ICANN's new rules for domain registrants require you to verify an email address

https://iwantmyname.com/blog/2014/01/icanns-new-rules-for-domain-registrants-require-you-to-verify-your-contact-details.html

by alexbilbie • 13 years ago

91 74 13 years ago

iwantmyname.com

uptown• 13 years ago

Are these formal ICANN rule-changes, or just how iwantmyname is choosing to enforce the verification aspect of domain ownership? Seems like what they're saying they may do is replace your domain with some lead-generation landing-page similar to what many domain registrars do upon registering a new domain prior to modifying the DNS settings.

devicenull• 13 years ago

It's almost certainly just them. You'll note that you haven't heard of any of the other registars talking about this.

aeden3• 13 years ago

No, this is incorrect - it is part of the new Registry Registrar Agreement that ICANN ratified earlier this year. It goes into effect 1 January. All accredited registrars will have to agree to it this year to retain their accreditation.

treitnauer2• 13 years ago

Others in the industry have updated their sites or informed their customers as well:

- http://support.godaddy.com/help/article/8948/verifying-conta...

- http://www.hover.com/blog/icann-registrant-verification-is-c...

- http://blog.dnsimple.com/2013/12/new-rules-for-domain-regist...

jkldotio• 13 years ago

I've spoken to Timo and the others on the team at iwantmyname before and they're all pretty laid back so I can't imagine them doing this unless they really had to.

Edit. This seems to be a more legal-like explanation of the relevant rules from a registrar called enom. http://www.comprotex.com/icann.html

jfreak53• 13 years ago

It's only them, the upline we use hasn't said a word to us about it. I just asked support and he seemed shocked I would even ask ha ha.

aeden3• 13 years ago

You should be very concerned about your registrar, then, because they are not paying attention to ICANN policy.

talideon13• 13 years ago

No, it's not. Any registrar on the 2013 RAA has to proactively validate and verify WHOIS data accuracy. Those still on the 2009 RAA only have to reactively validate and verify WHOIS data accuracy in response to complaints.

corobo• 13 years ago

As commented above[1] it looks like this is required by a new contract which is required for registrars to sell all of these new (and imo, silly) TLDs such as .cab, .sexy, etc

[1] https://news.ycombinator.com/item?id=7005417

treitnauer2• 13 years ago

As many others pointed out this is a change in ICANN policies and we are required to do this. The page will be completely neutral without any ads.

slashdotaccount• 13 years ago

We need decentralized DNS (like Namecoin) systems. Properly implemented cryptography and decentralization is the only hope for the free internet to remain free.

anoncow• 13 years ago

But do people want a free internet? People are looking for a medium they can profit from. And we are shortsighted by default.

SkyMarshal• 13 years ago

People != People

Rhapso• 13 years ago

Namecoin is a good start, but it has scaling issues. We can use it as a authentication back-end for something a bit more scalable.

huhtenberg• 13 years ago

This doesn't look like verifying contact details.

It looks like verifying a contact email address, which is nothing new and a routine with most registrars anyways.

aeden3• 13 years ago

The difference is that the registrar is now obligated to shut down any domains where the registrant changes first name, last name or email address and does not verify the email address using the link from the sent email. This is why it's such a big deal.

yogo• 13 years ago

For GoDaddy this is new as far as I can tell. You now get an email with a verification link. That never happened in the past (at least not by default).

nitinag2• 13 years ago

Competitor registrar here. This is actually required by the new 2013 ICANN contract. Not all registrars are on the new contract yet, but those that have already signed are required to start following it as of January.

Link: http://www.icann.org/en/resources/registrars/raa/approved-wi...

You can thank the law enforcement lobby and ICANN wanting to keep them happy. All of us registrars fought hard against it for a number of obvious reasons, but they went forward with it anyway.

Almost all registrars will be on the new contract soon if they already aren't because ICANN made it a requirement to be able to sell the new GTLDs. This is now going to be a normal part of owning a domain name.

nwh• 13 years ago

If domains weren't obnoxious enough to deal with, a combination of contact verification and hundreds of new top level domains really is just icing on the cake. I just renewed my domains so that I don't have to bother with verification for a while, and somehow the amount of upselling is just astounding.

rossjudson3• 13 years ago

Can you clarify what the 'obvious reasons' are, for those who are not domain experts?

