- Gnso-dnsabuse-pdp - lists.icann.org

Updates and Action items - DNSAM PDP1 Session 1 and 2
by Feodora Hamza June 8, 2026

June 8, 2026

Dear DNSAM PDP1, Please find below the high-level notes and action items form today’s session 1 and 2. Please note our next session is scheduled for Wednesday, 9 June at 10:00. Staff has updated the Prelim Rec Review Doc with the discussed changes from today (in suggestion mode), please see below: * Prelim Rec Review Doc (we have archived last version to have a reference point): https://docs.google.com/document/d/1udLt1o9rwCc4xNRsuw6B-5onjpI63VDA/edit?u… Action Items: * WG to review in case any update or suggestion from today was missed. * WG to review Prelim Rec language and discuss/add potential “cannot live with” * WG to review the glossary in the Prelim Rec Review Doc (last tab) Thank you. Kind regards, Feodora on behalf of Support Staff ICANN86 Policy Forum – DNSAM PDP1 Session 1 and 2 Action Items: * LT with support from Staff to develop prelim rec language for CQ8 and 9 * Staff to update the Prelim Rec Review Document with the updates and suggestion agreed on during Session 1 and 2. * WG members to discuss with their groups the updated Rec and note any “cannot live with” items (if any). Important links/docs: * Prelim Rec Review Doc (we have archived last version to have a reference point): https://docs.google.com/document/d/1udLt1o9rwCc4xNRsuw6B-5onjpI63VDA/edit?u… * Session link: * Session 1 https://icann86.sched.com/event/2NQMr/gnso-dns-abuse-mitigation-pdp-1-1-of-4 * Session 2 https://icann86.sched.com/event/2NQMt/gnso-dns-abuse-mitigation-pdp-1-2-of-4 High Level Meeting Minutes – ICANN86 DNSAM PDP Session 1 & 2 Discussion on CQ8 * WG members noted including a sunset or review mechanism in the policy. * WG members generally supported periodic policy evaluation, with a two-year holistic review suggested. * Concerns were raised about making the policy overly prescriptive. * LT noted to not “overthink” this CQ and focus on the “policy goal” and effort made. * Discussion acknowledged challenges in measuring effectiveness. Discussion on CQ9 * Discussion cantered on requiring registrars to maintain internal documentation describing ADC procedures in the course of conducting their ordinary business. * WG members suggested to remove the last sentence of straw proposal. * ICANN Org noted “different documentation format” I * Concerns were raised regarding ineffective “check-the-box” reviews and transparency around whether ADCs are performed. * Existing registry agreement language (Spec 11.3.B) was discussed as a potential language model. * Some participants supported strengthening language from “should” to “must” where appropriate. Discussion on PR1: * WG members agreed to add proposed definition of Compromised Domains in glossary. * The advisory definition of compromised domains was discussed as a basis for further work. * WG agreed to add in rationale that mitigation on existing contractual obligation should not be substantively delayed due to ADC trigger. Discussion on PR2: * Discussion addressed concerns regarding the phrase “reasonable investigation.” * WG agreed on proposed update based on slide – removal of “review at least one data point” Discussion on PR3: * No major concerns were raised regarding replacing “reasonably available” with “reasonably accessible.” * Participants discussed reseller obligations and registrar responsibility under consensus policy requirements. * Agreement that registrars remain responsible for relevant contractual obligations, including reseller compliance. * Discussion noted that “reasonable” is widely used in existing agreements and Compliance is comfortable with its current interpretation. Discussion on PR5: * Participants discussed simplifying language related to privacy safeguards. * Support was expressed for referencing compliance with applicable law(s). Discussion on PR6: * Extensive discussion occurred on whether to establish fixed timelines. * Participants generally favoured retaining “promptly” rather than specifying 24-hour or 72-hour requirements. * IPC expressed interest in measuring response times as part of effectiveness metrics rather than as a strict policy requirement. * Concerns were raised that strict timelines could be counterproductive and could allow abuse to continue longer. * BC ultimately accepted use of “promptly” in place of a 24-hour timeline proposal. * Outcome: broad alignment on “promptly”. Discussion on PR7: * Agreement that several topics should be flagged for future policy consideration rather than included as policy recommendations. * Topics identified included: * Transparency regarding mitigation actions. * Recourse mechanisms. * Cross-registrar intelligence sharing. * Registry-level abuse patterns. * Frameworks for contracted-party information sharing. * LT suggested communicating these issues to Council through a letter rather than an annex to the report.

