Subject: Re: [provreg] Extension for an abuse contact in Domain objects?

From: "Michele Neylon :: Blacknight" <[email-masked]>
Date: Mon, 29 Oct 2012 13:22:42 +0000

Luis

ICANN has included an abuse contact in their proposal to registrars for a new whois format:
http://prague44.icann.org/meetings/prague2012/presentation-registration-data-directory-whois-03jun12-en.pdf

Regards

Michele

--
Mr Michele Neylon
Blacknight Solutions
Hosting & Colocation, Brand Protection
http://www.blacknight.com/
http://blog.blacknight.com/
http://mneylon.tel/
Intl. +353 (0) 59  9183072
Locall: 1850 929 929
Direct Dial: +353 (0)59 9183090
Fax. +353 (0) 1 4811 763
Twitter: http://twitter.com/mneylon
-------------------------------
Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty
Road,Graiguecullen,Carlow,Ireland  Company No.: 370845

________________________________________
From: [email-masked] [[email-masked]] on behalf of Luis Muñoz [[email-masked]]
Sent: 29 October 2012 12:59
To: [email-masked]
Subject: [provreg] Extension for an abuse contact in Domain objects?

This topic has more or less been discussed in various fora over the years with no evident conclusions. Is there any experience with this? Is there interest to develop an EPP extension to specify abuse contacts for Domain (and perhaps Host) objects?

Best regards

-lem

_______________________________________________
provreg mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/provreg

---

From: "Michele Neylon :: Blacknight" <[email-masked]>
Date: Mon, 29 Oct 2012 14:12:26 +0000

James - yeah. Without giving it a huge amount of thought we'd probably just have a standard abuse contact point in our whois template. 

________________________________________
From: Gould, James [[email-masked]]
Sent: 29 October 2012 14:10
To: Michele Neylon :: Blacknight; Luis Muñoz; [email-masked]
Subject: Re: [provreg] Extension for an abuse contact in Domain objects?

It looks like the proposal is to include a registrar abuse contact, which
would not be directly linked from the domains.  If so, this can be handled
outside of EPP.

--

JG

James Gould
Principal Software Engineer
[email-masked]

703-948-3271 (Office)
12061 Bluemont Way
Reston, VA 20190
VerisignInc.com

On 10/29/12 9:22 AM, "Michele Neylon :: Blacknight"
<[email-masked]> wrote:

>This topic has more or less been discussed in various fora over the years
>with no evident conclusions. Is there any experience with this? Is there
>interest to develop an EPP extension to specify abuse contacts for Domain
>(and perhaps Host) objects?
>
>Best regards
>
>-lem
>

---

From: "Gould, James" <[email-masked]>
Date: Mon, 29 Oct 2012 14:10:45 +0000

--
  
JG

James Gould
 
703-948-3271 (Office)
12061 Bluemont Way
Reston, VA 20190
VerisignInc.com

---

From: Luis Muñoz <[email-masked]>
Date: Mon, 29 Oct 2012 10:39:58 -0400

> James - yeah. Without giving it a huge amount of thought we'd probably just have a standard abuse contact point in our whois template. 

In this case, the contact would point to the Registrar -- handling this at the template level is certainly one way to go.

However, I was thinking along the lines of a per-object abuse contact that would point to the Registrant.

Best regards

-lem

---

From: "Michele Neylon :: Blacknight" <[email-masked]>
Date: Mon, 29 Oct 2012 14:50:59 +0000

Luis

Most of our registrants wouldn't know what what to do with an abuse report. As a hosting provider and registrar we end up having to pro-actively contact our clients when there are issues and explain to them in simple terms how to remedy them.
While I can see that kind of thing being of use to the more technically minded registrant I'd imagine that they're in a minority and would probably be more likely to have some kind of reseller access if they were registering larger number of domains .. 

Regards

Michele

________________________________________
From: Luis Muñoz [[email-masked]]
Sent: 29 October 2012 14:39
To: Michele Neylon :: Blacknight
Cc: Gould, James; [email-masked]
Subject: Re: [provreg] Extension for an abuse contact in Domain objects?

Best regards

-lem

---

From: "Gould, James" <[email-masked]>
Date: Mon, 29 Oct 2012 14:53:37 +0000

It doesn't look like an object level contact reference.  If a Registrar
has an abuse contact linked to it or embedded in it, than the abuse
contact information to include in whois can be automatically derived from
the sponsoring registrar without having to explicitly set another contact
on a per object basis.

