GAC and Community
Work on DNS Abuse
October 2026
About this Report
The GAC is an ICANN Advisory Committee of Government and Intergovernmental Organization (IGO) representatives that advises the ICANN Board on public policy matters. The Generic Names Supporting Organization (GNSO) fashions policy for generic Top-Level Domains, and DNS Abuse (malware, phishing, pharming, botnets, and spam when used to propagate the other four named forms of DNS Abuse) is a policy area the GNSO Council is taking action on.
This report aims to map out references to DNS Abuse, particularly points of interest and action statements, made in GAC Communiqués from 2016 to June 2026 to relevant DNS community initiatives, including those undertaken by the Institute. This report is designed for use by the ICANN community, and interested parties, to improve their understanding of the active steps the DNS community is taking to combat DNS Abuse, the progress on GAC’s recommendations, and where further work is needed.
Executive Summary
Meeting | Advice | Status |
|---|---|---|
ICANN57 (2016) | Requested details on ICANN’s diligence regarding Registrar Accreditation Agreement (RAA) Section 3.18 (Abuse Contact / Duty to Investigate). | ICANN Board submitted a scorecard to GAC on 3 Feb 2027 following trilateral dialogue between the Board, GAC, and GNSO. |
ICANN83 (2025) | Urged the GNSO Council to begin PDPs on DNS Abuse before ICANN84, prioritizing bulk registration and a registrar’s duty to investigate related domains. | ICANN Board submitted a scorecard to GAC on 14 Sep 2025 following trilateral dialogue between the Board, GAC, and GNSO. |
What Is the GAC?
The Government Advisory Committee (GAC) represents the voice of Governments and Intergovernmental Organizations (IGOs) in ICANN’s multistakeholder structure. This report outlines the GAC’s recent input on DNS Abuse, the current status of DNS Abuse work by ICANN and across the community, and DNS Abuse mitigation efforts of importance for ICANN 87.
What Does the GAC Do?
- Issues Advice to the ICANN Board on issues of public policy
- Drafts Communiques detailing its work and its views on issues of importance to the GAC
The ICANN Board responds to both formal GAC Advice and to the GAC’s input on “issues of importance.” The ICANN Bylaws require the Board to seek mutually acceptable solutions before rejecting GAC Advice. Since 2016, the GAC has issued both formal Advice and identified issues of importance related to DNS Abuse.
Current Areas of Importance
- The GAC has urged the community to continue finalizing work on PDP 1 and to begin work on PDP 2
- The GAC has requested updates on the implementation and enforcement of the 2024 DNS Abuse Amendments
Work from the Community
- The Policy Development Process (PDP) 1 on Associated Domain Checks Working Group released its Initial Report for Public Comment
- The Generic Names Supporting Organization (GNSO) Council recently convened a drafting team for PDP 2 on Registrations at Scale
Work from ICANN Org
- ICANN Compliance terminated a registrar for DNS Abuse. This is the first termination on the basis of DNS Abuse; it shows the amendments have teeth, and that ICANN Compliance is willing and able to terminate registrars on DNS Abuse grounds.
- OCTO-044 Publication on associated domains checks of DNS Abuse registered in bulk
- Metrica now verifies Mitigation status of DNS Abuse report
NetBeacon Institute Updates
- Testing new languages in NetBeacon Reporter: English, Spanish, French, Turkish, Brazilian Portuguese, Arabic, Simplified Chinese. Volunteers needed to help us test!
- Published a case study on the impact of ICANN Compliance Breach Notices
- New external Resource Library to learn about DNS Abuse
- 27,240 phishing domains analysed in July 2026 through NetBeacon MAP
- NetBeacon Reporter surpasses 600,000 reports all-time
What’s Next?
- Tune in for important conversations at ICANN87
- Interested in learning more about developments in DNS Abuse? Book a meeting with us here!
Important Sessions at ICANN87
DNS Abuse Mitigation Themes
This section explores key DNS Abuse themes and maps out community activity with GAC interventions.
Theme 1: Unearthing Malicious Campaigns
(PDP1: Associated Domain Checks)
The GNSO DNS Abuse Small Team identified Associated Domain Check (ADCs) as one of the policy gaps that could be addressed through a policy development process. The GNSO Council approved a charter creating a multistakeholder working group with representatives from across the ICANN community. The working group issued its Initial Report, which recommends policy obligating registrars to conduct an Associated Domain Check (ADC), for public comment. The Initial Report received 40 submissions before it closed, which the working group will review during ICANN87.
The GAC has several representatives in the working group, and has been an advocate of additional policy work beyond the amendments. It has previously called for completion of both PDPs prior to the next round of gTLD delegations.
Timeline
2022
- GNSO DNS Abuse Small Team report first flags the need for ADC-related work
Nov 2024
- The GAC supports the community conducting more work on DNS Abuse including several narrowly scoped PDPs (ADC)
April 2025
- The Small Team reconvenes to identify further work to address DNS Abuse
May 2025
- The Institute publishes a White Paper proposing PDPs on ADC, bulk registration, subdomains, recourse mechanisms, and DGA-based abuse coordination
Jun 2025
- The GAC issues Formal Advice to the Board urging the GNSO Council to start PDPs, prioritizing a registrar’s duty to investigate domains associated with a registrant’s account when it is the subject of an actionable report
Jul 2025
- The Small Team’s report to Council names ADC and DGA-based abuse coordination among the top priority gaps
Aug-Dec 2025
- The Preliminary and Final Issue Reports are presented to the GNSO Council; the Final Issue Report recommends a separate charter for ADC
Jan 2026
- The GNSO Council approves the PDP 1 (ADC) Charter
Mar 2026
- The GAC welcomes PDP 1’s start, pushes for a shorter timeline and regular progress checks, hopes it becomes a “blueprint”
- PDP1 Working Group begins work
Jun 2026
- The GAC welcomes progress on the ADC PDP, reiterates PDP 1 should complete before the 2026 new-gTLD round delegates strings
Aug 2026
- The PDP 1 Working Group’s Initial Report opens for Public Comment
Sep 2026
- The Public Comment period closes with 40 on-time submissions
Current Gaps:
- Discussions are underway about the best way to measure the PDP1’s impact on abuse once implemented; the Institute is exploring how MAP and Reporter data could feed into that.
- Likely next topics for this theme: Bulk registrations/API – see below, and registrant recourse mechanisms.
Theme 2: Preventing Malicious Campaigns
(PDP2: Bulk Registrations/API)
While ADC’s are expected to mitigate existing abuse, this PDP2 focuses on bulk registrations to prevent DNS Abuse before the domains are registered maliciously. It was identified by the Small Team Report as a policy gap. The GNSO Council is currently working on the charter for this PDP, and they are carefully deliberating on how the PDP can effectively approach high volume registration tools like APIs to curtail DNS Abuse. The Council has not yet set a launch date for the PDP, but it will likely begin either at ICANN88 or ICANN89 in 2027. This would allow time for the Council to approve the charter, representatives to be chosen, and meetings to be organized.
The GAC has been interested in gating bulk registrations for several years now, and has expressed support of the GNSOs work to get the PDP started as soon as possible. While not involved in the chartering process, the GAC shares its thoughts through the GAC liaison. The GAC’s next step is figuring out their desired outcomes as well as identifying potential representatives on the working group.
Timeline
2022
- The GNSO DNS Abuse Small Team Report first flags bulk registration; not addressed in the 2024 amendments
Mar 2025
- The GAC asks for insights from the ICANN Office of the Chief Technology Officer (OCTO) on bulk registrations/API in a DNS Abuse context
Jul 2025
- The Small Team’s Final Issue Report to the GNSO Council names unrestricted API access for bulk registration among the top priority gaps
Oct 2025
- The GAC wants charter language on bulk registration to stay technology-neutral rather than API-specific, since there are multiple ways to automate large-volume domain registration
Jun 2026
- The GAC states that once sufficient progress is made on PDP1, work on PDP2, covering API access safeguards for new registrants, should begin
Aug 2026
- The GNSO Council forms a drafting team for the PDP2 charter
Sep 2026
- OCTO publishes OCTO-044 Associated Domain Methods Using Public Data to quantify suspected abuse registered in bulk
Current Gaps:
- There is no current information on the anticipated date of PDP 2
Theme 3: Requiring Mitigation
In 2023, the Contracted Parties (gTLD registrars/registries) negotiated amendments to their contracts with ICANN, which came into effect in 2024. The amendments obligate registrars to promptly investigate reports of DNS Abuse and take appropriate action. ICANN’s Contractual Compliance team receives reports of non-compliance and sends a notice to Contracted Parties to implement remedial measures.
