PDP – Fast Flux Working Group

Last Updated: 24 October 2017

Summary:

The ICANN Security and Stability Advisory Committee (SSAC) completed a study of the way in which the DNS can be manipulated by Internet cyber-criminals to evade detection and termination of their illegal activities. The results of the study were published in January 2008 in the SSAC Advisory on Fast Flux Hosting and DNS (SAC 025) which described the techniques that are collectively referred to as "fast flux hosting," explained how these techniques enable cybercriminals to extend the maliciously useful lifetime of compromised hosts employed in illegal activities, and "encouraged ICANN, registries, and registrars...to establish best practices to mitigate fast flux hosting, and to consider whether such practices should be addressed in future [accreditation] agreements.

The term "fast flux" refers to rapid and repeated changes to A and/or NS resource records in a DNS zone, which have the effect of rapidly changing the location (IP address) to which the domain name of an Internet host (A) or name server (NS) resolves.

**Note:  The status image below is for illustration purposes only. This particular effort followed an older PDP model rather than what is currently outlined in the ICANN Bylaws (circa 2014).

Status:

Implementation Status

Web Presence:

Responsible Staff Member:

  • GNSO Policy Team

GNSO Council Resolution for Issue Report on Fast Flux:

Adopted on: 06 March 2008

The following is an extract from the GNSO Council resolution page:

ICANN Staff shall prepare an Issues Report with respect to "fast flux" DNS changes, for deliberation by the GNSO Council. Specifically the Staff shall consider the SAC Advisory, and shall outline potential next steps for GNSO policy development designed to mitigate the current ability for criminals to exploit the DNS via "fast flux" IP or nameserver changes. [See full resolution]

Issue Report

Submitted on: 31 March 2008

GNSO Council Resolution on the Initiation of the PDP:

Adopted on: 08 May 2008

The following is an extract from the GNSO Council resolution page:

The GNSO Council RESOLVES: To initiate a Policy Development Process uniquely on the issues deemed in scope in the Issues report. [See full resolution]

GNSO Council Resolution to Approve the WG Charter:

Adopted on: 29 May 2008

The following is an extract from the GNSO Council resolution page:

The GNSO Council RESOLVES: To form a Working Group of interested stakeholders and Constituency representatives, to collaborate broadly with knowledgeable individuals and organizations, in order to develop potential policy options to curtail the criminal use of fast flux hosting. The WG is also open to invited experts and to members of the ICANN advisory committees whether acting in their own right or as representatives of their AC. [See full resolution]

GNSO Council Resolution to Approve the WG Chair:

Adopted on: 25 June 2008

The following is an extract from the GNSO Council resolution page:

Resolved: Mike O'Connor is elected as chair of the PDP WG on Fast Flux and Mike Rodenbaugh is appointed GNSO Council Liaison to the PDP WG on Fast Flux. [See full resolution]

Working Group Initial Report:

Submitted on: 26 January 2009

Working Group Final Report:

Submitted on: 06 August 2009

GNSO Consideration of the WG Final Report:

Adopted on: 03 September 2009

The following is an extract from the GNSO Council resolution page:

Whereas the Working Group did not make recommendations for new consensus policy, or changes to existing policy;

Resolved:  To form a Drafting Team to work with support staff on developing a plan with set of priorities and schedule that can be reviewed and considered by the new Council as part of its work in developing the Council Policy Plan and Priorities for 2010. [See full resolution]

GNSO Resolution on the Fast Flux Recommendations:

Adopted on: 13 January 2011

The following is an extract from the GNSO Council resolution page:

The Council accepts the approach identified below for the adopted recommendations (see http://gnso.icann.org/meetings/minutes-03sep09.htm) and instructs the ICANN Staff to implement these recommendations as set forth below:…. 

The Council now considers the work of the Fast Flux WG complete. As such, the "Fast Flux Council Follow-up" action item is deemed closed and will be deleted from the Pending Project List. [See full resolution]

Implementation Details: