DNS abuse obligations: what changed on 5 April 2024
On 5 April 2024, amendments to ICANN's Registrar Accreditation Agreement (RAA) and Registry Agreement (RA) took effect, creating the first binding obligations on contracted parties to act against DNS abuse. Before that date, registrars and registries operated under broad discretion. After it, they carry a legal duty – however carefully worded – to respond to well-evidenced reports of specific categories of technical harm.
The amendments define DNS abuse as five categories: malware, botnets, phishing, pharming, and spam – where spam functions as a delivery vector for the other four, not as a standalone category. Contracted parties must take "prompt, reasonable and appropriate action" to stop or disrupt that abuse. This is a mitigation duty, not a rights-adjudication mechanism. It does not resolve cybersquatting. It does not replace the UDRP. Brand owners and registrants who conflate the two risk losing time and leverage on the remedy that actually applies to their situation.
This page sets out what the amendments require, who bears the new obligations, how the categories are drawn, and – critically – where the boundary lies with trademark disputes and domain recovery.
What the RAA and RA amendments actually require
The core obligation under the amended contracts is straightforward to state and harder to enforce in practice. Registrars and registries must take prompt, reasonable, and appropriate action when presented with well-evidenced reports of DNS abuse within the defined categories. The duty sits on the contracted party, not on the complainant – a reporter submits evidence, the registrar or registry decides the response.
What counts as "prompt, reasonable and appropriate" is left to the contracted party's judgment. There is no mandated response time, no prescribed remedy, and no automatic suspension. That discretion is deliberate: the drafters recognized that technical abuse manifests differently across zones and registrar portfolios, and that a rigid timeline would be gamed. The practical result is that outcomes vary – some registrars act within hours on a well-documented phishing report; others acknowledge receipt and take days or weeks.
The obligation also extends to disrupting abuse, not merely stopping the specific instance reported. Registrars must maintain the operational capacity to respond. They cannot disclaim responsibility by arguing the domain is managed by a reseller. The chain of accountability runs to the RAA signatory.
The five categories: what is covered, and what is deliberately excluded
The amendments adopt a narrow, technical definition of DNS abuse. Only these five categories fall within scope:
- Malware: software inserted or activated without the user's informed consent and designed to damage, compromise, or gain unauthorized access to a system.
- Botnets: networks of compromised machines under centralized command, used to distribute malware, launch attacks, or relay spam.
- Phishing: fraudulent attempts to obtain credentials or financial information by impersonating a legitimate entity, typically through a deceptive site or message.
- Pharming: redirection of legitimate domain traffic to a fraudulent destination through DNS manipulation or host-file compromise.
- Spam: included only as a delivery vector – that is, spam used to propagate malware, enable phishing, or facilitate the other categories. Unsolicited commercial email that does not involve the other four is explicitly out of scope.
Everything else is deliberately excluded. Content moderation, trademark disputes, cybersquatting, consumer confusion, counterfeit goods, defamation – none of it falls within the DNS-abuse obligations. ICANN's contracted parties are not required to adjudicate intellectual property rights. That boundary matters enormously to anyone hoping a phishing or abuse report will serve double duty as a trademark remedy.
Why a DNS-abuse report is not a substitute for a UDRP complaint
This is the question we encounter most frequently in practice. A brand owner discovers a domain that mimics their trademark, redirects customers, and carries phishing content. The temptation is to report it as DNS abuse and expect the registrar to suspend it. That approach may generate a short-term technical fix – the registrar locks the domain – but it leaves the registration intact.
A registrar lock imposed in response to a DNS-abuse report is not a transfer. The domain remains registered to the same holder. Once the reported content is removed or the lock lifted, the name returns to the registrant's active control. The brand owner is back to square one, usually months later, with no legal determination in their favor.
