<div dir="ltr"><div><div class="gmail_default" style="font-family:arial,sans-serif">Hi Shiva,</div><div class="gmail_default" style="font-family:arial,sans-serif"><br></div><div class="gmail_default" style="font-family:arial,sans-serif">Thank you very much and for your constructive feedback. We had a discussion about this on the list a few weeks back and members agreed to withdraw our support from the associated domain check. The statement tried to capture that discussion and generally NCSG's longstanding values and was read out yesterday so unfortunately we can't incorporate your changes but this is an ongoing conversation. Also we didn't withdraw support from the report as a whole but withdrew our support from this recommendation to investigate.</div><div class="gmail_default" style="font-family:arial,sans-serif"><br></div><div class="gmail_default" style="font-family:arial,sans-serif">Our concern with associated domain checks is not limited to domain name registrants. This mechanism can also significantly impact end users’ rights, particularly freedom of expression and access to information. Overbroad blocking of “associated” domains risks removing lawful websites and services, cutting off important sources of information and tools that users rely on. Because these determinations are often opaque, affected users typically receive no notice and have no way to challenge a mistake. In practice, such measures can disproportionately affect marginalized communities and independent media, especially in environments with weak rule of law, where “association” may be used as a pretext for censorship.</div><div class="gmail_default" style="font-family:arial,sans-serif"><br></div><div class="gmail_default" style="font-family:arial,sans-serif">Please see the examples below: </div><div class="gmail_default" style="font-family:arial,sans-serif">
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:"Helvetica Neue""><b>1. Overbroad blocking leading to collateral damage</b><b></b></p>
<ul class="gmail-ul1">
<li class="gmail-li1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:"Helvetica Neue""><span class="gmail-s1" style="font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:9px;line-height:normal;font-family:Menlo"></span>If a domain is flagged as “associated” with abuse, entire domains or subdomains can be suspended or blocked.</li>
<li class="gmail-li1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:"Helvetica Neue""><span class="gmail-s1" style="font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:9px;line-height:normal;font-family:Menlo"></span>This can remove lawful content and services hosted alongside or under the same infrastructure, preventing end users from accessing information or tools they rely on.</li>
</ul>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:"Helvetica Neue""><b>Example:</b><br>
A shared hosting provider has hundreds of legitimate small business websites. If one is compromised and associated domain checks link others incorrectly, the entire set could be disabled.</p>
<p class="gmail-p2" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:"Helvetica Neue";min-height:15px"><br></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:"Helvetica Neue""><b>2. Lack of transparency and remedy for affected users</b><b></b></p>
<ul class="gmail-ul1">
<li class="gmail-li1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:"Helvetica Neue""><span class="gmail-s1" style="font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:9px;line-height:normal;font-family:Menlo"></span>End users generally aren’t notified when a site they visit is blocked due to an associated domain determination.</li>
<li class="gmail-li1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:"Helvetica Neue""><span class="gmail-s1" style="font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:9px;line-height:normal;font-family:Menlo"></span>There’s no accessible appeals process for them, even if the information they sought was lawful and important.</li>
<li class="gmail-li1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:"Helvetica Neue""><span class="gmail-s1" style="font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:9px;line-height:normal;font-family:Menlo"></span>This lack of remedy erodes trust and leaves users without a path to challenge mistaken or excessive enforcement.</li>
</ul>
<p class="gmail-p2" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:"Helvetica Neue";min-height:15px"><br></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:"Helvetica Neue""><b>3. Chilling effect on speech and service availability</b><b></b></p>
<ul class="gmail-ul1">
