- Gnso-dnsabuse-pdp - lists.icann.org

Post Call / DNS Abuse Mitigation PDP1 WG / Monday, 23 March 2026
by Julie Bisland March 23, 2026

March 23, 2026

Dear all, All recordings for the DNS Abuse Mitigation PDP1 WG call held on Monday, 23 March 2026 at 12:30 UTC can be found on the agenda wiki page <https://icann-community.atlassian.net/wiki/x/GQCSLQ> (attendance included), which can also be accessed via the GNSO Master calendar<https://gnso.icann.org/en/group-activities/calendar/2026>. These include: * Attendance * Audio recording * Zoom recording (including audio, visual, rough transcript, and chat.) * Transcript * Agenda and Notes/Action Items For additional information, you may consult the mailing list archives<https://lists.icann.org/hyperkitty/list/gnso-dnsabuse-pdp@icann.org/> and the main wiki page<https://icann-community.atlassian.net/wiki/x/zoKmLQ>. Thank you. With kind regards, Julie -- Julie Bisland Policy Operations Analyst (GNSO) Internet Corporation for Assigned Names and Numbers (ICANN) Find out more about the GNSO by visiting: https://learn.icann.org/<https://urldefense.proofpoint.com/v2/url?u=https-3A__learn.icann.org_&d=DwM…> Follow @GNSO on Twitter: https://twitter.com/ICANN_GNSO<https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_ICANN-5FGN…> Transcripts and recordings of GNSO Working Group and Council events are located on the GNSO Master Calendar <https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_en_grou…>

1 0

Outcomes, Action Items, and Notes - 23 March 2026 - Meeting #5
by Steve Chan March 23, 2026

March 23, 2026

Dear DNSAM PDP 1, Please see the attached outcomes, action items, and notes from Meeting #5. Best, Steve [OUTCOMES] * None [ACTION ITEMS] * Action Item: Members and Participants to complete voting by the deadline. * Action Item: Staff to send email about work plan: https://docs.google.com/spreadsheets/d/1gDXM13Io8RJlYZVj0rhbfoMi7und3v9i/ed… * Action Item: WG Members to review work plan and provide feedback by 30 Mar, if any. * Action Item: Staff to send email about collaboration tool, which seeks to capture and distill verbal and email discussions to date. [NOTES] 1. Welcome * Recapped what took place at ICANN85, including admin activities, reminders on good habits for consensus building, and deliberations on Charter question 1. 2. Update on VC Chair Selection Procedure * Considered a number of options and factors but settled on a relatively simple procedure, as laid out in the slide. Action Item: Members and Participants to complete voting by the deadline. 3. Introduction of WG Members * Every member, participant, and alternate was invited to discuss 1) their name, role in WG, affiliation 2) background expertise 3) “why am I here” * A number of speakers mentioned implementability, pragmatism, enforceability, proportionality, respect for human rights, scalability, and wishing to make a real difference in further mitigating DNS Abuse. * Several speakers mentioned that this PDP would be their first ever. Welcome! 4. Update on Workplan Review * Paul will be checking participation levels and hopes to see broad participation. * Consider whether all emails, like acknowledgments, need to be sent to all on the WG. * Reviewed work plan slide, highlighting all of the milestones. Reminded the WG about homework to identify problematic Mondays, to help determine next steps, if any. * Reviewed the more detailed work plan on the following slide. The holistic reviews (HRIA, GPI etc.) will be done iteratively along the way, but also robustly once all recommendations are stable. * Reviewed the slide with standard PDP steps and timelines, to illustrate that there are a number of required steps that cannot be removed or shortened. The steps within the WG’s direct control are deliberations to get to the Initial Report and consideration of public comment/drafting of Final Report/consensus call. * Concern about using LLM over review of the email list, including providing access to data and training LLMs – doing so was not an ICANN-sanctioned activity. * Concern about whether Oman will occur and the potential loss of F2F time. And noted that it would be helpful to know when meetings will take place in Seville. Noted that for Seville, the meetings will occur during the regular meeting, not on day zero or earlier. * Question about whether sub-tracks may be useful to progress the work more rapidly. * Question about what the minimum number of days are, assuming agreement on recommendations on day 1. Clarified that a number of the mandatory steps are already completed – we are currently in the first green, variable box. * Offer to liaise with the meetings planning team, especially in relation to Tech Day. * Suggestion to consider stress testing the recommendations, when they are closer to stable. Action Item: Staff to send email about work plan: https://docs.google.com/spreadsheets/d/1gDXM13Io8RJlYZVj0rhbfoMi7und3v9i/ed… Action Item: WG Members to review work plan and provide feedback by 30 Mar, if any. 5. Continue Deliberation * Recap: At ICANNN85, began deliberations for CQ1, including looking at draft RAA text. * Reminders about best practices for deliberations, including minding scope, being creative, being iterative, etc. * Not in scope: Compromised domains; ADC across Rrs; dictating the types of mitigation actions in the course of an ADC. * Reminder that we will need to review the early input carefully – will be put into a digestible format and discussed at a future meeting. * Given time, will not start the review of the charter question. Action Item: Staff to send email about collaboration tool, which seeks to capture and distill verbal and email discussions to date. 6. AOB * None Steven Chan  VP, Policy Development Support & GNSO Relations Internet Corporation for Assigned Names and Numbers (ICANN) 12025 Waterfront Drive, Suite 300 Los Angeles, CA 90094-2536  Email: steve.chan(a)icann.org<mailto:steve.chan@icann.org> Mobile: +1.310.339.4410