The UDRP, by contrast, addresses the registration itself. A panel ruling orders transfer or cancellation – a permanent remedy. The filing fee for a single-domain case at WIPO is USD 1,500 for a single-member panel, and a standard case concludes in roughly two months. That is the appropriate route where the issue is a confusingly similar domain registered in bad faith. A DNS-abuse report to the registrar may run in parallel to document conduct, but it cannot substitute for a UDRP complaint in terms of the remedy.
The distinction is structural. The RAA and RA obligations are about technical harm to the DNS and internet infrastructure. The UDRP is about trademark rights in domain names. They address different wrongs with different tools.
If your domain dispute involves both technical abuse and trademark rights, the choice of route requires careful sequencing. For an assessment of your domain dispute, contact info@cognomenlaw.com.
How the amendments affect domain theft and hijacking claims
Domain theft – where a registrant loses control of a domain through unauthorized transfer, account compromise, or social-engineering of the registrar – occupies a different legal space from DNS abuse, but the April 2024 amendments touch it indirectly.
Before the amendments, the contractual obligations on registrars to maintain security were general. The new language reinforces that registrars must maintain the operational capability to stop or disrupt defined categories of abuse. Where a hijacked domain is subsequently used in a phishing campaign or malware distribution, the abuse obligations now give an independent contractual lever to press the registrar into action.
More importantly, the amendments signal a direction of travel: ICANN is willing to sharpen contracted-party obligations. Domain theft victims dealing with registrar inaction can now point to a clearer duty of response as part of the pressure they apply. That does not replace the legal mechanisms – registrar escalation, UDRP if the name was also registered against the original holder's trademark, or court action for recovery – but it adds a compliance dimension to the conversation.
In a recent matter (a .com hijacking, spring 2025), we worked through registrar escalation backed by a documented account-compromise record, and secured transfer reversal before any formal dispute procedure became necessary. The registrar's response time was materially faster than comparable cases from prior years. Whether the amended RAA language influenced that outcome is not something we can state with certainty, but the trend toward registrar responsiveness is real.
Who bears the obligations and who can enforce them
The obligations in the amended RAA and RA run between ICANN and its contracted parties. Registrars and registries are the duty-holders. Individual domain registrants and brand owners are not parties to those contracts and have no direct contractual claim against a registrar under the RAA for failing to act on an abuse report.
Enforcement, formally, is ICANN's role. ICANN can initiate compliance proceedings against a registrar that systematically fails to meet its amended obligations. In practice, ICANN's compliance process is slow and its remedies are contractual rather than adjudicative.
The practical implication for brand owners: use the DNS-abuse framework to document registrar non-response and to create a contemporaneous record of the technical harm. That record supports a UDRP bad-faith argument – evidence that the domain was used for phishing bolsters the "used in bad faith" limb of Paragraph 4(a)(iii) of the Policy. It also supports an application for a court injunction or emergency relief where the domain is being actively weaponized against your customers.
What the framework does not do is give brand owners an independent right of action against the registrar. That structural limitation is unlikely to change in the short term. As of September 2026, no revision to the RAA that would create such a right is publicly under consideration. Verify the current position with counsel if this affects your strategy.
What should registrars and registries be doing now?
Contracted parties have had more than two years since the April 2024 amendments to build the compliance infrastructure the new obligations require. At minimum, a compliant registrar should maintain a credible DNS-abuse reporting channel, acknowledge reports promptly, investigate documented cases, and take action where the evidence meets the threshold. The policy does not dictate the specific remedy – suspension, registrar lock, or deletion – but inaction on a well-evidenced phishing report is no longer defensible under the contract.
Registries operating new gTLDs carry parallel obligations. With the next round of new gTLD strings expected to enter general availability from 2028 onward (the application window having closed in August 2026), newly delegated registries will operate under these amended obligations from day one. That is a materially different baseline from the conditions under which earlier gTLD strings were delegated.
