ALAC Requests an Issues Report on Post-Expiration Domain Recovery

Introductory Note

By the ICANN Staff

The At-Large Advisory Committee resolved in its meeting of 14 th October 2008:

“That the ALAC convene a Working Group, with Alan Greenberg as the ALAC Coordinator, to finalize the draft of the request for an Issues Report on Post-Expiry Domain Recovery, with the draft to be approved by the ALAC at the ICANN meeting in Cairo. The working group may include representatives from At-Large, GNSO constituencies and other interested individuals but due to tight time constraints, will be limited to those with specific knowledge of the subject being discussed.”

This motion passed unanimously.

The issue was originally raised by NARALO, through a request for action posed by Mr. Danny Younger, on 27 th August 2008. This request may be viewed at http://atlarge-lists.icann.org/pipermail/na-discuss_atlarge-lists.icann.org/2008-August/002593.html.

The text below is the third revision, incorporating suggestions received by Mr. Greenberg, and incorporating face-to-face discussions with other stakeholders. The ALAC endorsed the request in its later form during its sessions at the ICANN Cairo meeting.

It was transmitted to the GNSO Staff and the GNSO Council by Mr. Greenberg on 20 th November 2008. The transmission may be viewed at http://gnso.icann.org/mailing-lists/archives/council/msg05734.html.

[end of introduction]

Request for Issues Report on Post-expiration Domain Recovery

The At-Large Advisory Committee requests the creation of an Issues Report on Post-expiration Domain Recovery by the original registrant¹.

Note: for the purposes of this document, the term “registrar” refers to both registrars and their resellers.

Note: for the purposes of this document, the term “expiration” refers to the date showing as the domain “expiration date” effective during the preceding year. The reason for such cumbersome wording is the provision in many Registrar-Registrant agreements such as the following example which could result in the domain name never actually expiring: "Should you choose not to renew your domain name during any applicable grace period, you agree that we may, in our sole discretion, renew and transfer the domain name to a third party on your behalf (such a transaction is hereinafter referred to as a "Direct Transfer")."

Over the years, ICANN has implemented several measures aimed at ensuring that a domain that had recently expired could be recovered by its original registrant. These measures have proven to be ineffective. Registrars have developed means of circumventing them to make both the possibility of recovery, and the price of such recovery, quite unpredictable.

A short summary of the issues related to domain expiration and recovery is included in Attachment 1.

If a registrant does not renew its domain name before the registration’s expiration date, the registrant may first become aware of the non-renewal when its website is not accessible or its e-mail does not work. Typically a web URL will now resolved to a parked page which may or may not give an indication that the domain name has expired and could be recovered, or the process for such recovery. Most likely the page will have pay-per-click links, with the subject matter somehow related to the domain name or the content of the original site. It is also possible that the web/e-mail could continue to work during this period, providing no indication at all that the domain has expired.

When a registrant tries to recover a domain following the expiration and before deletion, some combination of the following may occur:

• The domain may be recoverable, but the price may be set based on the registrar’s perceived market value of the domain, and/or the amount of time that has elapsed since expiration.
• The domain may have already been transferred, sold or auctioned and is no longer available.
• The domain name has been deleted and the Registrar does not offer redemption under the RGP, or the RGP is offered, but at an excessive price.

Consequences of “Lost” Domain Names

A 2002 ICANN Discussion Paper on Redemption Grace Periods (http://www.icann.org/en/registrars/redemption-proposal-14feb02.htm) summarized the impacts of lost domain names on registrants (described as consumers).

To consumers (individuals, businesses, non-commercial organizations, and governmental and educational entities), the consequences of an unintentional domain registration deletion can be devastating. If a domain is deleted and re-registered by a third party, the original registrant's web, e-mail and other Internet services will, in the best circumstances, simply stop working. Worse still is the potential for e-mail and web traffic intended for the original registrant to be redirected to and captured by a third party whose intentions may not be benevolent. In many cases the prior registrants of names find that "their" domains have been pointed to content they find to be distressing. (For example, in some cases deleted church-group domain names have been re-registered and directed to adult-content sites.) Some registrants of expired domains are interested primarily in profiting from a mistaken deletion by obtaining click-through revenue the domain will draw. Others have demanded ransom for return of inadvertently deleted names that they re-register; they sometimes enhance the ransom value by placing content on the site calculated to harm the former registrant.