1 0

Meeting Invitation / DNS Abuse Mitigation PDP1 WG / Monday, 30 March 2026
by Julie Bisland March 23, 2026

March 23, 2026

Dear all, The next DNS Abuse Mitigation PDP1 WG call will take place on Monday, 30 March 2026 at 12:30 UTC for 90 minutes. Join from PC, Mac, iPad, or Android - Zoom Webinar: https://icann.zoom.us/j/91807711636?pwd=q6XCt8cWQU9m3fGgSojQ5X07pbnX6a.1 Passcode:+X8RaawVrW Phone one-tap: +13126266799,,91807711636#,,,,*0006343077# US (Chicago) +13462487799,,91807711636#,,,,*0006343077# US (Houston) Webinar ID: 918 0771 1636 Passcode: 0006343077 International numbers available: https://icann.zoom.us/u/a9jfXWLB8 ALL: Before joining the call * Please send apologies to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only * Please be sure you have read the ICANN Expected Standards of Behavior<https://urldefense.com/v3/__https:/www.icann.org/resources/pages/expected-s…>, the ICANN Community Anti-Harassment Policy<https://www.icann.org/resources/pages/community-anti-harassment-policy-2017…>, and the ICANN Community Participant Code of Conduct<https://www.icann.org/en/system/files/files/adopted-icann-community-partici…>. * 2026 Meetings wiki: https://icann-community.atlassian.net/wiki/x/B4CWLQ * Time Zone conversion (30 March): https://tinyurl.com/yw2t37uy Thank you. Kind regards, Julie -- Julie Bisland Policy Operations Analyst (GNSO) Internet Corporation for Assigned Names and Numbers (ICANN) Find out more about the GNSO by visiting: https://learn.icann.org/<https://urldefense.proofpoint.com/v2/url?u=https-3A__learn.icann.org_&d=DwM…> Follow @GNSO on Twitter: https://twitter.com/ICANN_GNSO<https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_ICANN-5FGN…> Transcripts and recordings of GNSO Working Group and Council events are located on the GNSO Master Calendar <https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_en_grou…>

1 0

**15-MINUTE REMINDER** Meeting Invitation / DNS Abuse Mitigation PDP1 WG / Monday, 23 March 2026
by Julie Bisland March 23, 2026

March 23, 2026

**15-MINUTE REMINDER** Dear all, The DNS Abuse Mitigation PDP1 WG call will take place on Monday, 23 March 2026 at 12:30 UTC for 90 minutes. Join from PC, Mac, iPad, or Android - Zoom Webinar: https://icann.zoom.us/j/91807711636?pwd=q6XCt8cWQU9m3fGgSojQ5X07pbnX6a.1 Passcode:+X8RaawVrW Phone one-tap: +13126266799,,91807711636#,,,,*0006343077# US (Chicago) +13462487799,,91807711636#,,,,*0006343077# US (Houston) Webinar ID: 918 0771 1636 Passcode: 0006343077 International numbers available: https://icann.zoom.us/u/a9jfXWLB8 ALL: Before joining the call * Please send apologies to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only * Please be sure you have read the ICANN Expected Standards of Behavior<https://urldefense.com/v3/__https:/www.icann.org/resources/pages/expected-s…>, the ICANN Community Anti-Harassment Policy<https://www.icann.org/resources/pages/community-anti-harassment-policy-2017…>, and the ICANN Community Participant Code of Conduct<https://www.icann.org/en/system/files/files/adopted-icann-community-partici…>. * 2026 Meetings wiki: https://icann-community.atlassian.net/wiki/x/B4CWLQ * Time Zone conversion (23 March): https://tinyurl.com/u3m4kuzv Thank you. Kind regards, Julie -- Julie Bisland Policy Operations Analyst (GNSO) Internet Corporation for Assigned Names and Numbers (ICANN) Find out more about the GNSO by visiting: https://learn.icann.org/<https://urldefense.proofpoint.com/v2/url?u=https-3A__learn.icann.org_&d=DwM…> Follow @GNSO on Twitter: https://twitter.com/ICANN_GNSO<https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_ICANN-5FGN…> Transcripts and recordings of GNSO Working Group and Council events are located on the GNSO Master Calendar <https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_en_grou…>

