View source for Whois Anti-Harvesting Techniques

==Common Anti-Harvesting Techniques==
*'''Rate Limiting''': this practice prevents bulk searching and data mining of the WHOIS database by limiting how many queries can be submitted within a certain period of time.<ref name="twelve">http://www.icann.org/en/resources/compliance/update/update-whois-access-audit-report-port43-30apr12-en.pdf (PDF) Internet Corporation for Assigned Names and Numbers (ICANN)</ref> After reaching the registrar mandated limit, search results are either not returned due to temporary blacklisting or in some cases, only select information is returned.<ref name="cmu">http://www.icann.org/en/news/public-comment/whois-misuse-27nov13-en.htm (PDF) titled Whois Misuse Study Draft Report (November 26, 2013), Internet Corporation for Assigned Names and Numbers (ICANN)</ref> For example, contact information may no longer be returned although other information is still retrieved. According to Carnegie Mellon University's recent Whois Misuse Study, rate limiting is one of the most common anti-harvesting techniques used by registrars.<ref name="cmu"/> Donuts Inc.,<ref name="nut">http://www.donuts.co/policies/whois/ Donuts, Inc.</ref> NetworkSolutions,<ref>http://watchmy.domains/kb/whoislimits.php Watchmy.Domains</ref> and Nominet<ref>http://www.nominet.org.uk/uk-domain-names/about-domain-names/domain-lookup-whois/detailed-instructions Nominet</ref> use rate limiting policies to guard against Whois abuse.
**Note: if look-up limits are set "aggressively" low, they can create problems for well-intentioned users and ICANN's automatic Whois Monitoring Systems (WMS), resulting in notices from ICANN.<ref name="twelve"/> 
**Read an example of [http://www.nominet.org.uk/uk-domain-names/about-domain-names/domain-lookup-whois/detailed-instructions Nominet's Whois Rate Limiting Policy]
*'''Privacy or Proxy Services''': these services keep the registrant's personal contact data out of the WHOIS database by using the registar's or a third party's contact information instead; some services also screen spam before forwarding any messages received to the registrant.<ref name="SSAC">http://www.icann.org/en/groups/ssac/documents/sac-023-en.pdf (PDF) ICANN Security and Stability Committee (SSAC)</ref><ref name="cmu"/> A Security and Stability Advisory Committee (SSAC) report revealed that using a privacy or proxy service decreased the number of spam messages a registrant received and found that it was more effective at reducing spam than using protective methods such as CAPTCHAs or rate limiting.<ref name="SSAC"/> Many popular registrars offer privacy or proxy services. Some provide the service at an additional charge such as Namecheap <ref>https://www.namecheap.com/products/whoisguard.aspx Namecheap.com </ref> or refer the registrant to a partner service such as Godaddy.<ref>https://www.domainsbyproxy.com/default.aspx?ci=44263&prog_id=GoDaddy Domains by Proxy</ref><ref name="SSAC"/> Additionally, some registrars provide privacy services free of charge, such as Public Domain Registry.<ref>http://www.publicdomainregistry.com/privacy-protection/ Public Domain Registry</ref>
**View a side by side comparison of contact information [https://www.domainsbyproxy.com/PublicVsPrivate.aspx with or without privacy protection].<ref name="SSAC"/>
**See an example of a [https://www.myprivacy.ca/ free and simple privacy service] used to reduce spam.
*'''CAPTCHA''' or Completely Automated Public Turing Test To Tell Computers and Humans Apart: some registrars make users complete a CAPTCHA challenge before a Whois query can be entered in order to stop "automated collection of domain name records."<ref name="SSAC"/> Donuts Inc.<ref name="nut"/> and Namecheap<ref>https://www.namecheap.com/domains/whois.aspx Namecheap.com</ref> incorporate CAPTCHAs in their Whois searches.
**Examples and more information about CAPTCHAs can be [http://www.captcha.net/ found here]. 
*'''Blacklisting''': this practice permanently or temporarily stops users from searching a registrar's Whois database when using a certain IP address or domain name; permanent blacklisting is usually employed if the user is suspected of frequent Whois misuse.<ref name="cmu"/>
*'''Zone File Publication''': according to an SSAC report, not publishing TLD zone files may decrease the risk of Whois abuse.<ref name="SSAC"/> However, ICANN contracts mandate that gTLDs publish their zone files, so this strategy can only be used by certain ccTLDs.<ref name="SSAC"/>