--
  
JG

James Gould
 
703-948-3271 (Office)
12061 Bluemont Way
Reston, VA 20190
VerisignInc.com

On 10/29/12 10:39 AM, "Luis Muñoz" <[email-masked]> wrote:

>> James - yeah. Without giving it a huge amount of thought we'd probably
>>just have a standard abuse contact point in our whois template.
>
>In this case, the contact would point to the Registrar -- handling this
>at the template level is certainly one way to go.
>

---

From: Luis Muñoz <[email-masked]>
Date: Mon, 29 Oct 2012 11:37:13 -0400

> the sponsoring registrar without having to explicitly set another contact

I think those are different points of contact. A Registrar can have an abuse contact to deal with issues with (unresponsive?) Registrants. However, I'm more interested in giving the Registrant a mechanism to publish its own abuse contacts.

Best regards

-lem

---

From: Luis Muñoz <[email-masked]>
Date: Mon, 29 Oct 2012 11:47:46 -0400

> While I can see that kind of thing being of use to the more technically minded registrant I'd imagine that they're in a minority and would probably be more likely to have some kind of reseller acce…

Yes, the technical illiteracy argument is a very powerful deterrent. The same argument could be made about Tech contacts and the like, which in many cases end up being handled by a (hopefully better) informed third party. IMO this would be a point against a "mandatory" contact.

I think having an optional abuse contact defined for Domain objects would allow knowledgeable Registrants a mechanism to advertise the existence of this POC (and to some extend, a working abuse contact could be a data point in and on itself). Less inclined Registrants could simply refrain from providing this information, so the fallback would be the current status quo.

More competent Registrants would use this optional POC to advertise their preferred email for receiving complaints, sparing hosting technical contacts -- which in many cases belong to different organizational structures -- from having to sort through reports destined for other groups.

Certainly having a "back-office" solution (via web UI or an off-band process) to manage this type of contact information  would work for smaller volumes, but having API support for this would negate the need to provide such access for this purpose. Current resellers would then use the existing interfaces to provision this information just as they do with the rest of their contact data.

Best regards

-lem

---

From: "Michele Neylon :: Blacknight" <[email-masked]>
Date: Mon, 29 Oct 2012 15:54:23 +0000

Luis

But you're relying on "us" ie. registrars, to implement it.

Unless a registry operator made it mandatory for us (registrars) to do this I can't see why we'd want to, as it would add extra levels of complication in terms of user interfaces etc.,

And it would also need to be compatible with ICANN's whois policy on whois data formatting (assuming this becomes mandatory). 

Regards

Michele

________________________________________
From: Luis Muñoz [[email-masked]]
Sent: 29 October 2012 15:47
To: [email-masked]; Neylon:@
Cc: Gould, James; [email-masked]
Subject: Re: [provreg] Extension for an abuse contact in Domain objects?

Best regards

-lem

---

From: Luis Muñoz <[email-masked]>
Date: Mon, 29 Oct 2012 12:19:12 -0400

> Unless a registry operator made it mandatory for us (registrars) to do this I can't see why we'd want to, as it would add extra levels of complication in terms of user interfaces etc.,

True, in order to work it would have to be implemented by both, Registries and Registrars. But if, as it seems, Registrars will be required to provide an Abuse point of contact, then it's arguable that allowing Registrants to provide a more direct contact (or in the worst case, allowing for a standardized mechanism to keep that information up to date) would lessen the workload of the Registrar's Abuse POC.

Said implementation would be much easier if rough consensus existed beforehand. Raising awareness about this point would also help reduce redundant work and perhaps even lead to some collaboration in drafting a single extension for this task.

> And it would also need to be compatible with ICANN's whois policy on whois data formatting (assuming this becomes mandatory). 

Absolutely. However there's nothing in the recommendations so far that is explicitly incompatible with the addition of this information.

Best regards

-lem

---

From: "Gould, James" <[email-masked]>
Date: Mon, 29 Oct 2012 16:32:57 +0000

Is there truly a problem being solved by adding a new per-object contact
type with an abuse contact?  I'm assuming that the technical or registrant
contact can be contacted in the event of abuse at the object level.
Adding a new contact type across the registrars and registries is a large
change that would need to solve a real problem and be critical enough to
justify the change.  As far as the inclusion of a registrar level abuse
contact or a registry level abuse contact, I have the same question
whether there is a problem that needs to be solved?  Are clients currently
unable to report abuse using the registrar contact information currently
present whois?  Is this a nice to have set of information or a must have
based on a real world problem?