2 1

**RESENDING** Meeting Invitation / DNS Abuse Mitigation PDP1 WG / Monday, 23 March 2026
by Julie Bisland March 23, 2026

March 23, 2026

Dear team, The invite was sent during ICANN85…poor timing. To ensure everyone receives it, we are resending. Best regards, Julie -- Julie Bisland Policy Team Supporting the GNSO From: Julie Bisland <julie.bisland(a)icann.org> Date: Wednesday, March 11, 2026 at 11:31 AM To: "gnso-dnsabuse-pdp(a)icann.org" <gnso-dnsabuse-pdp(a)icann.org> Cc: GNSO-Secs <gnso-secs(a)icann.org> Subject: Meeting Invitation / DNS Abuse Mitigation PDP1 WG / Monday, 23 March 2026 Dear all, The DNS Abuse Mitigation PDP1 WG call will take place on Monday, 23 March 2026 at 12:30 UTC for 90 minutes. Join from PC, Mac, iPad, or Android - Zoom Webinar: https://icann.zoom.us/j/91807711636?pwd=q6XCt8cWQU9m3fGgSojQ5X07pbnX6a.1 Passcode:+X8RaawVrW Phone one-tap: +13126266799,,91807711636#,,,,*0006343077# US (Chicago) +13462487799,,91807711636#,,,,*0006343077# US (Houston) Webinar ID: 918 0771 1636 Passcode: 0006343077 International numbers available: https://icann.zoom.us/u/a9jfXWLB8 ALL: Before joining the call * Please send apologies to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only * Please be sure you have read the ICANN Expected Standards of Behavior<https://urldefense.com/v3/__https:/www.icann.org/resources/pages/expected-s…>, the ICANN Community Anti-Harassment Policy<https://www.icann.org/resources/pages/community-anti-harassment-policy-2017…>, and the ICANN Community Participant Code of Conduct<https://www.icann.org/en/system/files/files/adopted-icann-community-partici…>. * 2026 Meetings wiki: https://icann-community.atlassian.net/wiki/x/B4CWLQ * Time Zone conversion (23 March): https://tinyurl.com/u3m4kuzv Thank you. Kind regards, Julie -- Julie Bisland Policy Operations Analyst (GNSO) Internet Corporation for Assigned Names and Numbers (ICANN) Find out more about the GNSO by visiting: https://learn.icann.org/<https://urldefense.proofpoint.com/v2/url?u=https-3A__learn.icann.org_&d=DwM…> Follow @GNSO on Twitter: https://twitter.com/ICANN_GNSO<https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_ICANN-5FGN…> Transcripts and recordings of GNSO Working Group and Council events are located on the GNSO Master Calendar <https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_en_grou…>

11 24

Missing First Half of Today's Meeting
by Michaela Nakayama Shapiro March 23, 2026