1 0

Re: New Interisle Study
by Nitin Walia June 8, 2026

June 8, 2026

8 10

Possible absence for the 2nd session today
by Ching Chiao June 8, 2026

June 8, 2026

Hi Terri, Kindly note I might not be able to join the 2nd WG session today. Thanks! Best, Ching *Ching Chiao 乔敬* *Head of APAC & Corporate Development* *WhoisXMLAPI.com <http://whoisxmlapi.com/>* *中文：https://zh.main.whoisxmlapi.com/ <https://zh.main.whoisxmlapi.com/>* *日本语：https://ja.main.whoisxmlapi.com/ <https://ja.main.whoisxmlapi.com/>* Join *IASC (Internet Abuse Signal Collective)* https://main.whoisxmlapi.com/internet-abuse-signal-collective LinkedIn : https://www.linkedin.com/in/chiao/ Book a meeting now: https://calendar.app.google/9neWrkwvhPHRqGZ86

2 1

Re: Alternate for ICANN86 Sessions 1 and 4
by Eberhard W Lisse June 7, 2026

June 7, 2026

Hi, I will be conflicted on Monday for the morning session due to TechDay, and Bruce Tonkin will stand in. We are both conflicted due to Transit on Thursday, so please note our apologies. greetings, el -- Dr. Eberhard W. Lisse \ / Obstetrician & Gynaecologist (retired) el(a)lisse.NA / * | Telephone: +264 81 124 6733 (cell) PO Box 8421 Bachbrecht \ / If this email is signed with GPG/PGP 10007, Namibia ;____/ Sect 20 of Act No. 4 of 2019 may apply

1 0

Action Items and prep material ICANN86 DNSAM PDP1
by Feodora Hamza June 5, 2026

June 5, 2026

Dear DNSAM PDP1, Please find below the proposed session 1 and 2 agenda for our meeting starting on Monday, 8 June at 11:45 (Spain local time). 1. Welcome 2. Progress Made and ICANN86 Objectives 3. Discussion on CQ8 4. Discussion on straw proposal CQ9 5. Review Prelim Recs on CQ1-7 The CollabDocument has been updated with language on CQ8 and CQ9: https://docs.google.com/document/d/1GxM-Yrgv6sZPEYU8ikW4cRM5YqWsJuWGiQyO39p… Please note the two main action items for the WG to complete before ICANN86 (as introduced last week): Action Items: 1. WG Members to review prelim rec document above and identify any areas of “CANNOT LIVE WITH” before 8 June. * PrelimRec Review Doc: https://docs.google.com/document/d/1udLt1o9rwCc4xNRsuw6B-5onjpI63VDA/edit?u… 1. Staff to share scoped impact assessment (HR and DP) on current prelim language with WG today. WG to review before 10 June. * Scoped Impact Assessment: https://docs.google.com/document/d/18xVFX-IXfEgPnIj2UaXmwiXsWE8FY-Jo/edit?u… We wish you all safe travels to Spain and look forward to seeing you in person. Kind regards, Feodora on behalf of Support Staff

1 0

Post Call / DNS Abuse Mitigation PDP1 WG / Monday, 01 June 2026
by Julie Bisland June 4, 2026

June 4, 2026

Dear all, All recordings for the DNS Abuse Mitigation PDP1 WG call held on Monday, 01 June 2026 at 12:30 UTC can be found on the agenda wiki page <https://icann-community.atlassian.net/wiki/x/UYDJNw> (attendance included), which can also be accessed via the GNSO Master calendar<https://gnso.icann.org/en/group-activities/calendar/2026>. These include: * Attendance * Audio recording * Zoom recording (including audio, visual, rough transcript, and chat) * Transcript * Agenda and Notes/Action Items For additional information, you may consult the mailing list archives<https://lists.icann.org/hyperkitty/list/gnso-dnsabuse-pdp@icann.org/> and the main wiki page<https://icann-community.atlassian.net/wiki/x/zoKmLQ>. Thank you. With kind regards, Julie -- Julie Bisland Policy Operations Analyst (GNSO) Internet Corporation for Assigned Names and Numbers (ICANN) Find out more about the GNSO by visiting: https://learn.icann.org/<https://urldefense.proofpoint.com/v2/url?u=https-3A__learn.icann.org_&d=DwM…> Follow @GNSO on Twitter: https://twitter.com/ICANN_GNSO<https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_ICANN-5FGN…> Transcripts and recordings of GNSO Working Group and Council events are located on the GNSO Master Calendar <https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_en_grou…>

