Actually there is no shift operated here. The fact that the email address published in the whois is owned by the registrant or a PP provider is irrelevant. It will go through the same verification process that the registrar is bound to operate. As to the consequences for the PP provider, I thought we agreed that their involvement in the registration of a domain name should be mentioned in the whois. Thus I am quite sure that a repeat offender would come on Compliance Radar and would trigger the applicable measures. Regarding the PP customer who is being scammed by the unscrupulous PP provider, they would not have their domain name deleted but suspended. They would therefore just need to contact their registrar to appoint an accurate email address, go through the verification process and have their domain reactivated. Lastly regarding the 14 days it only relates to whois inaccuracy, if the domain name is used in a blatantly illegal fashion there are - as you know - other routes and grounds to take it down. Luc
On 05 Dec 2014, at 17:29, McGrady, Paul D. <PMcGrady@winston.com> wrote:
Thanks Luc. I don't understand this part of your comment:
" While PP providers not caring about their ICANN PP accreditation - I still have faith we will see the end of this WG - could try to pull such stunt, I don’t see any benefit doing so."
If the accuracy compliance is shifted to the registrar, why would the PP's accreditation be at risk for posting non-sense WHOIS information? If there was a rule against it, and they did it, surely ICANN would want to enforce against the PP and not the registrar, at least at first? But your construct doesn't call for any such restriction, so what is ICANN's recourse to terminate the PP's accreditation? Also, what happens to the innocent PP customer who signs up with a gamer and loses his/her registration at the end of 14 days?
I'm sorry to ask so many questions, but I'm trying to understand why we would want to adopt a model that relieves PP services of the obligation to publish functioning email addresses and then shift the burden of initial cleanup to registrars (I understand registrars may still be stuck with ultimate cleanup, but in the case that PP services have an obligation to ensure that all published email addresses function, the registrar could complain to ICANN and insist on compliance action against the PP service that is causing it so much work).
PS: As we all know, a lot of mischief can be accomplished in 14 days.
-----Original Message----- From: Luc SEUFER [mailto:lseufer@dclgroup.eu] Sent: Friday, December 05, 2014 10:05 AM To: McGrady, Paul D. Cc: Michele Neylon; Don Blumenthal; Steven J. Metalitz; gnso-ppsai-pdp-wg@icann.org Subject: Re: [Gnso-ppsai-pdp-wg] @EXT RE: Continuing the discussiononhardbounces, and deciding on terminology
In such case the domain name registered with the nonsensical email addresses would in theory only be activated for a maximum of 14 days. (which is the RAA delay for a registrant to validation its email address). But I suppose that many registrars have implemented this obligation like we did and require the email addresses to be verified by the registrant prior to the domain name activation.
While PP providers not caring about their ICANN PP accreditation - I still have faith we will see the end of this WG - could try to pull such stunt, I don’t see any benefit doing so.
As other pointed out in the past during our calls, criminals are using valid details nowadays their goal is not to be detected by automated anti-fraud tools. A few years ago we could prevent the majority of domain names registrations used only for phishing attacks. Now they are really hard to detect as bad actors are getting incredibly resourceful.
Luc
On 05 Dec 2014, at 16:44, McGrady, Paul D. <PMcGrady@winston.com> wrote:
I wonder how other registrars would feel about that? What if there were an accredited privacy service that only put non-sense in email addresses and registrars spent their days responding to ICANN Compliance requests? The PP service would be shifting its costs to the registrars and the registrars would be getting nothing other than extremely manual, cost inefficient customers. What am I missing? I'd like to understand Luc's proposal.
Best, Paul
-----Original Message----- From: Michele Neylon - Blacknight [mailto:michele@blacknight.com] Sent: Friday, December 05, 2014 9:39 AM To: McGrady, Paul D.; Don Blumenthal; Luc SEUFER; Steven J. Metalitz Cc: gnso-ppsai-pdp-wg@icann.org Subject: RE: [Gnso-ppsai-pdp-wg] @EXT RE: Continuing the discussion onhardbounces, and deciding on terminology
I guess I'd say - yes There's already the requirement If you email thing@domain.tld and it bounces and that is the email address in whois then you can submit a whois accuracy complaint which will fall to the registrar who can then pass it to either the privacy service or the registrant (depending on what the relationships are .. )
-- Mr Michele Neylon Blacknight Solutions Hosting & Colocation, Domains http://www.blacknight.host/ http://blog.blacknight.com/ http://www.blacknight.press/ http://www.technology.ie/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Social: http://mneylon.social ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,Ireland Company No.: 370845
-----Original Message----- From: McGrady, Paul D. [mailto:PMcGrady@winston.com] Sent: Friday, December 5, 2014 5:37 PM To: Michele Neylon - Blacknight; Don Blumenthal; Luc SEUFER; Steven J. Metalitz Cc: gnso-ppsai-pdp-wg@icann.org Subject: RE: [Gnso-ppsai-pdp-wg] @EXT RE: Continuing the discussion onhardbounces, and deciding on terminology
Thanks. So is the suggestion that accuracy compliance related to whatever email PP services publish be redirected to registrars?
-----Original Message----- From: Michele Neylon - Blacknight [mailto:michele@blacknight.com] Sent: Friday, December 05, 2014 9:32 AM To: McGrady, Paul D.; Don Blumenthal; Luc SEUFER; Steven J. Metalitz Cc: gnso-ppsai-pdp-wg@icann.org Subject: RE: [Gnso-ppsai-pdp-wg] @EXT RE: Continuing the discussion onhardbounces, and deciding on terminology
Registrar
-- Mr Michele Neylon Blacknight Solutions Hosting & Colocation, Domains http://www.blacknight.host/ http://blog.blacknight.com/ http://www.blacknight.press/ http://www.technology.ie/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Social: http://mneylon.social ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,Ireland Company No.: 370845
-----Original Message----- From: McGrady, Paul D. [mailto:PMcGrady@winston.com] Sent: Friday, December 5, 2014 5:30 PM To: Michele Neylon - Blacknight; Don Blumenthal; Luc SEUFER; Steven J. Metalitz Cc: gnso-ppsai-pdp-wg@icann.org Subject: RE: [Gnso-ppsai-pdp-wg] @EXT RE: Continuing the discussion onhardbounces, and deciding on terminology
Thanks Michele. When you saw "we" do you mean registrar or privacy service?
-----Original Message----- From: Michele Neylon - Blacknight [mailto:michele@blacknight.com] Sent: Friday, December 05, 2014 9:25 AM To: McGrady, Paul D.; Don Blumenthal; Luc SEUFER; Steven J. Metalitz Cc: gnso-ppsai-pdp-wg@icann.org Subject: RE: [Gnso-ppsai-pdp-wg] @EXT RE: Continuing the discussion onhardbounces, and deciding on terminology
We've already dealt with this scenario with ICANN Compliance.
If the published email in whois leads to a bounced email we have to investigate it and fix it. The issue could be with the forwarding system or the receiving email on the far end - it doesn't matter which one it is. The obligation is the same
So I agree with Luc
Regards
Michele
-- Mr Michele Neylon Blacknight Solutions Hosting & Colocation, Domains http://www.blacknight.host/ http://blog.blacknight.com/ http://www.blacknight.press/ http://www.technology.ie/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Social: http://mneylon.social ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,Ireland Company No.: 370845
-----Original Message----- From: gnso-ppsai-pdp-wg-bounces@icann.org [mailto:gnso-ppsai-pdp-wg-bounces@icann.org] On Behalf Of McGrady, Paul D. Sent: Friday, December 5, 2014 5:22 PM To: Don Blumenthal; Luc SEUFER; Steven J. Metalitz Cc: gnso-ppsai-pdp-wg@icann.org Subject: Re: [Gnso-ppsai-pdp-wg] @EXT RE: Continuing the discussion onhardbounces, and deciding on terminology
Correct. So all that ICANN Compliance could do is write to the PP service, which will in turn confirm that the email address published is accurate. Absent giving ICANN access to the underlying customer data and convincing them to get in the business of confirming that underlying customer data (unlikely!/unwanted?), Luc's model doesn't seem to work.
Best, Paul
-----Original Message----- From: gnso-ppsai-pdp-wg-bounces@icann.org [mailto:gnso-ppsai-pdp-wg-bounces@icann.org] On Behalf Of Don Blumenthal Sent: Friday, December 05, 2014 9:19 AM To: Luc SEUFER; Steven J. Metalitz Cc: gnso-ppsai-pdp-wg@icann.org Subject: Re: [Gnso-ppsai-pdp-wg] @EXT RE: Continuing the discussion onhardbounces, and deciding on terminology
Luc,
It doesn't seem to me that you are referring to the typical privacy/proxy model. Services publish addresses that are owned by the p/p companies themselves and not ones, or aliases, that belong to service users.
Don
-----Original Message----- From: gnso-ppsai-pdp-wg-bounces@icann.org [mailto:gnso-ppsai-pdp-wg-bounces@icann.org] On Behalf Of Luc SEUFER Sent: Friday, December 5, 2014 9:48 AM To: Steven J. Metalitz Cc: gnso-ppsai-pdp-wg@icann.org Subject: Re: [Gnso-ppsai-pdp-wg] @EXT RE: Continuing the discussion onhardbounces, and deciding on terminology
Hello Steve,
I do understand that. But it doesn’t matter as when the registrar will verify the email address registered in the whois it will de facto verify the underlying one. So if the latter isn’t functioning the published one won’t be verified and the domain name deactivated.