When informal resolution fails, we see public indications of escalating enforcement. This typically comes in the form of a public breach notice (of which ICANN has issued 7 to registrars, and 1 to registries). Most recently, ICANN terminated a registrar for non compliance, sending a strong signal that ICANN Compliance are willing and able to turn a registrar off for failure to appropriately mitigate well-evidenced reports of DNS Abuse.
Implementation, enforcement, and measurement of the amendments have previously been stated as the GAC’s priority. The termination of a registrar is a significant development in enforcement. Various projects publish metrics to track abuse volumes and mitigation rates, including NetBeacon MAP and ICANN Metrica.
Timeline
2016-2022
- The GAC issues repeated calls for clearer, enforceable contract provisions on DNS Abuse, including abuse reporting at the registrar/registry level and public aggregate data
2019
- Framework to Address Abuse launches with 11 signatories, later grows to 50+; SSAC115 draws the line between DNS Abuse and content abuse
2021
- Public Interest Registry (PIR) creates the NetBeacon Institute (formerly DNS Abuse Institute)
2022-2023
- ICANN and Contracted Parties negotiate the amendments
- The NetBeacon Institute launches NetBeacon MAP to provide credible, reliable metrics on DNS Abuse
2023
- The GAC signals support for the negotiations, welcomes clarity that non-compliance could lead to suspension/revocation, urges swift adoption once finalized
- NetBeacon MAP starts publishing Specific Reporting tables
Jan 2024
- ICANN Board adopts the amendments
Apr 2024
- Amendments enter into force
Jul 2024
- ICANN Compliance issues breach notice to .TOP Registry for RA violations related to DNS Abuse. This is the first and only breach notice under the amendments towards a gTLD registry
Sep 2024
- ICANN Compliance issues breach notice to registrar Aceville Pte for RAA violations related to DNS Abuse. This is the first breach notice under the amendments towards a registrar
Dec 2024
- The Institute publishes a NetBeacon MAP review of mitigation rates
2024-2026
- The GAC tracks implementation of the amendments; notes a post-amendment spike in abuse reports, requests regular compliance reporting on the report-to-action ratio, escalates toward a centralized mandatory reporting mechanism (not yet delivered)
Feb 2025
- ICANN Compliance issues a breach notice to registrar Ultahost for RAA violations related to DNS Abuse
Jul 2025
- ICANN Compliance issues a breach notice to registrar WebNic.cc for DNS Abuse mitigation failures
Jun 2026
- ICANN Compliance issues first breach notice to registrar Fewmoretaps for RAA violations related to DNS Abuse
Aug 2026
- ICANN Compliance issues termination notice to registrar Fewmoretaps for RAA violations related to DNS Abuse. This is the first termination notice whose listed reason is under the amendments
Oct 2026
- The Institute publishes blog using mitigation data correlated with breach notices to measure the impact of enforcement
Current Gaps:
- More attention needs to be paid to how compliance notices affect abuse rates as well as mitigation rates for a given registrar
Past Themes
These three issues were raised clearly, met with a strong, direct response, and haven’t come back up in any Communiqué since.
Malicious vs. Compromised Domains
- GAC’s ask (2022): Last raised at ICANN73, the GAC noted the community plenary session on “Evolving the DNS Abuse Conversation,” finding it “universally agreed” that the malicious/compromised distinction is important and supporting further community work on it. At ICANN75, the GAC welcomed a forthcoming Contracted Parties House discussion paper on “malicious vs. compromised” domains.
