New WHOIS Info Verification Being Implemented by ICANN

LOS ANGELES—The Internet Corporation for Assigned Names and Numbers (ICANN) is following through on its promise to shore up erroneous whois contact information. Using false or misleading info has long been a tactic of fraudsters and other internet miscreants running dodgy websites who don't want anyone finding them. Under pressure from international law enforcement as well as governments frustrated with the domain cat-and-mouse game, the Marina del Rey, California-based non-profit that contracts with the U.S. Commerce Department to oversee the management of the domain space is trying to kick stricter rules into gear. Under the new rules, registrars are now required to follow up after a new domain has been registered, or an old one transferred to a new owner, to make sure that the contact info provided for the whois lookup is correct. If any of the information is found to be incorrect, the registrar is expected to update the whois listing with the correct information once it is received from the domain owner. In worst-case scenarios, in which the domain owner "willfully" refuses to comply with registrar requests or provide false information, the registrar is directed by ICANN to "either terminate or suspend the Registered Name Holder's Registered Name or place such registration on clientHold and clientTransferProhibited, until such time as Registrar has validated the information provided by the Registered Name Holder." Specifically, the rules state: Except as provided for in Section 3 below, within fifteen (15) days of (1) the registration of a Registered Name sponsored by Registrar, (2) the transfer of the sponsorship of a Registered Name to Registrar, or (3) any change in the Registered Name Holder with respect to any Registered Name sponsored by Registrar, Registrar will, with respect to both Whois information and the corresponding customer account holder contact information related to such Registered Name: Validate the presence of data for all fields required under Subsection 3.3.1 of the Agreement in a proper format for the applicable country or territory. Validate that all email addresses are in the proper format according to RFC 5322 (or its successors). Validate that telephone numbers are in the proper format according to the ITU-T E.164 notation for international telephone numbers (or its equivalents or successors). Validate that postal addresses are in a proper format for the applicable country or territory as defined in UPU Postal addressing format templates, the S42 address templates (as they may be updated) or other standard formats. Validate that all postal address fields are consistent across fields (for example: street exists in city, city exists in state/province, city matches postal code) where such information is technically and commercially feasible for the applicable country or territory. Verify: the email address of the Registered Name Holder (and, if different, the Account Holder) by sending an email requiring an affirmative response through a tool-based authentication method such as providing a unique code that must be returned in a manner designated by the Registrar, or the telephone number of the Registered Name Holder (and, if different, the Account Holder) by either (A) calling or sending an SMS to the Registered Name Holder's telephone number providing a unique code that must be returned in a manner designated by the Registrar, or (B) calling the Registered Name Holder's telephone number and requiring the Registered Name Holder to provide a unique code that was sent to the Registered Name Holder via web, email or postal mail. In either case, if Registrar does not receive an affirmative response from the Registered Name Holder, Registrar shall either verify the applicable contact information manually or suspend the registration, until such time as Registrar has verified the applicable contact information. If Registrar does not receive an affirmative response from the Account Holder, Registrar shall verify the applicable contact information manually, but is not required to suspend any registration. The rules also state: Upon the occurrence of a Registered Name Holder's willful provision of inaccurate or unreliable WHOIS information, its willful failure promptly to update information provided to Registrar, or its failure to respond for over fifteen (15) calendar days to inquiries by Registrar concerning the accuracy of contact details associated with the Registered Name Holder's registration, Registrar shall either terminate or suspend the Registered Name Holder's Registered Name or place such registration on clientHold and clientTransferProhibited, until such time as Registrar has validated the information provided by the Registered Name Holder. ghacks.net has provided a few useful tips for domain owners, advising them, "Domain owners will have to pay attention to verification emails that they receive from their registrars. It is no longer possible to simply ignore those, as access to the domain may be lost in the process for as long as it takes to validate the information. You may also want to check your registrar's domain management page where all of your domains are listed. You may find somewhere 'pending verification' or 'validation' is listed as the status. Make sure you correct any issues here to avoid further problems." The complete new whois rules can be found here, along with the rest of ICANN's 2013 Registrar Accreditation Agreement.