ICANN 84 - Highlights from Dublin

Initially scheduled to be held in Muscat, Oman, the 84th ICANN meeting was relocated to Dublin due to security concerns. Unsurprisingly, DNS Abuse was once again the primary focus of the 2025 Dublin ICANN meeting.

The Double-Edged Sword 

The domain name industry's ability to self-regulate globally through ICANN is both an advantage and a disadvantage. On the positive side, it enables every player to enter the market and operate under the same rules, regardless of their location, fostering stability and predictability. However, this uniqueness also makes ICANN a target for legislators who struggle to achieve the same level of harmonisation in regulating online activities.

Under Pressure

For years, the domain name industry has faced pressure from governments and private interests to address online abuse, despite ICANN's scope being strictly limited to the domain name system. In 2013, the Registrar Accreditation Agreement (RAA) was amended to implement the so-called Law Enforcement Agency (LEA) "asks." Some of these requests were reasonable, while others were vague or overly broad, disregarding the operational and legal limitations of registrars.

Leverage

After 18 months of negotiations between ICANN and registrars, a revised version of the 2013 RAA was made available for signature. Notably, this new version was introduced when the last round of new extensions opened. ICANN mandated that only registrars who had signed the latest version of the agreement could become accredited by registries of the new extensions.

History Repeats Itself

Twelve years later, the internet has grown exponentially, as have the gaps in international laws and regulations. This has led to an increase in illicit and criminal activities. Unlike the domain name industry, there is no legal framework binding every hosting provider or online service operator. Law enforcement agencies and rights owners must navigate sovereignty, local laws, and jurisdiction, just as they do in the offline world.

Consequently, they are again attempting to use the new round of Top-Level Domains (TLDs) opening in April 2026 as leverage to impose new obligations on registries and registrars.

The Limitations of DNS-Level Action and Regulation

While their frustration is understandable and ICANN's uniqueness makes it an easy target, the DNS level is not the appropriate place to regulate and combat every kind of online abuse. By this logic, the registrar of the domain name facebook.com should immediately suspend this domain name as it is "a pillar of global economic fraud."

Progress Through Collaboration

This is not to say that registrars and registries are inactive. As mentioned in a previous post, they voluntarily amended their accreditation agreement in 2024 to, among other things, grant the ICANN compliance department greater purview, and this is yielding results.

They also help ICANN identify gaps in policy that could improve DNS Abuse mitigation and prevention. Soon, the policy development process will begin to address three identified gaps:

1. Associated domain name checks
2. Gated API access
3. DGA malware and botnet

The fact that these topics will undergo the policy development process does not guarantee that each will result in a policy. It will be up to each working group to determine the most effective way to bridge the identified gap.

A constant fight

During the Dublin meeting, several registries presented their methods for identifying and combating DNS Abuse. Unsurprisingly, they all employed "artificial intelligence," each with its own definition of the trendy term. They all faced the same challenges as registrars: criminals are becoming increasingly sophisticated, and there is no single solution.

Just like in the offline world, fraud and abuse will never completely disappear and will require constant efforts and innovation from every actor to mitigate them.