March 23, 2026

INTERNAL Dear all, With apologies, I will unfortunately be missing the first half of today's call due to a last-minute conflict. If I miss my turn to introduce myself, I can send a message to the mailing list after today's call. Should this pose an issue, please let me know and I will coordinate with @farzaneh badii<mailto:farzaneh.badii@gmail.com> to ensure there is adequate NCSG representation on today's call. Best, Michaela Michaela Nakayama Shapiro (she/her/hers) Programme Officer - Censorship [cid:logo_1c766458-35ee-431a-9a22-e00b47cd2091.png]<https://www.article19.org> Defending freedom of expression and information www.article19.org<https://www.article19.org> Subscribe to our Newsletter<https://www.article19.org/ie-sign-up/> [cid:newsletter_02744340-c607-4374-8a37-11b8b216096d.png] <https://www.article19.org/ie-sign-up> Note: we work half day Fridays (AM) Follow us [cid:bluesky1x_864ef831-9476-4116-88b8-2a3410741630.png]<https://bsky.app/profile/article19.bsky.social> [cid:facebook_2853baa0-f060-42e6-b448-6a8788c1b5dd.png] <https://www.facebook.com/article19org/> [cid:youtube_ffe95af1-d962-4acd-ab59-4eb4ea07466e.png] <https://www.youtube.com/channel/UCDB6E_x0xRSfF62b872n9YQ> [cid:linkedin_199dc89c-14aa-41cd-b2a7-37b8ae8d667d.png] <https://www.linkedin.com/company/article19> [cid:instagram_05fbcc72-6df2-442b-8c34-146d0e9d8c41.png] <https://www.instagram.com/article19org/> [cid:x_d21e0607-da5a-44a7-80c7-e2d86bc18a92.png] <https://twitter.com/intent/follow?screen_name=article19org> [cid:impact-report_1c71655a-4438-4380-a628-e982f14c0294.jpg]<https://www.article19.org/ie-sign-up/>

1 0

Complete straw proposal
by Naoum MENGOUDIS March 22, 2026

March 22, 2026

Following is the amendments proposal of copilot: If ICANN ever wanted to seriously tackle the “one domain is abusive, ten siblings are untouched” problem, the RAA would need a structural upgrade, not just a cosmetic tweak. What you’re proposing — mandatory associated‑domain checks once a domain is verified abusive — is exactly the kind of systemic fix that would close the biggest operational blind spot in today’s DNS abuse framework. Let me give you a clean, actionable blueprint for how such an amendment could be drafted so that it’s enforceable, proportionate, and technically realistic. --- 🔧 How to Amend the RAA to Require Associated‑Domain Checks Below is a structured proposal that fits the style and enforceability pattern of the 2023–2024 amendments. --- 1️⃣ Add a New Defined Term: “Associated Domain Name” This is essential. Without a definition, ICANN Compliance cannot enforce anything. Proposed definition > Associated Domain Name means a domain name under the Registrar’s sponsorship that shares one or more operational or registration attributes with a Verified Abusive Domain, including but not limited to: > (a) identical or substantially similar registrant data; > (b) identical or substantially similar nameservers; > (c) identical hosting IP addresses; > (d) identical DNS configuration patterns; > (e) identical or substantially similar contact information provided via privacy/proxy services. This definition is intentionally broad but bounded — similar to how “reasonable and appropriate action” was framed. --- 2️⃣ Add a New Registrar Obligation: “Associated Domain Review Requirement” Proposed RAA clause > Upon verification that a domain name is engaged in DNS Abuse (“Verified Abusive Domain”), Registrar shall conduct an Associated Domain Review to identify any Associated Domain Names under its sponsorship that present a reasonable likelihood of facilitating the same or related abusive activity. This creates a triggered obligation — not continuous surveillance. --- 3️⃣ Require Documented Review + Action on Associated Domains Proposed clause > Registrar shall document the results of the Associated Domain Review and, where evidence indicates that an Associated Domain Name is engaged in or facilitating DNS Abuse, Registrar shall take reasonable and appropriate action consistent with Section 3.18. This ties the new requirement back to the existing enforcement mechanism. --- 4️⃣ Add a Timeframe (ICANN loves timeframes) Proposed clause > The Associated Domain Review shall be completed within 72 hours of verification of DNS Abuse, unless exceptional circumstances justify a longer period. This mirrors the “timely action” language in the amendments but makes it measurable. --- 5️⃣ Add a Minimal‑Burden Safe Harbor Registrars will fight this unless you give them a safety valve. Proposed clause > Registrar shall not be required to perform technical analysis beyond data reasonably available to it in the ordinary course of business. Nothing in this section obligates Registrar to perform active monitoring of domain names. This keeps the requirement proportional and enforceable. --- 6️⃣ Add ICANN Compliance Hooks Proposed clause > Registrar shall retain documentation of Associated Domain Reviews for no less than two years and shall provide such documentation to ICANN Compliance upon request. This makes the obligation auditable. --- 🧠 Why This Amendment Works ✔ It’s operationally realistic Registrars already have access to the necessary data: WHOIS, RDAP, DNS config, hosting IPs. ✔ It targets abuse clusters, not single domains This is where the real harm reduction happens. ✔ It avoids requiring proactive monitoring ICANN has historically refused to mandate proactive surveillance; this stays within precedent. ✔ It is enforceable Clear definitions + clear triggers + clear documentation = ICANN Compliance can act. --- 🧩 Optional Add‑Ons (if you want to go further) - Require registrars to suspend newly registered domains that match the abusive pattern until manual review. - Require registrars to share associated‑domain findings with registries or trusted notifiers. - Require registrars to publish transparency reports on associated-domain actions. These would be more controversial but would dramatically reduce abuse at scale. --- (we should seriously take it into account) ΜΕΓΓΟΥΔΗΣ Ναούμ Αστυνόμος Α' Διεύθυνση Δίωξης Κυβερνοεγκλήματος Τμήμα Διαδικτυακής Προστασίας Ανηλίκων Λ. Αλεξάνδρας 173, 115 22, Αθήνα<https://www.google.com/maps/place/%CE%94%CE%B9%CE%B5%CF%8D%CE%B8%CF%85%CE%B…> MENGOUDIS Naoum Police Major Cyber Crime Directorate Online Child Protection Department Alexandras Avenue 173, 115 22, Athens<https://www.google.com/maps/place/%CE%94%CE%B9%CE%B5%CF%8D%CE%B8%CF%85%CE%B…> T: (+30) 2106476475 E: n.mengoudis(a)cybercrimeunit.gov.gr<mailto:n.mengoudis@cybercrimeunit.gr> ------------------- Email Disclaimer This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this email. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system.If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited. Think green before printing

1 0

Proposed Agenda for 23 March 12:30 UTC
by Feodora Hamza March 21, 2026

March 21, 2026

Dear DNSAM PDP1 WG, Please find below the proposed agenda for our call on 23 March at 12:30 UTC. Agenda Item Time Welcome * ICANN85 Recap 5min Update on VC Chair Selection Procedure 5min Introduction of WG members * Name and Affiliation * One sentence on background/expertise * One sentence on “Why am I here?” 30 - 40min Update on Process for Review of workplan 20min Continue Deliberations – Charter Q1 20 - 30min AOB 5min Please note that later today you should receive further information/material regarding the Workplan and collaboration document (strawman document) for the WG deliberations. Thank you. Kind regards, Feodora

3 2

DNS Abuse Mitigation PDP1 WG
by ICANN Policy Calendar March 20, 2026

March 20, 2026

MEETING: DNS Abuse Mitigation PDP1 WG DATE/TIME: Weekly on Mondays at 12:30 UTC for 90 minutes, 23 March – 01 June 2026 Join from PC, Mac, iPad, or Android Zoom webinar: https://icann.zoom.us/j/91807711636?pwd=q6XCt8cWQU9m3fGgSojQ5X07pbnX6a.1 Passcode:+X8RaawVrW Phone one-tap: +13126266799,,91807711636#,,,,*0006343077# US (Chicago) +13462487799,,91807711636#,,,,*0006343077# US (Houston) Webinar ID: 918 0771 1636 Passcode: 0006343077 International numbers available: https://icann.zoom.us/u/a9jfXWLB8 ALL: Before joining the call * Please send apologies to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only * Please be sure you have read the ICANN Expected Standards of Behavior<https://urldefense.com/v3/__https:/www.icann.org/resources/pages/expected-s…>, the ICANN Community Anti-Harassment Policy<https://www.icann.org/resources/pages/community-anti-harassment-policy-2017…>, and the ICANN Community Participant Code of Conduct<https://www.icann.org/en/system/files/files/adopted-icann-community-partici…>. * 2026 Meetings wiki: https://icann-community.atlassian.net/wiki/x/B4CWLQ * Time Zone conversion (23 March): https://tinyurl.com/u3m4kuzv

1 0

Update regarding DNSAM PDP1 Leadership
by Feodora Hamza March 18, 2026

March 18, 2026

Dear DNSAM PDP 1 WG, During the GNSO Council meeting held on 9 March 2026 at ICANN85 the GNSO Council confirmed the nomination of Paul McGrady to serve as the DNS Abuse Mitigation PDP1 WG Chair. You may find the corresponding motion and the resulting resolution published below. * Motion: https://icann-community.atlassian.net/wiki/spaces/gnsocouncilmeetings/pages… * Resolution: https://gnso.icann.org/sites/default/files/policy/2026/vote-result/gnso-cou… Kind regards, Feodora Hamza Policy Development Support Manager (GNSO) Internet Corporation for Assigned Names and Numbers (ICANN) Mobile: +32 496 30 24 15 Email: feodora.hamza(a)icann.org<mailto:feodora.hamza@icann.org> Website: www.icann.org<http://www.icann.org>

1 0