8 10

Re: New Interisle Study
by David Hughes June 3, 2026

June 3, 2026

1 0

New Interisle Study
by trachtenbergm＠gtlaw.com June 2, 2026

June 2, 2026

FYI fellow members of the DNS Abuse PDP Part 1, The new Interisle study is out and underscores the importance of this PDP getting it right and resulting in something that is meaningful, including in particular, having measurable and enforceable obligations (see https://interisle.net/insights/cybercriminaldomaindemand<https://urldefense.com/v3/__https:/interisle.net/insights/cybercriminaldoma…>). The report indicates that 10% to 20% of domains are registered for bad purposes, but it might be even higher. The report further indicated that 10% of gTLD domains registered in 2025 have been added to blocklists, and almost all of these were registered for malicious purposes rather than being compromised. As an aside, WhoisXML API analyzes 8-10 million new registrations every month and generally estimates that about a quarter of them are registered for malicious purposes<https://main.whoisxmlapi.com/blog/april-2026-domain-activity-highlights>). Notably for this PDP, the report also addresses Associated Domains - see in particular pg 17: A recent study about associated domains was performed by the research team in ICANN’s Office of the CTO (OCTO). This study found that “at least 16% of newly registered gTLD domains, [created] in the first quarter of 2025, exhibited batch registration patterns.” Starting with an initial set of “seed” RBL- listed domains, the researchers found an additional 80% more domains that were associated with the blocklisted ones. This “indicates that for every three newly registered malicious domains reported through RBL feeds, batch expansion (using conservative filtering) identifies an additional two neighboring domains.” The researchers stated that “the true rate is likely to be higher” since they excluded ”many valid batches” such as those containing more than 1,000 domains. The results “indicate that batch registrations are prevalent, significantly predict overall abuse rates, and are useful for pivoting and expanding from known malicious ‘seed’ domain sets, particularly in certain TLDs and registrar environments.” Best regards, Marc H. Trachtenberg Shareholder Chair, Internet, Domain Name, e-Commerce and Social Media Practice Greenberg Traurig, LLP Aspen Chicago 411 E. Main Street 360 North Green Street Suite 207 | Aspen, CO 81611 Suite 1300 | Chicago, IL 60607 T +1.970.300.5313 T +1.312.456.1020 M +1.773.677.3305 M +1.773.677.3305 trac(a)gtlaw.com<mailto:trachtenbergm@gtlaw.com> | www.gtlaw.com<http://www.gtlaw.com/> | View GT Biography <https://www.gtlaw.com/en/professionals/t/trachtenberg-marc-h> [Greenberg Traurig Logo] [Greenberg Traurig Logo] ---------------------------------------------------------------------- If you are not an intended recipient of confidential and privileged information in this email, please delete it, notify us immediately at postmaster(a)gtlaw.com, and do not use or disseminate the information.

1 0

ICANN86 Policy Outlook Report / GNSO Chair Blog
by Julie Bisland June 2, 2026

June 2, 2026

Dear All, On behalf of the GNSO Team, I am happy to share the ICANN86 Policy Outlook Report and the GNSO Chair Blog: * GNSO Chair Blog: https://www.icann.org/en/blogs/details/the-gnso-council-welcomes-you-to-ica… * Policy Outlook Report: https://go.icann.org/outlook86 Happy reading! With kind regards, Julie -- Julie Bisland Policy Operations Analyst (GNSO) Internet Corporation for Assigned Names and Numbers (ICANN) Find out more about the GNSO by visiting: https://learn.icann.org/<https://urldefense.proofpoint.com/v2/url?u=https-3A__learn.icann.org_&d=DwM…> Follow @GNSO on Twitter: https://twitter.com/ICANN_GNSO<https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_ICANN-5FGN…> Transcripts and recordings of GNSO Working Group and Council events are located on the GNSO Master Calendar <https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_en_grou…>

