Abuse Obligations in the Registrar Accreditation Agreement and the Registry Agreement
- Framework for Registry Operators to Respond to Security Threats
- Advisory, New gTLD Registry Agreement Specification 11 (3)(b)
- Security Response Waiver (SRW) for Registrars
- Security Response Waiver (SRW) for Registry Operators (formerly Expedited Registry Security Request)
- ICANN Monitoring System API (MoSAPI) User Guide – In addition to service level agreement (SLA) performance information, registries can access daily feeds from ICANN Domain Metrica system via the MoSAPI.
Resources for End Users
- Contracted Party House Publication: Guide to Abuse Reporting Practices
- Contracted Party House Publication: Minimum Required Information for WHOIS Data Requests
After a reporter has submitted an abuse complaint to the registrar of record regarding the abuse of a domain name in a gTLD, and after a reasonable time, if the reporter believes the registrar did not fulfill its obligations according to the Registrar Accreditation Agreement (see Section 3.18), then the reporter may file a complaint with ICANN Contractual Compliance here: abuse involving a domain name. For more information on abuse complaint handling, visit the ICANN Contractual Compliance Handling Report webpage.
Enforcing Contractual Obligations with Registries and Registrars
ICANN Contractual Compliance (Compliance) enforces the contractual obligations set forth in ICANN's policies and agreements, including the Base Registry Agreement (Base RA) and the Registrar Accreditation Agreement (RAA). The abuse-related provisions enforced by Compliance include Specification 6 Section 4 of the Base RA and Section 3.18 of the RAA which, since 5 April 2024, contain requirements for registry operators and registrars to take mitigation actions against well-evidenced DNS Abuse. Compliance enforces these requirements, and all other obligations across all ICANN's policies and agreements, through the processing of external complaints and by conducting certain proactive monitoring activities and regularly scheduled audits. Additional information about Compliance's Audit Program can be found on the Contractual Compliance Audit Program webpage.
Additionally, Compliance publishes monthly reports with information about complaints received and related enforcement actions. These include reports dedicated to the enforcement of DNS Abuse requirements that are updated every month.
More information about the interpretation and enforcement of the DNS Abuse requirements can be found by reviewing the Advisory: Compliance With DNS Abuse Obligations in the Registrar Accreditation Agreement and the Registry Agreement.
Compliance has also published "Submitting DNS Abuse Complaints To ICANN: A Step-by-Step Guide", which provides clear instructions for submitting actionable DNS Abuse complaints to ICANN. We invite you to read it and learn more about how to engage with ICANN's enforcement processes.
Latest Publications
2026 Publications- Announcement: ICANN Publishes January 2026 gTLD Registry Audit Report (January 2026)
- Announcement: ICANN Publishes New Step-by-Step Guide for Submitting DNS Abuse Complaints (November 2025)
- Blog: ICANN's Progress and Next Steps in Enforcing DNS Abuse Mitigation Requirements (October 2025)
- Blog: ICANN Publishes Insights and Clarifications on INFERMAL Study (June 2025)
- Blog: ICANN Domain Metrica Release Update: Access Now Open to All Users (February 2025)
- Recording: Webinar on INFERMAL - a Project Focused on Malicious Domain Registrations (February 2025).
- Blog: Building Better Tools: ICANN81 Updates on ICANN Domain Metrica and INFERMAL (December 2024)
- Blog: ICANN's DNS Abuse Mitigation Program: Key Updates from 2024 (December 2024)
- Announcement: New Report: ICANN's Enforcement of DNS Abuse Mitigation Requirements (November 2024)
- Blog: INFERMAL Project: Analyzing Features of Malicious Domain Registrations (October 2024)
- Blog: ICANN Domain Metrica Project Update and Timeline (October 2024)
- Blog: Updates on ICANN's Domain Abuse Activity Monthly Reports (October 2024)
- Blog: ICANN Launches Reports on the Enforcement of DNS Abuse Requirements (June 2024)
- Blog: ICANN's Enforcement of DNS Abuse Requirements: A Look at the First Two Months (June 2024)
- Blog: ICANN's New IDN Guidelines Help Strengthen DNS Abuse Mitigation (May 2024)
- Blog: A New ICANN Project to Measure Metadata on Domain Names (February 2024)
- Blog: ICANN Publishes Paper on Defense Mechanisms Against Harmful Internet Content (December 2023)
- Blog: ICANN's Contracted Parties Approve New Obligations to Mitigate DNS Abuse (December 2023)
- Blog: Update on ICANN-Funded INFERMAL Project Designed To Combat DNS Abuse (October 2023)
- Blog: ICANN Contracted Parties Set to Vote on Proposed DNS Abuse Amendments (October 2023)
- Blog: ICANN's "Day of DNS Abuse Discussions" Draws More Than 125 Participants (September 2023)
- Blog: ICANN to Hold Meeting in Vietnam on DNS Abuse (August 2023)
- Blog: ICANN and Contract Negotiations Update: Improved DNS Abuse Requirements (May 2023)
- Blog: New ICANN Project Explores the Drivers of Malicious Domain Name Registrations (April 2023)
- Blog: ICANN and Contracted Parties Negotiate About Improved DNS Abuse Requirements (18 January 2023)
- Guest blog (APNIC): DNS Abuse Trends (14 June 2022)
- Blog: Keep Up to Date With ICANN's DNS Security Threat Mitigation Program (9 June 2022)
- Blog: ICANN Publishes DNS Abuse Trends (22 March 2022)
- Announcement: The Recording is Now Available for the ICANN Informational Session on DNS Abuse (8 November 2021)
- Announcement: Informational Session on DNS Abuse: Panel Discussion with the ICANN Board (18 October 2021)
- Blog: Update on ICANN's DNS Security Threat Mitigation Program (19 July 2021)
- Announcement: Webinar: ICANN DNS Security Threat Mitigation Program Update and Community Discussion (1 July 2021)
- Announcement: Adding Linguistic Diversity to the Domain Name Security Threat Information Collection and Reporting Project (14 June 2021)
- Blog: ICANN Org's Multifaceted Response to DNS Abuse (20 April 2020)
If you have questions about ICANN's program, please direct them to [email protected].
Archive
DNS Abuse Mitigation Program (October 2024)
DNS Security Threat Mitigation Program (September 2024)
DNS Security Threat Mitigation Program (April 2023)
Continue reading...