If you take for example my own domain name for which I am using a poor man privacy service. The address I have published in the whois is junk@seufer.email<mailto:junk@seufer.email> which redirect to my actual email address. And as far as the registrar for my domain name is concerned, they verify the published address, they don’t care that it is forwarding to another one.
Luc
On 05 Dec 2014, at 15:22, Metalitz, Steven <met@msk.com<mailto:met@msk.com>> wrote:
Luc, we are not talking here about the e-mail address published in Whois, but the one to which the p/p provider forwards the message that was sent to the e-mail address published in Whois.
Steve Metalitz
-----Original Message----- From: Luc SEUFER [mailto:lseufer@dclgroup.eu] Sent: Friday, December 05, 2014 9:14 AM To: Leaning, Richard Cc: Metalitz, Steven; gnso-ppsai-pdp-wg@icann.org<mailto:gnso-ppsai-pdp-wg@icann.org> Subject: Re: @EXT RE: [Gnso-ppsai-pdp-wg] Continuing the discussion on hardbounces, and deciding on terminology
Hello Richard
Yes, the registrant is ultimately responsible for maintaining its details current. But in case they fail to - whatever the reason - a complaint can be lodged to ICANN via this form https://forms.icann.org/en/resources/compliance/complaints/whois/inaccuracy-... and the registrars in charge of the domain name will have to take reasonable steps to investigate and if applicable correct the inaccurate data.
The fact that the registrant details are those of the PP provider doesn’t matter. The obligations of the registrars stemming from the RAA are the same.
Best Wishes,
Luc
// Luc Seufer Chief Legal Officer | EuroDNS
office: +352 26 37 25-166 mobile: +352 691 600 417 fax: +352 20 300 166 lseufer@eurodns.com<mailto:lseufer@eurodns.com><mailto:lseufer@eurodns.com> | www.eurodns.com<http://www.eurodns.com><http://www.eurodns.com>
2, rue Léon Laval L-3372 Leudelange Luxembourg
On 05 Dec 2014, at 11:01, Leaning, Richard <Richard.Leaning@europol.europa.eu<mailto:Richard.Leaning@europol.europa.eu><mailto:Richard.Leaning@europol.europa.eu>> wrote:
Richard Leaning Cyber Community Engagement European Cyber Crime Centre (EC3) Europol
Mobile +44 (0) 7814744079 Office +31 70 3531630 Richard.leaning@europol.europa.eu<mailto:Richard.leaning@europol.europa.eu><mailto:Richard.leaning@europol.europa.eu>
-----Original Message----- From: Leaning, Richard Sent: Friday, December 05, 2014 11:00 AM W. Europe Standard Time To: 'Luc SEUFER'; 'Steven J. Metalitz' Cc: 'gnso-ppsai-pdp-wg@icann.org<mailto:gnso-ppsai-pdp-wg@icann.org><mailto:gnso-ppsai-pdp-wg@icann.org>' Subject: RE: [Gnso-ppsai-pdp-wg] Continuing the discussion on hard bounces, and deciding on terminology
My understanding is that it's the registrant who is responsible to keep the WHOIS accurate, not the registrar. Which is the problem with the WHOIS. I know that's another conversation altogether.
Cheers
Dick
Richard Leaning Cyber Community Engagement European Cyber Crime Centre (EC3) Europol
Mobile +44 (0) 7814744079 Office +31 70 3531630 Richard.leaning@europol.europa.eu<mailto:Richard.leaning@europol.europa.eu><mailto:Richard.leaning@europol.europa.eu>
-----Original Message----- From: Luc SEUFER [lseufer@dclgroup.eu<mailto:lseufer@dclgroup.eu><mailto:lseufer@dclgroup.eu>] Sent: Friday, December 05, 2014 10:15 AM W. Europe Standard Time To: Steven J. Metalitz Cc: gnso-ppsai-pdp-wg@icann.org<mailto:gnso-ppsai-pdp-wg@icann.org><mailto:gnso-ppsai-pdp-wg@icann.org> Subject: Re: [Gnso-ppsai-pdp-wg] Continuing the discussion on hard bounces, and deciding on terminology
But if the email address published in the whois is not functional, you would just need to report it to ICANN compliance which would then investigate and if need be have the applicable registrar update this record.
It seems to me rather more efficient than forcing the P/P provider to befriend its customers on skype. ;-)
Luc
On 04 Dec 2014, at 19:29, Metalitz, Steven <met@msk.com<mailto:met@msk.com><mailto:met@msk.com>> wrote:
Exactly – if e-mail does not function, and there is some other way to contact them in order to relay the message, then the provider should use that other way, at least upon request. That’s all that we are asking for here.
From: gnso-ppsai-pdp-wg-bounces@icann.org<mailto:gnso-ppsai-pdp-wg-bounces@icann.org><mailto:gnso-ppsai-pdp-wg-bounces@icann.org> [mailto:gnso-ppsai-pdp-wg-bounces@icann.org] On Behalf Of Stephanie Perrin Sent: Thursday, December 04, 2014 11:20 AM To: gnso-ppsai-pdp-wg@icann.org<mailto:gnso-ppsai-pdp-wg@icann.org><mailto:gnso-ppsai-pdp-wg@icann.org> Subject: Re: [Gnso-ppsai-pdp-wg] Continuing the discussion on hard bounces, and deciding on terminology
Thanks very much, this is extremely useful. As a representative of dumb users everywhere who are likely to be calling you in a blind panic many days after such an event occurs, I agree that the language we use, bouncing or otherwise, has to be crystal clear. It also has to take into account the possibility that users may designate some other way to contact them....a cell number, skype, etc. Cheers Stephanie On 14-12-02 1:28 PM, Christian Dawson wrote:
Colleagues,
I apologize for belaboring the point about ‘hard’ and ‘soft’ bounces when I know we’re not using that terminology, but I wanted to be delve deeper into that conversation to try to get us to acceptable terminology we CAN use. To do so, I want to explain further what I’m talking about.
As I stated on the call, my background is as a web hosting provider. Despite being a small business, I run a network with over a million domain names sitting somewhere on it, and about 517,000 individual mail accounts I am aware of. I want to be clear that the kinds of bounces I was talking about aren’t the kind when you give a bogus gmail or hotmail account. We’re talking about mail from independent resolvers that source back to an independent domain hosted on a server - the kind most often used by one of my web hosting customers, or a customer of that customer, or a customer of that customer of a customer, and so on.
There are tons of reasons for a permanent message failure in situations like these, a lot of them server conditions that are temporary in nature. There’s a good chart worth looking at here:
http://www.activecampaign.com/help/bounces-soft-bounce-vs-hard-bounce/
I’m not a registrar, I’m a web hosting provider and a small business owner - so from my perspective I’m trying to make sure we adopt policies that will keep service tickets to a minimum. As a web hosting provider, I already incur a lot of support costs over the ICANN WHOIS validation process. Every week we have numerous customers who write us complaining of being ‘down’ because they missed an email and ended up getting their business presence suspended. I want to make sure that we adopt standards in a way that doesn’t disadvantage my customers or cause them to open service tickets that cost me money. I think getting the terminology right will be the best way to do that.
------------------------- Christian J. Dawson (703)847-1381 x 7120 Voice Chief Operations Officer, ServInt www.servint.net<http://www.servint.net/> dawson@servint.com<mailto:dawson@servint.com> (703)847-1383 Fax -------------------------
_______________________________________________ Gnso-ppsai-pdp-wg mailing list Gnso-ppsai-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-ppsai-pdp-wg The contents of this message may be privileged and confidential. Therefore, if this message has been received in error, please delete it without reading it. Your receipt of this message is not intended to waive any applicable privilege. Please do not disseminate this message without the permission of the author. _______________________________________________ Gnso-ppsai-pdp-wg mailing list Gnso-ppsai-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-ppsai-pdp-wg The contents of this message may be privileged and confidential. Therefore, if this message has been received in error, please delete it without reading it. Your receipt of this message is not intended to waive any applicable privilege. Please do not disseminate this message without the permission of the author. The contents of this message may be privileged and confidential. Therefore, if this message has been received in error, please delete it without reading it. Your receipt of this message is not intended to waive any applicable privilege. Please do not disseminate this message without the permission of the author. The contents of this message may be privileged and confidential. Therefore, if this message has been received in error, please delete it without reading it. Your receipt of this message is not intended to waive any applicable privilege. Please do not disseminate this message without the permission of the author.
________________________________
--------------------------------------------------------
This e-mail and any attached files are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this e-mail by mistake, please notify the sender immediately and delete it from your system. You must not copy the message or disclose its contents to anyone.
Think of the environment: don't print this e-mail unless you really need to.
-------------------------------------------------------- The contents of this message may be privileged and confidential. Therefore, if this message has been received in error, please delete it without reading it. Your receipt of this message is not intended to waive any applicable privilege. Please do not disseminate this message without the permission of the author.
________________________________ -------------------------------------------------------- This e-mail and any attached files are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this e-mail by mistake, please notify the sender immediately and delete it from your system. You must not copy the message or disclose its contents to anyone. Think of the environment: don't print this e-mail unless you really need to. --------------------------------------------------------