MichaelGG3• 13 years ago

Not a domain expert, but I think the obvious reason of having your domains get deactivated because you didn't check email to be rather silly.

belorn• 13 years ago

Example 1: You are a large company, and registered 200 domain names for various products, spellings, local shops and such.

That is 200 verification emails, which now need to be pressed or whoops, no more working web shop, email!, and internal API will stop working and so on. Remember that broken DNS will cause emails to bounce rather than being resent later by the mail server.

Example 2: A company is changing name/owner, and in middle of all this need to register new domain name. Whoops, forgot to activate in all that?

Example 3: technical contact is on vacation.

talideon13• 13 years ago

Some of us are waiting on ICANN to process waivers so that we can opt out of certain requirements of the 2013 RAA that are contrary to our local law, but ICANN are dragging their heels on processing the waiver requests. That's especially an issue for European registrars like ourselves, as we have stricter data privacy laws than the US does.

The verification and validation requirements the LEAs pushed down our throats are still crazy, even if they're not as bad now as what they were initially looking for.

scintill76• 13 years ago

You can thank the law enforcement lobby and ICANN wanting to keep them happy.

Yeah, because there's absolutely no way to have an anonymous email address... /s But seriously, what does law enforcement think this will accomplish? I could see ICANN wanting to cut down on squatters or other domain delinquents, but for tracking down criminals this seems pointless. If anyone has theories or info on what they hope to accomplish I'd be interested.

billpg2• 13 years ago

I already get all sorts of emails sent to the address listed on whois. Most, if not all, are outright scams. So now one of those will actually be genuine?

But which one?

abjorn• 13 years ago

The one from your domain registrar, I would imagine.

billpg2• 13 years ago

I have a separate secret mailbox for them to use.

I get plenty of emails in my whois-listed mailbox that purport to be from my registrar. Guess how many are genuine.

salient• 13 years ago

I blame Google for this. Yes, there were others who pushed "real name policies" before, but it wasn't until Google when they really forced people to do it, and now that they got away with it, others are taking the example from them, and doing the same.

ubernostrum• 13 years ago

This isn't a "real name" policy.

It states that for certain types of changes/new contact details, there will be a verification email sent, with a link you have to click.

That doesn't involve giving your real identity to anyone.

rossjudson3• 13 years ago

Real name policies greatly benefit the community as a whole. Of course we all see that there is a rare need for anonymity, but it should be far from the default. I wish the net could be divided into two halves -- "Willing to put my name behind what I write", and "Anonymous Cesspool".

Sanddancer• 13 years ago

Tell a transperson that. Or an abuse survivor. Or someone with HIV trying to get information. There are many, many, many situations where requiring real names is harmful to a community. As a further counterexample, look at news sites which use facebook comments as their backend. People are quite willingly assholes even if their "real" name is behind what they write.

lurkinggrue• 13 years ago

Or cesspit of trolls who don't care you know their real "Name"

logfromblammo• 13 years ago

Anglo-American common law tradition allows me to manage my own identity. I am who I say I am, and I publish the name that I will answer to when strangers say it. And I am also free to have multiple nicknames, which might be associated with my public name, or not.

I am very disappointed in the cultural trend over the last few decades that makes a third-party entity, usually a government, the final arbiter over who someone is. If I want to be a certain name in person, and "logfromblammo" on HN, or another pseudonym somewhere else, I question the motives of anyone who wants to undermine that separation. I think it is a fundamental human right to decide who you are, and the ability to separate your social circles by the identity you use is essential to privacy and free discourse.

Several of the positions I hold as an on-line personality--religion, political views, spectator sport preferences--could be used against me in my job or hometown. An atheist anarchist that doesn't even like football is just one step away from social assassination in my physical location. If I cannot establish a separate and distinct identity to discuss such things in another venue, I cannot be free of the social prejudices of my neighbors, ever.

So I believe your assertion is incorrect. Real name policies promote self-censorship for everyone who is not blessed enough to live in a socially tolerant locale. I am content for logfromblammo to have a separate karma rating than my in-person name, and for it to be a discardable on-line identity. That arrangement can certainly be abused, but making that abuse impossible hurts far more than it helps.

drdaeman• 13 years ago

Is there any reason you want everyone on "put my name" part of the Net to be forced to use traditional¹ name format instead of free-form pseudonyms? Is there any difference except for the looks? Or you want services to register accounts only after a notary confirms your identity?

Best regards,

John Doe Jr.

___

P.S. ¹) Some people will likely to be unable to use their "real" name with such policies. http://www.kalzumeus.com/2010/06/17/falsehoods-programmers-b...

saurik• 13 years ago

... so now that YouTube did that, and it didn't help (as the trolls were, in fact, "willing to put my name behind what I write"), we aren't going to adjust our understanding and stop believing in this false dichotomy? :(

talideon13• 13 years ago

This is nothing to do with Google. It's the Law Enforcement Agencies who were pushing this with ICANN, not Google.

kijin2• 13 years ago

How will this affect registrars that offer to hide your email address behind a randomly generated and periodically rotated address that forwards to your own?

For example, NameCheap' WhoisGuard service has an option to rotate the email address every 30 days. If I subscribe to a service like that, will I have to verify the randomly generated address every time it is rotated?

thirsteh2• 13 years ago

Namecheap and their whoisguard have already been sending out annual or bi-annual emails asking you to confirm that the address details are correct, but it sounds like those emails will contain some confirmation link in the future.

kijin2• 13 years ago

That was not my question.

Right now, they only ask for confirmation once a year regardless of whether there has been any change of contact info. But OP makes it look like I'll have to verify my email address every time it changes, and one of the main features of WhoisGuard is that the email address in my whois changes all the time.

If I tell NameCheap/WhoisGuard to rotate my email every day (probably overkill, but it's possible), will I wake up every morning to find a new confirmation link in my inbox?

talideon13• 13 years ago

All registrars are required to do that currently as part of ICANN's WHOIS Data Reminder Policy: http://www.icann.org/en/resources/registrars/consensus-polic...

Those were basically a way to nudge name holders to ensure the details they provided were correct to minimise the chances to people lodging WHOIS inaccuracy complaints with registrars or directly with ICANN. See here: http://www.icann.org/en/resources/compliance/complaints/regi...

What's changed is that the Law Enforcement Agencies have pushed to make registrars be proactive in checking that any contact information is accurate rather than reactive in response to complaints. It's likely going to push up domain costs quite a bit. Here's what registrars on the 2013 RAA are required to do: http://www.icann.org/en/resources/registrars/raa/approved-wi...

bachback• 13 years ago

15 days. I am literally stunned. so if you go to long holiday you might come back and your site is .. banned. way to go on free speech.

wtallis• 13 years ago

There's absolutely no reason to be stunned, surprised, or disappointed that not finalizing a transaction within two weeks will result in discontinuation of the service.

These verifications don't show up out of the blue. They're only for when you create or modify a domain registration. If you change your domain records less than an hour before going off-grid for an extended vacation, you deserve the consequences.

talideon13• 13 years ago

Your site isn't "banned" in any sense: you are leasing your domain, and as part of the lease agreement, you are required to provide accurate contact detail. That was the case even before ICANN brought in the 2013 RAA.

As wtallis wrote, this only applies when you initially register a domain or modify the contact details associated with a domain. While registrars are required to re-validate contact details, they only need to email you to notify you that you should check that your contact details are still accurate, which they currently have to do already. Of course, if the email bounces... but if that's the case then you've seriously screwed up.

unethical_ban2• 13 years ago

One other has clarified, and it's important: Email is pseudonymous, and that's all that is required. Frustrating, but not quite as speech-quelling as addresses and phone numbers.

Oh, and you bought that domain with a credit card.

chimeracoder• 13 years ago

Oh, and you bought that domain with a credit card.

Namecheap actually accepts Bitcoin[0], but yes - the way they are currently implemented and used, TLD domain names are not at all anonymous.

[0] https://www.namecheap.com/support/payment-options/bitcoin.as...

trentmb• 13 years ago

Do registrars not accept pre-paid cards?

unethical_ban2• 13 years ago

I haven't tried personally, but most of the time now one cannot purchase or use a prepaid card without associating it to an address.

You know, for turrursm.

Istof• 13 years ago

Can the registrars send an automatic reply on behalf of their customers?

talideon13• 13 years ago

No. That wouldn't constitute verification and validation of contact details, and registrar are required to verify and validate any contact details provided to them. It's the registrar that's contacting the customer, not some other third party who they deal with.

larrys• 13 years ago

Registrar here.