1 0

Notes and AIs from 1 June DNSAM PDP1 Meeting
by Feodora Hamza June 2, 2026

June 2, 2026

Dear DNSAM PDP1, Please find below the high-level notes and action item from yesterday`s meeting. Our next meeting is scheduled for Monday, 8 June at 11:45 (Spain local time). Please note the two main action items for the WG to complete before ICANN86 (as introduced last week): Action Items: 1. WG Members to review prelim rec document above and identify any areas of “CANNOT LIVE WITH” before 8 June. 2. Staff to share scoped impact assessment (HR and DP) on current prelim language with WG today. WG to review before 10 June. 3. PrelimRec Review Doc: https://docs.google.com/document/d/1udLt1o9rwCc4xNRsuw6B-5onjpI63VDA/edit?u… 4. Scoped Impact Assessment: https://docs.google.com/document/d/18xVFX-IXfEgPnIj2UaXmwiXsWE8FY-Jo/edit?u… We wish you all safe travels to Spain and look forward to seeing you in person. Kind regards, Feodora on behalf of Support Staff 2026-06-01 DNS Abuse Mitigation PDP1 WG<https://icann-community.atlassian.net/wiki/spaces/DAMP1/pages/935952465/202…> Action Items: 1. WG Members to review prelim rec document above and identify any areas of “CANNOT LIVE WITH” before 8 June. 2. Staff to share scoped impact assessment (HR and DP) on current prelim language with WG today. WG to review before 10 June. 3. Identified areas of concerns/feedback/questions will be added and discussed during ICANN86 Working Sessions. 4. Staff to develop straw proposal on CQ8 and 9 based on WG discussion. Important docs/links: * Wiki space/slides: https://icann-community.atlassian.net/wiki/spaces/DAMP1/pages/935952465/202… * Session recording: https://icann.zoom.us/rec/play/X5ToLe1DYY8f-DSM3Lu2D3Y8jn3ieH-3ICCp23-k_G0v… * CollabDoc: https://docs.google.com/document/d/1GxM-Yrgv6sZPEYU8ikW4cRM5YqWsJuWGiQyO39p… * PrelimRec Review Doc: https://docs.google.com/document/d/1udLt1o9rwCc4xNRsuw6B-5onjpI63VDA/edit?u… * Scoped Impact Assessment: https://docs.google.com/document/d/18xVFX-IXfEgPnIj2UaXmwiXsWE8FY-Jo/edit?u… High-level notes: 1. Welcome (5min) 2. ICANN86 Prep (10min) * Chair introduced the objectives for the 4 ICANN86 sessions. * Main focus: review preliminary recs, review scoped impact assessment, develop preliminary recs for CQ8 and 9. 1. Start Deliberations on CQ8 (35min) * Discussion focused on how to measure the policy's effectiveness in the future. * Some WG members suggested a two-year review cycle. * Some WG members noted that reporting and reviews are different things and should be discussed separately, while agreeing that a two-year review period sounded appropriate. * WG members questioned whether "average uptime" or "reduction in uptime" are meaningful or measurable indicators. * Some WG members noted that effectiveness measures should not be limited to quantitative statistics. * WG members noted to seek input from OCTO on potential data sets/metrics. support for seeking OCTO input regarding metrics and effectiveness evaluation. * OCTO was viewed as a valuable source of expertise rather than a prerequisite for policy advancement. * Staff noted the Charter input on the “metrics” question. The charter notes following considerations: · Identification of metrics used to measure whether policy goals are achieved · Identification of potential problems in attaining the data or developing the metrics · A suggested timeframe in which the measures should be performed · Define current state baselines of the policy and define initial benchmarks that define success or failure 1. Start Deliberations on CQ9 (35min) * Discussion focused on how Rrs can demonstrate compliance with ADC requirements. * Support Staff provided some considerations when discussing this question: · In general terms, the method for demonstrating compliance would likely follow the same principles used today for other DNS Abuse-related requirements. · Registrars typically demonstrate compliance by providing information and documented evidence that shows what actions they took, when, and why. · The “best-case scenario” for demonstrating compliance would be a clear, auditable record that matches the language of the obligation. · Evidence might include logs, investigation notes, or ticketing-system entries showing that the required review was performed and the results were acted upon. · The above is only illustrative. The exact form of evidence would depend on how the obligation is drafted. · Ultimately, Compliance can only enforce (and can only require documentation of) what the RAA itself expressly states. · Some WG members noted that registrars should be able to demonstrate: · when the ADC obligation was triggered, · what indicators were reviewed, · what steps were taken, · what conclusions were reached, · rationale for those conclusions. · WG members discussed whether registrars should be required to create additional logs. They noted compliance should rely on documentation already generated through existing processes. · WG members discussed whether high-level transparency reporting could provide accountability without excessive burden. 1. AOB (5min)

1 0