The loss of a domain name can cause significant financial hardship to the registrant, and that harm can increase with the time required to recover the name. Less concrete harm in the form of damaged reputation and permanently lost business is also relevant. For non-commercial domain names, the impact can also be significant; examples include sites serving networks for parents of terminally ill children, political campaigns and a host of others. Moreover the time and cost to recover a domain can be substantial, particularly if those who have taken over a domain have found that it draws high traffic. If a name is ultimately not recoverable, the harm to the registrant may be very large.

In cases where a claim can be made that the entity taking over a domain name is violating the Intellectual Property rights of the original registrant, there may be recourse under the UDRP. However, many small enterprises and individuals do not pursue relief under the UDRP.

In many cases, the registrants are providing a variety of services to the community at large, and with the redirection of a domain name, the services are no longer available. The impact of the loss of these services on which the end user relies can vary from minor inconvenience or annoyance to major impact on their livelihood if such services were a necessary input into their own business.

Relevance to ICANN’s Mission

According to ICANN’s bylaws, ICANN’s mission is to “coordinate, at the overall level, the global Internet's systems of unique identifiers, and in particular to ensure the stable and secure operation of the Internet's unique identifier systems.” The ICANN Bylaws list 11 core values that should guide ICANN’s decisions and actions in furtherance of its mission.

Enabling predictable post-expiration recovery of domain names while at the same time allowing for innovation in domain registration involves the following core values.

1. Preserving and enhancing the operational stability, reliability, security, and global interoperability of the Internet.

6. Introducing and promoting competition in the registration of domain names where practicable and beneficial in the public interest.

7. Employing open and transparent policy development mechanisms that (i) promote well-informed decisions based on expert advice, and (ii) ensure that those entities most affected can assist in the policy development process.

9. Acting with a speed that is responsive to the needs of the Internet while, as part of the decision-making process, obtaining informed input from those entities most affected.

Desired Outcomes

Previous attempts to ensure predictability in post-expiration domain recovery have not been successful. Possibly, this is because they have been process-based instead of outcome-based. As a result, we now have a Redemption Grace Period in place, but even for registrars that pass the right on to registrants, it is rarely applicable. We have an Auto-renew Grace Period, but it has been circumvented by registration contractual terms.

The ALAC supports the following outcomes:

1. Domains are guaranteed to be recoverable by the original registrant for a specific period immediately following expiration (nominally 30-45 days) – the Expiration Grace Period – EGP. They may not be sold or auctioned during the EGP. Note that this is NOT a recommendation to create an Expiration Grace Period. The term and the acronym EGP are used here purely as a shorthand in the following points.
2. If the domain name resolves for web access, the resultant home page must identify the domain name as a post-expiration name and provide details on how the name can be recovered. Such a page should not include pay-per-click links, advertising, or other similar content. The name must not resolve, directly or indirectly, to its original IP address(es); specifically, the original web site must not be accessible via the domain name.
3. During the EGP, e-mail must either not resolve or bounce with an appropriate error code, but under no conditions be delivered to the original owner or another recipient.
4. Any other services normally accessible via the domain name must no longer be accessible.
5. The cost of recovering the name during the EGP must be fixed² and published.
6. The mechanism to change registrars during the recovery process must be documented and published.
7. If a domain is ultimately deleted following the EGP, the RGP must be offered to registrants, and the pricing must be fixed and published.
8. There should be an ability to change registrars during the RGP recovery.
9. The term “published” means the information must be readily locatable on the registrar’s web site.

Although not an issue within the scope of a PDP, ICANN must have in place procedures for addressing registrar or reseller failure to abide by expiration-related processes, and must facilitate procedures for addressing registrant complaints with respect to such processes (timely investigation is critical).