Here is the applicable rules. As nitinag pointed out this only is for registrar's who have signed the 2013 RAA. Registrars still under the 2009 RAA are not bound by this. (At some point they will have to sign the new RAA and they will right away if they want to sell (as was pointed out) the new f TLDs.

http://www.icann.org/en/resources/registrars/raa/approved-wi...

While I can't speak for what other registrars will be doing these ICANN policies in the past tend to leave plenty of wiggle room and the ability to game the system (by registrars) if they want to.

Specifically:

"In either case, if Registrar does not receive an affirmative response from the Registered Name Holder, Registrar shall either verify the applicable contact information manually or suspend the registration, until such time as Registrar has verified the applicable contact information. If Registrar does not receive an affirmative response from the Account Holder, Registrar shall verify the applicable contact information manually, but is not required to suspend any registration."

squintychino• 13 years ago

How will this affect current domain squatters? Will they be required to follow this when they renew these domains? Or is this just for new registrations moving forward?

talideon13• 13 years ago

It doesn't, aside from it being more difficult for them to hide behind invalid contact details, which should make it easier for others to initiate UDRP proceedings against them.

As soon as they register a new domain with a registrar under the 2013 RAA or if they update their contact details, they'll be forced to validate them.

absconditus• 13 years ago

Why are so many of you upset by this?

marincounty2• 13 years ago

I'm not--but I don't like what they charge per domain. I can deal(go else where)with Godaddy, but I can't deal with fixed costs.

marincounty2• 13 years ago

ICANN needs to lower their price per domain. I don 't think they originally thought so many people would buy a domain? Or, just got greedy?

noclip• 13 years ago

ICANN charges 22 cents per domain. What would you propose the price be lowered to?

talideon13• 13 years ago

If anything, it's the registries who will need to lower their cut. They have the largest margin out of ICANN, the registries, and the registrars. The registrars, however, are the ones who are going to end up hurting because the onus to check all this stuff is on us, and margins for registrars are thin as it stands.

crististm• 13 years ago

What would it take to have a p2p DNS?

jpalomaki• 13 years ago

Check Namecoin and dot-bit http://dot-bit.org/Main_Page

zAy0LfpBZLC8mAC• 13 years ago

But isn't it still possible to use an address at the newly-registered domain? And what's the point then? Or, if not, how broken is that?

rip747• 13 years ago

To quote the source: ====================

Verify: the email address of the Registered Name Holder (and, if different, the Account Holder) by sending an email requiring an affirmative response through a tool-based authentication method such as providing a unique code that must be returned in a manner designated by the Registrar, or

the telephone number of the Registered Name Holder (and, if different, the Account Holder) by either (A) calling or sending an SMS to the Registered Name Holder's telephone number providing a unique code that must be returned in a manner designated by the Registrar, or (B) calling the Registered Name Holder's telephone number and requiring the Registered Name Holder to provide a unique code that was sent to the Registered Name Holder via web, email or postal mail.

In either case, if Registrar does not receive an affirmative response from the Registered Name Holder, Registrar shall either verify the applicable contact information manually or suspend the registration, until such time as Registrar has verified the applicable contact information. If Registrar does not receive an affirmative response from the Account Holder, Registrar shall verify the applicable contact information manually, but is not required to suspend any registration. ====================

So there are other methods that ICANN outlines in order to verify the account holder information to activate the domain, not _just_ an email address like the article states.

coherentpony• 13 years ago

Is there a way to register a domain name completely anonymously?

oakwhiz• 13 years ago

Someone else can register it on your behalf, but I'm fairly sure that's as close as you can really get to anonymous. Of course if you do bad things with that domain, people are going to go after that person first.

talideon13• 13 years ago

No, not any more, and strictly speaking there hasn't been one for quite some time. Your registrar needs to have accurate contact details for you, but you can use their WHOIS privacy service (if they provide one) to ensure the rest of the world doesn't have your contact details. Before the 2013 RAA, you were still required to provide accurate contact information, it's just that the onus was on the registrant, not the registrar, to ensure the contact details were accurate unless the registrar or ICANN received a complaint about the accuracy of the contact details associated with a domain.

ICANN's new rules for domain registrants require you to verify an email address

Related Stories