--
  
JG

James Gould
 
703-948-3271 (Office)
12061 Bluemont Way
Reston, VA 20190
VerisignInc.com

On 10/29/12 12:19 PM, "Luis Muñoz" <[email-masked]> wrote:

>> Unless a registry operator made it mandatory for us (registrars) to do
>>this I can't see why we'd want to, as it would add extra levels of
>>complication in terms of user interfaces etc.,
>
>True, in order to work it would have to be implemented by both,
>Registries and Registrars. But if, as it seems, Registrars will be
>required to provide an Abuse point of contact, then it's arguable that
>allowing Registrants to provide a more direct contact (or in the worst
>case, allowing for a standardized mechanism to keep that information up
>to date) would lessen the workload of the Registrar's Abuse POC.
>
>Said implementation would be much easier if rough consensus existed
>beforehand. Raising awareness about this point would also help reduce
>redundant work and perhaps even lead to some collaboration in drafting a
>single extension for this task.
>
>> And it would also need to be compatible with ICANN's whois policy on
>>whois data formatting (assuming this becomes mandatory).
>
>Absolutely. However there's nothing in the recommendations so far that is
>explicitly incompatible with the addition of this information.
>
>Best regards
>
>-lem
>

---

From: Luis Muñoz <[email-masked]>
Date: Mon, 29 Oct 2012 12:56:48 -0400

On Oct 29, 2012, at 12:32 PM, Gould, James wrote:

> type with an abuse contact?

Definitely. Sites like abuse.net exist to fill the gap, with varied levels of success. The gradual implementation of abuse contacts at the RIR level would also suggest the problem is real.

> I'm assuming that the technical or registrant

Yes, and that is precisely part of the problem.

A Domain object has three contacts: A "Registrant", a "Technical" and an "Administrative" contact. Which one is the right one for abuse complaints? In my experience, I've seen that the community tends to choose the technical contact.

For operations where this is the wrong choice, this means that special arrangements need to be made for mail to be forwarded to the right people in order to act on the complaints, which more often than not results in complaints that reach nowhere. I'm sure we can all setup mail forwarding with out hands tied, but apparently this is a very rare skill.

This trend is so prevalent, that many Registrants simply opted to use abuse@ as their tech contact. Here, the problem happens the other way around: Technical issues need to be extracted out of the sea of complaints.

Now, if there were a dedicated point of contact for abuse, each area would receive the messages they need and be able to easily act on them.

> justify the change.

Which is why I would argue it should be defined as optional and implemented by interested parties. I have no doubt that over time this will be mandatory due to operational needs.

> [...] Is this a nice to have set of information or a must have

There would be far less firewall rules if we had a mechanism like this in place. What happens now is that an abuse complaint is fired, no response is received, abuse continues, firewall rule is added. To some, this resolves the problem. However, this is not a sustainable strategy.

Best regards

-lem

---

From: Christopher Browne <[email-masked]>
Date: Mon, 29 Oct 2012 12:58:43 -0400

> based on a real world problem?

I think I broadly concur with that line of thinking.

It seems like a valuable idea to add an anti-abuse contact at the
registrar level, which does not seem like an EPP extension.

However, adding a new object at the per-domain level would be a costly
endeavour in a number of ways, and I'm not sure how this contact ought
to be distinguished from the technical contact.

>From a technical ("EPP protocol") perspective, a new contact type
wouldn't be any different from the existing types.  To make it useful
(e.g. - guaranteeing that the anti-abuse contact is somehow better
than the present technical contact) would require having a further set
of policy to enforce usefulness.

---

From: Luis Muñoz <[email-masked]>
Date: Tue, 30 Oct 2012 02:08:28 -0400

> of policy to enforce usefulness.

Yes, ideally there would be a policy layer further clarifying this. Is there merit in building this policy along with the extension?

Best regards

-lem

---

From: Antoin Verschuren <[email-masked]>
Date: Tue, 30 Oct 2012 09:54:32 +0100

Op 30-10-12 07:08, Luis Muñoz schreef:
>> wouldn't be any different from the existing types.  To make it 
>> useful (e.g. - guaranteeing that the anti-abuse contact is 
>> somehow better than the present technical contact) would require 
>> having a further set of policy to enforce usefulness.
> 
> Yes, ideally there would be a policy layer further clarifying
> this. Is there merit in building this policy along with the
> extension?

And even with a policy, experience shows it does not lead to better
population.
How many of you populate the MNAME field in your zone correctly ?
What's the difference ?

We've had a policy and pre-delegation checks for many years to
populate fields correctly, only to find out that registrars only
populated the fields so they could pass our tests, but still emails to
MNAME's were not replied to (they were sent to dev/null).

Same is true even for registrants.
Many registrars register domains on their legal entity in stead of
their customers because maintaining correct customer data at the
registry is too much hassle or their customers don't want their data
out there. Responding to abuse is a cost, so it is discouraged. They
play by the rules to pass the policy, but not more than that.

- -- 
Antoin Verschuren

Technical Policy Advisor SIDN
Meander 501, PO Box 5022, 6802 EA Arnhem, The Netherlands

P: +31 26 3525500  M: +31 6 23368970
Mailto: [email-masked]
XMPP: [email-masked]
HTTP://www.sidn.nl/