Attachment 1: Summary of Domain Expiration and Recovery Issues

Historically, a domain was registered for a specific period of time. Near the end of the period, the registrar was (and still is) required to notify the registrant of this expiration. If the domain was not renewed, the registrar would eventually notify the registry to delete the domain. The timing of “eventually” could be as little as zero days and was not limited. On deletion, the domain name would re-enter the pool of available domains and could be re-registered by the original owner or by someone else.

In 2002, the ICANN Board approved the Redemption Grace Period (RGP). Under the RGP, a deleted domain would not re-enter the available pool but would be placed in a hold status for 30 days with the intention of allowing the original registrant, through the registrar, to have the domain restored and renewed. There were registry fees associated with the process, which could be marked up by the registrar. The RGP has been voluntarily implemented by all unsponsored gTLDs [with the possible exception of .name].

Concurrent with the Board discussion of the RGP a DNSO/GNSO PDP was started looking at domain deletion issues (http://www.dnso.org/dnso/notes/20030617.DeletesTF-report.html) including whether more specific rules should apply to when a registrar must delete an expired domain name. As a result, in 2004, ICANN announced such a policy. The announcement (http://www.icann.org/en/announcements/announcement-21sep04-2.htm) read:

Today ICANN announced the implementation of the Expired Domain Deletion Policy (EDDP). This consensus policy defines a uniform deletes practice that registrars must follow at the time of domain name expiration, as well as specific requirements for registrar handling of expired names that are subject to a UDRP dispute.

The EDDP was developed through ICANN's Generic Names Supporting Organization in response to concerns in the community about registrar practices in regards to deletion of expired names. In the past, some registrars have held on to domain registrations that the original registrant did not act to renew. With the new policy in place, all ICANN-accredited registrars will be required to delete domain names by the conclusion of the 45 day auto-renewal period that follows the expiration of a domain name, unless the registrant has consented to have the domain names renewed.

Names deleted by registrars at the conclusion of any registrar grace period following expiration will continue to be subject to the Redemption Grace Period (RGP). The RGP is a thirty (30) day registry "hold" period for all domain names deleted by registrars. This hold period is designed to allow registrars the ability to "restore" names that were deleted accidentally or without the intent of the registrant.

In short, a registrar was required to delete the name within 45 days, after which the RGP would kick in.

Unfortunately, before the policy was implemented, some registrars began changing their user agreements to allow them to take over or transfer expired domains to other parties, thereby allowing the name to be monetized, and/or sold or auctioned. In some cases, the original registrant receives a percentage (ranging up to 80%) of the sale price. By immediately monetizing these names, their value can be gauged.

If an original registrant attempts to recover their name, the registrar may make it available at some price if it has not yet been irrevocably sold.

Registrants may unintentionally allow their domain names to expire for many reasons. These include:

• Notices of expiration were sent and received, but the registrant did not take timely action.
• Notices were sent but not consciously received by the registrant, typically because they were treated as spam, or the e-mail address still existed but was not being checked.
• Auto-renewal had been requested by the registrant, but at renewal time, there were insufficient funds available or the credit card on file was not accepted.
• Notices were attempted to be sent, but could not be delivered, either due to mail system malfunction or out-of-date registration contact information.
• The registrar did not send the required notices due to system malfunction or deliberate inaction.
• The registrant is using a privacy service and that service does not forward the expiration notices.
• Auto-renewal had been requested but was not carried out by the registrar (or privacy service).
• The domain has been hi-jacked and contact information changed, allowing the transfer of the domain to another registrar.
• The domain may never have been registered in the “registrant’s” name. This is particularly prevalent in the cases where a domain name is bundled into a hosting agreement by a reseller.

 Some of these reasons may implicate registrar violations of ICANN and/or customer agreements, but enforcement is often difficult or impossible.

¹ In the context of this document, the “registrant” is the entity that has the benefit of the original registration and not a proxy service or other intermediary that may be the reflected in whois data.

² By “fixed” we mean that the cost does not vary over time or based on the perceived resale/auction value of the name.