- The response: the COMAR study (SIDN Labs, AFNIC Labs, and Grenoble Alpes University) developed a classification method that distinguishes malicious from compromised domains with 97% accuracy. NetBeacon MAP now publishes malicious/compromised breakdown charts as a standard feature. The Institute has published best-practices content on identifying and mitigating each type differently.
DNS Abuse Measurement & Metric Clarification
- GAC’s ask (2021-2024): across ICANN71, 75, 78, 79, and 80, the GAC repeatedly asked for clearer definitions of contractual terms like “reasonable,” “actionable,” and “prompt,” and for better DNS Abuse measurement infrastructure generally.
- The response: ICANN published a formal advisory in February 2024 clarifying exactly those terms.
Enhanced DNS Abuse Reporting
- GAC’s ask (2022-2024): at ICANN74, the GAC explicitly welcomed “the launch of a free, centralized abuse reporting tool by the community in response to recommendations made in both SAC115 and the SSR2 Review Final Report.” Related asks about reporting quality and tooling continued through ICANN75, 76, 78, and 79.
- The response: NetBeacon Reporter is exactly this, a free, centralized, standardized abuse reporting conduit for submitting reports of DNS Abuse registrars and registries.
What's Next
- PDP1 : the PDP1 Working Group will review public comment submissions during its sessions at ICANN87 to identify any remaining policy gaps; PDP2 charter drafting continues in parallel.
- Session 1
- Session 2
- Session 3
- Session 4
- PDP2: the gNSO will meet to discuss PDP2 and Human Rights Impact Assessment
- GAC: the GAC will hold a community discussion on DNS Abuse
- OCTO: OCTO will discuss strategies to detect abusive campaigns at scale
- Community plenary on recourse
- CPH and CSG: The Contracted Party House will meet with the Commercial Stakeholder Group and one discussion topic will be DNS Abuse data sharing.
Appendices
Appendix 1: Full Communiqué Table
|
Issue |
GAC Communiqué |
Issues of Importance |
|
2024 Contract Amendments |
* GAC Advice to the Board Requested information from ICANN on a variety of issues, including the diligence applied by ICANN in relation to ‘3.18 Registrar’s Abuse Contact and Duty to Investigate Reports of Abuse’ in the 2013 Registrar Accreditation Agreement (ICANN57, 2016). ICANN responded to this request. |
|
|
“The GAC supports the development of proposed contract provisions applicable to all gTLDs to improve responses to DNS Abuse. The GAC also emphasized the importance of taking measures to ensure that Registries, Registrars and Privacy/Proxy Services providers comply with the provisions in the contracts with ICANN, including audits.” |
||
|
“The GAC acknowledged the importance of ensuring that registries and registrars comply with ICANN contractual obligations. At the same time, the GAC continues to emphasize the need to develop and implement improved contract provisions, with clear and enforceable obligations, to better address DNS Abuse before further expanding the root through any subsequent application round for new gTLDs” |
||
|
“Relatedly, the GAC highlights the need for improved contract requirements to address the issue of DNS Abuse more effectively…The GAC looks forward to a definitive timeline for such an initiative.” |
||
|
“Improved contract provisions could focus on the reporting and handling of DNS Abuse and enforcement of related contract requirements” “The following would assist in developing such contract provisions: abuse reporting at the registrar and registry level; more detailed breakdowns of the types of DNS Abuse measured; and availability of raw aggregated data” |
||
|
“There was also a discussion about potential work across the community that could focus on developing improved contract provisions for ICANN’s consideration, and on the scope of DNS Abuse that may be addressed within ICANN’s remit. Discussion on a potential Policy Development Process could proceed in parallel with the advancement of these efforts” |
||
|
“The creation of effective and enforceable requirements for registrars and registries to disrupt or mitigate DNS abuse will represent a positive and concrete first step in addressing [DNS Abuse] at ICANN” In 2023, the GAC offered their support for contract negotiations between ICANN and Contracted Parties that improve existing DNS Abuse obligations and encouraged additional work. “The GAC … encourages the Contracted Parties and ICANN to further consider, inter alia, proactive measures as well as positive incentives for registries and registrars in future work on DNS abuse mitigation or disruption” (ICANN76, 2023). |
||
|