<li class="gmail-li1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:"Helvetica Neue""><span class="gmail-s1" style="font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:9px;line-height:normal;font-family:Menlo"></span>Content creators and service providers may self-censor or avoid certain infrastructure for fear of being linked to an abusive actor through automated association.</li>
<li class="gmail-li1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:"Helvetica Neue""><span class="gmail-s1" style="font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:9px;line-height:normal;font-family:Menlo"></span>This indirectly limits diversity of content and services available to the public.</li>
</ul>
<p class="gmail-p2" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:"Helvetica Neue";min-height:15px"><br></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:"Helvetica Neue""><b>4. Disproportionate impact on marginalized or at-risk communities</b><b></b></p>
<ul class="gmail-ul1">
<li class="gmail-li1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:"Helvetica Neue""><span class="gmail-s1" style="font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:9px;line-height:normal;font-family:Menlo"></span>In countries with poor press freedom or weak rule of law, “association” can be used as a pretext to suppress independent media, activist groups, or opposition voices.</li>
<li class="gmail-li1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:"Helvetica Neue""><span class="gmail-s1" style="font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:9px;line-height:normal;font-family:Menlo"></span>Automated checks make it easier to justify blocking them without a specific, substantiated abuse case.</li>
</ul>
<p class="gmail-p2" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:"Helvetica Neue";min-height:15px">I would like to also caution us against supporting "proactive" measures before doing human rights impact assessment and having the remedy in place. </p><p class="gmail-p2" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:"Helvetica Neue";min-height:15px"><br></p><p class="gmail-p2" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:"Helvetica Neue";min-height:15px">Best regards, </p></div><br clear="all"></div><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><font face="verdana, sans-serif">Farzaneh </font></div></div></div></div><br></div><br><div class="gmail_quote gmail_quote_container"><div dir="ltr" class="gmail_attr">On Fri, Aug 15, 2025 at 6:54 PM Shiva Upadhyay <<a href="mailto:0000055b426785d6-dmarc-request@listserv.syr.edu">0000055b426785d6-dmarc-request@listserv.syr.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div><div style="font-family:"Helvetica Neue",Helvetica,Arial,sans-serif;font-size:13px"><div></div>
<div dir="ltr"><div><p>Dear Farzaneh and colleagues,</p>
<p>Thank you for sharing your draft statement and for raising these concerns in such a thoughtful way. I fully respect the emphasis on due process and registrant rights, which are central to any credible DNS abuse framework. However, I would like to humbly offer a different perspective on the question of associated domain checks.</p>
<p>In practice, DNS abuse, particularly phishing, malware distribution, and botnet activity, rarely occurs in isolation. Abusive actors often rely on clusters of domains, rapidly shifting activity to bypass takedowns. Associated domain checks provide an important technical signal that allows registrars and registries to detect these patterns and intervene effectively. Without this tool, enforcement becomes fragmented and reactive, enabling bad actors to outpace mitigation efforts.</p>
<p>I share the concern that any enforcement mechanism must be applied proportionately, with transparency and safeguards. But I would argue that these are implementation issues rather than reasons to reject the concept outright. Associated domain checks do not inherently imply arbitrary enforcement; rather, they serve as part of a broader, multi-factor review process. With safeguards such as registrant notification, appeal mechanisms, and transparency reporting, we can achieve both goals: effective DNS abuse mitigation and protection of registrant rights.</p>
<p>From my perspective, to rule out associated domain checks entirely risks weakening our collective ability to combat abuse at scale. A more constructive way forward may be to endorse their inclusion while explicitly conditioning their use on due process guarantees.</p>
<p>With that in mind, I would respectfully propose the following alternative statement for consideration:</p></div><br></div><div dir="ltr"><span>“NCSG approves the DNS Abuse Small Team Report. We acknowledge that associated domain checks are an important tool in identifying patterns of abuse, especially in clustered infrastructure. However, we emphasize that their use must be coupled with clear safeguards—registrant notification, transparency, and meaningful opportunities for redress—to ensure fairness, proportionality, and accountability. DNS abuse mitigation should protect both internet users and registrants, and we support developing implementation frameworks that strike this balance.”<br></span><br>Thanks & Regards,</div><div dir="ltr"><br></div><div dir="ltr">Shiva Upadhyay</div>
</div><div id="m_783940930145847556yahoo_quoted_6284507304">
<div style="font-family:"Helvetica Neue",Helvetica,Arial,sans-serif;font-size:13px;color:rgb(38,40,42)">
<div>
On Thursday 14 August, 2025 at 04:17:19 pm IST, Manju <<a href="mailto:manju4icann@gmail.com" target="_blank">manju4icann@gmail.com</a>> wrote:
</div>
<div><br></div>
<div><br></div>
<div><div id="m_783940930145847556yiv5927289098"><div><div>+1 to the statement. Thank you so much, Farzi!</div><div><br clear="none"></div><div>Best,</div><div>Manju</div><div id="m_783940930145847556yiv5927289098yqt47145"><div><br clear="none"><div><div dir="ltr">On Thu, Aug 14, 2025 at 18:12 Johan Helsingius <<a rel="nofollow noopener noreferrer" shape="rect" href="mailto:00001963cc94b85a-dmarc-request@listserv.syr.edu" target="_blank">00001963cc94b85a-dmarc-request@listserv.syr.edu</a>> wrote:<br clear="none"></div><blockquote style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">I fully support this.<br clear="none">
<br clear="none">
Julf<br clear="none">
<br clear="none">
<br clear="none">
On 14/08/2025 01:18, farzaneh badii wrote:<br clear="none">
> Hi all,<br clear="none">
> <br clear="none">
> As we mentioned during the PC meeting, we are planning to vote on <br clear="none">
> approving the small team recommendations on DNS abuse. There were three <br clear="none">
> recommendations that were prioritized, two of which seem to be <br clear="none">
> interesting to investigate. But we (as discussed on this mailing list) <br clear="none">
> had grave concerns about the associated domain check. Here is the small <br clear="none">
> team report: <a rel="nofollow noopener noreferrer" shape="rect" href="https://gnso.icann.org/sites/default/files/policy/2025/" target="_blank">https://gnso.icann.org/sites/default/files/policy/2025/</a> <br clear="none">
> draft/dns-abuse-small-team-report-04aug25-en.pdf <https:// <br clear="none">
> <a rel="nofollow noopener noreferrer" shape="rect" href="http://gnso.icann.org/sites/default/files/policy/2025/draft/dns-abuse-small-" target="_blank">gnso.icann.org/sites/default/files/policy/2025/draft/dns-abuse-small-</a> <br clear="none">
> team-report-04aug25-en.pdf><br clear="none">
> So tomorrow I will vote for adoption of small team's DNS abuse <br clear="none">
> recommendation but I am planning to read this statement:<br clear="none">
> <br clear="none">
> "NCSG approves the DNS Abuse Small Team Report. However, we wish to <br clear="none">
> formally record our concern regarding the inclusion of /associated <br clear="none">
> domain checks/ as a potential DNS abuse mitigation measure.<br clear="none">
> <br clear="none">
> While we support effective and proportionate approaches to combating DNS <br clear="none">
> abuse, we have consistently emphasized the need for due process at both <br clear="none">
> the registration, detection and enforcement stages. Associated domain <br clear="none">
> checks risk enabling overly broad or arbitrary enforcement—particularly <br clear="none">
> if implemented without robust safeguards to ensure registrants are <br clear="none">
> informed, have a meaningful opportunity to respond, and are protected <br clear="none">
> from collateral harm.<br clear="none">
> <br clear="none">
> Such measures could lead to disproportionate take-down and suspensions <br clear="none">
> and the targeting of legitimate registrants through bulk association- <br clear="none">
> based criteria, undermining fairness, transparency, and accountability. <br clear="none">
> We are also disappointed that due process and access to remedy have not <br clear="none">
> been prioritized by other stakeholders in this work. Domain name <br clear="none">
> registrants are not inherently criminals, and DNS abuse mitigation <br clear="none">
> measures should reflect that presumption.<br clear="none">
> <br clear="none">
> We therefore cannot support the inclusion of associated domain checks <br clear="none">
> unless and until clear, transparent, and consistently applied due <br clear="none">
> process mechanisms are in place."<br clear="none">
> <br clear="none">
> <br clear="none">
> <br clear="none">
> Farzaneh<br clear="none">
</blockquote></div></div></div>
</div></div></div>
</div>
</div></div></blockquote></div>