New Report: ICANN’s Enforcement of DNS Abuse Mitigation Requirements

The Internet Corporation for Assigned Names and Numbers (ICANN) is pleased to announce the release of a six-month report, "ICANN's Enforcement of DNS Abuse Mitigation Requirements," detailing its enforcement actions under the new Domain Name System (DNS) Abuse mitigation requirements. The requirements, which became effective on 5 April 2024, require generic top-level domain registry operators (ROs) and registrars to take mitigation steps to address well-evidenced DNS Abuse, which, for the purposes of ICANN agreements, is limited to malware, botnets, phishing, pharming, and spam used as a vector for delivering the other forms of DNS Abuse.

During the initial six months of enforcement, from 5 April to 5 October 2024, ICANN's Contractual Compliance team launched 192 DNS Abuse investigations involving contracted parties. This enforcement effort led to impactful results, including:

- Issuing formal Notices of Breach to an RO and a registrar for noncompliance with DNS Abuse mitigation requirements.
- Resolving 154 cases that resulted in the suspension of over 2,700 abusive domain names and the disabling of more than 350 phishing websites.

ICANN's monthly DNS Abuse reports provide regular updates on complaints and enforcement actions, broken down by type of abuse. The six-month report provides additional context and details about the specific actions taken to keep the ICANN community informed and enhance transparency around the enforcement of DNS Abuse requirements.

ICANN Compliance also participated in numerous outreach activities to raise awareness of DNS Abuse obligations and provide guidance on compliance. These engagements included workshops and forums designed to inform contracted parties about their responsibilities and share best practices.

Additionally, in October 2024, ICANN launched an audit to assess ROs' compliance with their agreements with ICANN, which include DNS Abuse mitigation obligations.

ICANN invites stakeholders to review the full report, which provides detailed insights into the enforcement process, key findings, and ongoing efforts to enforce the new DNS Abuse requirements.