“The GAC welcomes the clarity provided during its DNS Abuse session that in case of non-compliance ICANN Compliance would be able to suspend or revoke the agreement with the contracted party, and it encourages ICANN org and the negotiating team to ensure this is clear in this process under the amendment.” “The GAC also welcomes any further work the negotiating team can do to clarify forthcoming reporting obligations with a view to promote transparency of the contracted parties’ policies and how they respond to DNS Abuse.” |
||
|
“Once the amendments are adopted, the GAC intends to engage with the community in discussions on policy efforts around the above mentioned topics as well as other key themes linked to effective implementation of the amendments, such as clarification of key terms from the amendments (i.e., “reasonable”, “actionable”, “prompt”).” “The GAC urges the Contracted Parties to adopt the DNS Abuse amendments so that baseline obligations for gTLD registries and registrars regarding DNS Abuse are established in ICANN’s contracts. The GAC also urges ICANN org to provide the community with the ability to monitor the implementation of the amendments.” |
||
|
“The GAC acknowledged the recommendation that, to support effective enforcement, the community would need to establish minimum evidential thresholds and standards for “actionable evidence”. Such standards should be consistently applied. Regarding “prompt action,” reference was made to SSAC115, which outlines a 96-hour minimum standard. To develop a clear appreciation of what “stop and/or otherwise disrupt” means, it was recommended that the information Contracted Parties provide on enforcement actions taken include the action taken as well as the considerations that lead to it.” “The GAC appreciated hearing from ICANN org’s Compliance department about plans for auditing and enforcing the amendments” “The GAC discussed what a reasonable timeframe for assessing the impact of the obligations might be. Some suggested six months. However, there remains a general expectation that significant progress occur in advance of the next round of new gTLD applications. The GAC will track reports from ICANN Compliance on DNS Abuse enforcement.” |
||
|
“The GAC looks forward to continuing discussions on DNS Abuse before and during ICANN81 where it expects to receive updates from ICANN Compliance on the implementation of contract amendments.” |
||
|
“the GAC notes that the volume of abuse reports has increased in this period compared to the same period before the amendments entered into force, possibly due to increased filing by those who submit abuse reports.” “The GAC also notes ICANN Compliance is keeping track of data regarding mitigation and disruption actions taken as results of DNS Abuse reports and welcomes ICANN Compliance’s actions to enforce the contractual amendments.” “The GAC highlights the importance of regular reporting from ICANN Compliance, including on statistics about the ratio between the number of reports and actions undertaken, and more specific information about the types of disruption or mitigation actions taken. The GAC would also welcome information about practices stemming from the interpretation of the Advisory guidance, for example in relation to “actionable evidence.” |
||
|
“The GAC underscores that it would be helpful to receive more information on ICANN Compliance’s updates on the implementation of contract amendments, and their proactive efforts related to investigation and enforcement (such as audits) of said amendments… the GAC emphasizes the need for Contracted Parties to share information and evidence on DNS Abuse within the community and encourages them to quickly act on DNS Abuse reports.” |
||
|
“The GAC welcomed last year’s contract amendments establishing obligations for Contracted Parties to mitigate and disrupt DNS Abuse, as a first step. Further work is necessary, however, to stem the increasing cost to the public of phishing, malware, botnets, and other forms of DNS Abuse.” |
||
|
“Additional policy issues outside of those targeted by the PDPs were discussed, including the absence of an obligation for the contracted parties to report on the abuse notices they receive and act upon. Without this data, the impact of the contract amendments on DNS Abuse, as well as the role of compliance in enforcing these new obligations, cannot be accurately measured.” “Regarding policy, the GAC notes that the 2024 DNS Abuse contract amendments served as an important first step, but more must be done to address the problem.” “Further, the GAC supports ICANN providing DNS abuse contract compliance data in standardized, open, machine-readable formats, in order to support evidence-based policy development and enforcement.” |
||
|
