DNS abuse is defined as being composed of five broad categories of harmful activity insofar as they intersect with the DNS — malware, botnets, phishing, pharming, and spam (when it serves as a delivery mechanism for the other forms of DNS abuse).
This blog post and the associated report aim to provide an overview of DNS abuse-related issues the Governmental Advisory Committee (GAC), part of the ICANN multistakeholder model, has identified. We also summarize the relevant community activity taking place to address these areas of interest and highlight remaining gaps.
From 2016 to June 2023, the GAC referenced four primary categories of activity related to DNS abuse:
- Contractual obligations
- Enhanced reporting
- Work on compromised and malicious registrations
- Measurement
Often these issues have also been raised in additional ICANN forums, including the Security and Stability Advisory Committee (SSAC) and the Generic Names Supporting Organization (GNSO).
Community responses have included the development of tools, educational resources, research projects, and measurement initiatives. These responses collectively work to increase the global Internet community’s understanding of the DNS abuse ecosystem and what mitigation and disruption practices best contribute to a safer online environment.
In addition, contractual obligations related to DNS abuse have been adopted by the ICANN Board. As this process continues, the community would benefit from increased awareness as to the tools and resources that exist to assist them with their new contractual requirements.
Several initiatives have been introduced to help reporters send reports to the correct part of the Internet ecosystem, but more work is needed to ensure reports are actionable and sufficiently evidenced and to raise awareness of the available tools.
Various projects have improved our ability to distinguish between compromised and maliciously registered domain names; ensuring these are appropriately mitigated and prevented requires a full public policy approach beyond the ICANN community and needs to include the wider Internet ecosystem.
There is considerable activity taking place to measure DNS abuse, which is adding to our overall understanding and providing the opportunity to benchmark. The next step will be to improve the accuracy — by reducing false positives, managing edge cases, and providing analysis on specific issues of interest (such as aging domains or incentive schemes).
This blog post and the associated report were prepared by the DNS Abuse Institute (Institute). The Institute focuses on initiatives to help reduce DNS abuse by fostering collaboration, creating best practices, and developing open, industry-shared solutions provided at no cost. The Institute was created in 2021 by the Public Interest Registry, the registry operator for the .ORG Top-Level Domain, in furtherance of its non-profit mission.
The Institute remains committed to further ICANN community work on this issue and will assist in whatever ways are appropriate. The Institute runs two main initiatives for the community:
- NetBeacon, the Institute’s centralized abuse reporting system, intends to address the problems of complexity and quality when it comes to reporting DNS abuse, specifically phishing, malware, botnets, and spam, to registrars and registries. NetBeacon attempts to eliminate barriers to reporting online abuse, such as a lack of technical knowledge, confusion on how to report abuse, and the inability to navigate the DNS ecosystem. NetBeacon makes the reporting process more productive by standardizing and enriching reports, benefitting abuse reporters, registrars, and registries.
- DNSAI Compass (Compass) measures the observed prevalence and persistence of phishing and malware in unique domain names across the DNS, both in terms of aggregate trends and on a TLD/registrar level. Compass provides aggregate data on observed mitigation, mitigation time, and registration type (malicious or compromised). Individualized dashboards are also available, free of charge, to help domain registrars and registries better understand and combat DNS abuse.
Rowena Schoo is the Director of Programs and Policy at the DNS Abuse Institute.
This post is adapted from the original on the DNS Abuse Institute Blog.
The views expressed by the authors of this blog are their own and do not necessarily reflect the views of APNIC. Please note a Code of Conduct applies to this blog.