DNS Abuse is any malicious activity aimed at disrupting the DNS infrastructure or causing the DNS to operate in an unintended manner. Abusive activities include corrupting DNS zone data, gaining administrative control of a name server, and flooding the DNS with thousands of messages to degrade name-resolution services.
- Botnet Attacks,
- pharming, and
- spam (when it is used to deliver other forms of DNS Abuse), accounting for over 85% of DAAR-reported DNS abuse in February 2021.
In 2009-2010, the Registration Abuse Prevention Working Group (RAPWG) generated a report that distinguished between “Registration Abuse” (technical abuse) and “Use Abuse” (content abuse). Technical abuse was defined as attempts to harm the DNS infrastructure and/or using the DNS to cause harm. Content abuse was defined as harms carried out through the use of a domain name, such as through the content on a website. This category of harm includes trademark and copyright infringement, defamation, piracy, child sexual abuse, and hate speech. The RAPWG concluded that technical abuse was within ICANN’s jurisdiction but content abuse was not. However, the working group recommended the development of the Uniform Dispute Resolution Policy (UDRP) because it involved the registration and use of domain names in bad faith.
In 2013, conversations between the Governmental Advisory Committee and the ICANN Board led to an amendment to Registry Agreements in 2013 to include Specification 11. Registry operators must now periodically conduct a technical analysis to assess whether domains within their TLD are used to carry out security threats, such as pharming, phishing, malware, and botnets. They must also include terms in their RRAS such that registrants are prohibited from perpetuating technical and content abuse.
In 2019, a group of domain name registries and registrars developed and released a document called the "Framework to Address Abuse," with 11 signatories. By 2021, 48 signatory registrars and registries had voluntarily bound themselves by the principles laid out in the framework.
Defining and Measuring the Problem
Is there a hard and fast difference between technical abuse and content abuse?
- The BC and GAC want more enforcement from ICANN in terms of gray areas, for instance, when technical and content abuse overlap
- The ICANN Board does not want to deliberate over content issues
How should DNS abuse be measured?
- Domain Abuse Activity Reporting (DAAR) - ICANN releases a monthly report on malicious activity
- .ORG Anti-Abuse Metrics
Remit: Whose job is it to stop the abuse?
- Registries do not host content and therefore cannot remove a piece of content from a website. The only way to remove content from the Internet is to delete it from the computer that hosts it via the hosting provider, or permanently remove that device from the Internet.
Interoperability: Can the various stakeholders work together to combat attacks?
What tools are available to mitigate or respond to attacks?
Technically, there are limits on what each type of stakeholder can do to stop abuse.
- The DNS Abuse Framework was developed by registries and registrars. The framework discourages a registry or registrar from taking action against domains, except in certain types of Website Content Abuse:
- child sexual abuse materials,
- illegal distribution of opioids online,
- human trafficking, or
- specific, credible incitements to violence
- OTCO monitors gTLD zone files,
- SSAC advises on the stability and security of the DNS, and
- Contractual Compliance is not beholden to the DNS Abuse Framework; instead, the office can reprimand registrars or registries that do not maintain abuse contacts (or a webform) to receive abuse complaints or promptly investigate allegations of DNS Abuse in good faith.
- TTL on DAAR-listed domains
- Site Operators, Registrants, and Hosting Providers can remove content.
- Registrars and registry operators can
- contract Trusted Notifiers to monitor content and report abuse
- Registry Operators
- Have to determine whether the domain in question was maliciously registered or if the domain has been compromised. Registries cannot generally directly remediate a compromised domain; instead, it is up to the sponsoring registrar. Conversely, if a domain has been maliciously registered, the registry has six options:
- Suspend the domain (most common)
- Refer to the sponsoring registrar
- Lock the domain
- Redirect a domain by changing the name servers
- Transfer the domain
- Delete the domain (generally considered an ineffective and extreme response)
- If a registry encounters unregistered domain names resulting from an automatic Domain Generation Algorithm (DGA), the operator can:
- Reserve the domains or
- create the domains in order to suspend or sinkhole the domains for victim identification
Law enforcement wants more cooperation from industry leaders
Data privacy and limits imposed by the General Data Protection Regulation
Is it getting better or worse?
Getting worse: In March 2021, the FBI’s Internet Crime Complaint Center (IC3) released its 2020 Internet Crime Report. There were 791,790 complaints of suspected internet crime, which indicated an increase of more than 300,000 from 2019, involving losses in excess of US$4.2 billion. Phishing, non-payment/non-delivery scams, and extortion were the top three types of crime reported. Getting better:
Are new or Legacy gTLDs experiencing more problems? The February 2021 DAAR report indicates the majority (64.8%) of security issues are occurring in legacy TLDs, which comprise 88.8% of resolving gTLD domains in zone files.
- ICANN definition of DNS Abuse
- Domains Jurisdiction Operational Approaches
- DAAR monthly report Feb 2021
- Com Laude History of DNS Abuse PDP
- CircleID article introducing DNS Abuse Framework
- DNS Abuse Framework website
- Cole, Mason. "The State of DNS Abuse Moving Backward," CircleID. July 23, 2020.
- RySG recommended options for registries
- FBI releases 2020 Internet Crime Report
- DAAR monthly report Feb 2021