“The GAC also encourages ICANN to explore the establishment of a centralized reporting mechanism managed by ICANN for the periodic reporting of DNS Abuse complaints received by registrars and registries, including the number of complaints and actions taken. Such reporting would help provide a clearer understanding of abuse trends, improve transparency, and support more effective policy responses.” |
||
|
“Recalling the ICANN85 Mumbai Communiqué, and noting the exchange with the ICANN Board on a centralized reporting function, the GAC reiterates the need for a mandatory reporting requirement for DNS abuse by the registrars.” |
||
|
Policy Work Beyond Amendments |
“The GAC looks forward to further engaging with the community to identify priorities which could be considered for further policy and other types of work to address DNS Abuse. The GAC recalls some topics previously identified (such as guidance on key terms or capacity building to disseminate best practices), as well as discussions on possible targeted, narrowly scoped PDPs to further address DNS Abuse.” |
|
|
“The GAC finds the INFERMAL report especially insightful as it contains findings that may further support the need for a targeted Policy Development Process on DNS Abuse… In particular, the GAC considers it important to look further into the topic of bulk registrations of domain names as one of the most correlated drivers to DNS Abuse” |
||
|
“The GAC is pleased that several community stakeholder groups share its view that more work is needed to address DNS Abuse. Continued efforts are necessary, and the upcoming new round of generic Top-Level Domains (gTLDs) set to open next year, underscores the urgency to act swiftly.” “Given the time constraints leading up to the next application round for New gTLDs, the GAC recommends prioritizing specific topics, as outlined in the GAC’s ICANN83 advice.” * GAC Advice to the Board “To urge the GNSO Council to undertake all necessary preparations prior to ICANN84 towards starting targeted and narrowly scoped Policy Development Processes (PDPs) on DNS Abuse issues, prioritizing bulk registration of malicious domain names and the responsibility of registrars to investigate domains associated with registrant accounts that are the subject of actionable reports of DNS Abuse.” |
||
|
“The GAC also noted with interest a point raised during discussion that there are different ways to automate the registration of a large number of domain names, and therefore policies should be effective while remaining technologically neutral.” “recalling its ICANN83 Advice to the ICANN Board9, the GAC recognizes the extensive efforts made by the ICANN community, prior to ICANN84, to proactively initiate DNS Abuse policy work. Swift progress should continue.” “The GAC continues to prioritize the commencement of policy development. At the same time, the GAC will follow efforts to address the additional gaps raised by the Preliminary Issue Report, all of which should ensure that critical DNS abuse vectors are effectively mitigated.” |
||
|
“GAC Members participated in the inaugural meetings of the GNSO Policy Development Process on Associated Domain Checks, and find that the PDP is off to a good start. The GAC favors shortening the overall timeline of the work and encourages the GNSO Council and ICANN org to regularly assess whether project milestones are being achieved. The GAC expects that the narrow scope of the PDP will yield rapid results, so that it can be treated as a “blueprint” for effective policy development at ICANN going forward.” “Transparency of reporting, underuse of predictive algorithms for early detection, subdomain abuse, and reducing the time for registrant contact verification remain particularly important issues for the GAC. The Committee welcomes the indication from the GNSO Council that it is developing a methodology to prioritize these policy gaps, and would appreciate further details as soon as possible.” |
||
|
“The GAC welcomes the progress achieved to date in the ADC PDP, and appreciated hearing stakeholder views from across ICANN Supporting Organizations and Advisory Committees. Once sufficient progress has been made in PDP1, PDP2, which addresses safeguards for Application Programming Interface access to new registrants, should begin.” “The GAC reiterates its expectations for policy development and implementation, notably on PDP1, to take place before the delegation of new strings from the 2026 application round.” |
Appendix 2: Glossary
- AC: Advisory Committee
- DNS Abuse: Registered domains used for phishing, malware, botnets, pharming, and spam when used as a delivery mechanism for one of the other four categories
- GAC: Government Advisory Committee
- gNSO: Generic Names Supporting Organization
- OCTO: ICANN Office of the Chief Technology Officer
- PDP: Policy Development Process
- SO: Supporting Organization