For brand owners monitoring a large portfolio, the amendments also sharpen the reporting toolkit. A structured abuse report – with screenshots, DNS resolution data, timestamps, and evidence of the harm category – is now more likely to generate a registrar response than an informal complaint. Volume matters too: a coordinated series of reports from multiple affected parties on the same registrar tends to produce faster action than isolated filings.
To weigh UDRP against a court action for your case, email info@cognomenlaw.com.
What this means in practice: a decision framework
The right tool depends on the harm you are trying to stop and the remedy you need.
If the domain is hosting malware, running a botnet, or operating a phishing page targeting your customers: report to the registrar under the DNS-abuse framework, document the report and any response, and simultaneously assess whether the underlying registration violates your trademark rights. If it does, a UDRP complaint runs in parallel – the DNS-abuse report becomes evidence of bad-faith use.
If the domain is a cybersquatting registration that sits parked and does nothing technical wrong: a DNS-abuse report will not help. File a UDRP complaint. Parking a domain with pay-per-click links confusingly similar to a trademark is a recognized bad-faith pattern under Paragraph 4(b) of the Policy, even without any technical abuse.
If the domain was transferred away from you without consent: pursue registrar escalation immediately, document the account compromise, and assess whether the UDRP (if your trademark rights were infringed in the process) or a court action is the appropriate second step. A DENIC DISPUTE entry can block onward transfer for .de; for .com and most gTLDs, the registrar's own security protocols govern the lock.
If you need money damages as well as a transfer: only a court action can reach them. US anticybersquatting litigation is the route for .com and other domains with US-nexus facts. The UDRP's only remedies are transfer and cancellation – no costs award, no damages, no injunction.
COGNOMEN
COGNOMEN is an independent boutique focused exclusively on domain-name disputes. We recover, defend, and transact internet domains across generic and country-code zones, before WIPO, the Forum, CAC, ADNDRC, and national procedures, and in court where arbitration cannot reach. We act for brand owners, domain investors, and registrants – including respondent-side defense and reverse domain name hijacking. COGNOMEN handles Court Action & Domain Theft matters exclusively, across gTLDs and ccTLDs. To discuss a domain, contact info@cognomenlaw.com.
Related at COGNOMEN
Frequently asked questions
What changed and when?
On 5 April 2024, amendments to ICANN's Registrar Accreditation Agreement and Registry Agreement took effect. For the first time, they imposed binding obligations on registrars and registries to take "prompt, reasonable and appropriate action" against five defined categories of DNS abuse: malware, botnets, phishing, pharming, and spam used as a delivery vector for those four. Content disputes, trademark conflicts, and cybersquatting remain outside scope. The obligation runs between ICANN and its contracted parties; individual complainants have no direct contractual right of action under the RAA.
Who does this affect?
Primarily ICANN-accredited registrars and registry operators, who now bear the compliance duty. Brand owners, registrants, and security researchers are affected indirectly: they gain a clearer basis for abuse reports, and registrars face a contractual duty to respond to well-evidenced filings. Anyone whose domain is being used in a phishing or malware campaign – and whose registrar was previously unresponsive – has a stronger contractual argument for action. Brand owners should still use UDRP for cybersquatting; the DNS-abuse framework is not a trademark remedy.
What should I do now?
If you are facing technical DNS abuse – phishing, malware, or pharming from a domain – file a structured abuse report with the registrar, include screenshots, DNS evidence, and a clear statement of the category. Preserve that record. If the domain also infringes your trademark, assess a UDRP complaint in parallel; the abuse record strengthens the bad-faith evidence. If the domain was stolen, escalate to the registrar immediately and contact domain recovery counsel. For cybersquatting without technical abuse, the UDRP remains the primary route. Contact info@cognomenlaw.com to assess the right combination of steps.
Author: Adrian Harland — Court anticybersquatting and domain theft recovery. Meet the team.
Speak with Cognomen Law
For a scoped view of your domain matter, contact info@cognomenlaw.com. Discuss your matter
This publication is general information and does not constitute legal advice. For advice on your situation, contact info@cognomenlaw.com.