RE: [ga] Domain Renewal Accounting Loophole Exposed in Verisign Registry

["Gomes, Chuck" <cgomes@xxxxxxxxxxxx>]

Please note my comments inserted in the text below.

Chuck Gomes
 
"This message is intended for the use of the individual or entity to
which it is addressed, and may contain information that is privileged,
confidential and exempt from disclosure under applicable law. Any
unauthorized use, distribution, or disclosure is strictly prohibited. If
you have received this message in error, please notify sender
immediately and destroy/delete the original transmission." 
 

> -----Original Message-----
> From: owner-ga@xxxxxxxxxxxxxx 
> [mailto:owner-ga@xxxxxxxxxxxxxx] On Behalf Of Danny Younger
> Sent: Monday, October 01, 2007 10:52 AM
> To: ga@xxxxxxxxxxxxxx
> Cc: RAA-WG@xxxxxxxxxxxxxxxxxxxxxxx
> Subject: [ga] Domain Renewal Accounting Loophole Exposed in 
> Verisign Registry 
> 
> 
> Posted in DomainTools blog:
> 
> Domain owners that pay the renewal fee on their domain after 
> expiration date and then transfer away from their current 
> registrar are getting fleeced out of a year of registration. 
> Under the right conditions and if everything aligns correctly 
> we find that hundreds of transaction each day are being 
> deprived of a paid domain year. I confirmed my finds when I 
> found Pat Kane the Director of Business Operations of 
> Verisign during the ICANN meeting in Lisbon.

I have no idea how Jay thinks Pat could have confirmed that "hundreds of
transaction each day are being 
deprived of a paid domain year"  We would have no visibility into
whether or not registrars refund registration fees in cases where we
refund the registry fees to registrars.

> No registrar 
> that I am aware of proactively provides a refund if the 
> domain owner transfers away within 45 days of the anniversary 
> of the domain creation and renewed after the expiration. I 
> asked a few registrars and Elliot Noss the CEO of Tucows went 
> on the record and said he would provide a refund when this 
> edge case happened at Tucows. Mr. Noss doesn't believe that 
> many domain owners experience this at his registrar because 
> their transfer policy allows domain owners to transfer out 
> after expiration. At a registrar like Godaddy the edge case 
> may happen a lot, if a registrar blocks the transfer during 
> the grace period until the domain is paid for the case will 
> happen more often.
> 
> However a lot of registrars do not allow owners to transfer 
> out after expiration, instead they insist that the owner 
> renew the domain name because it is past expiration, after 
> the renewal they will not block the transfer. But their is a 
> huge problem with this, Verisign refunds the money to the 
> original registrar for the renewal if another registrar 
> transfers the domain away in this window. Verisign implicitly 
> automatically renews every domain that expires, this is why 
> the domain stays alive past expiration, it is up to the 
> current registrar if they want to delete the domain. The only 
> way Verisign knows if a domain owners pays is if the 
> registrar doesn't delete the domain during the grace period.

Deletion of a name would certainly be an indication that the registrant
hadn't paid, but it would not be definitive.  We have no information
about the registrant.  So several other scenarios are possible: 1) the
registrar could have renewed the registration for their uses; 2) the
registrant could have changed; 3) the registrar could have allowed the
auto-renewal to occur without fees being paid by the registrant.
 
> So if a transfer goes out, Verisign refunds one year to the 
> old registrar, even it you paid for it, it is refunded to the 
> old registrar.
> 
> The Verisign accounting system that handles over 75 Million 
> transactions a year has a flaw in it that some registrars may 
> not understand how it works and generally don't issue a 
> refund when they are issued a refund by Verisign.

I fail to see any flaw in the VeriSign system. We simply refund the
registration fee per the policies in our registry agreements and RRAs.
If you read this post in its entirety, you will see that the issue at
stake appears to be a registrar issue, whether the registrar will refund
registrant fees in cases where they have received a refund of registry
fees.  That said though, it may be that this issue may be a good one to
be included in the Issues report that is going to be prepared for the
Registrar Transfer Policy Review PDP as directed by the GNSO Council.

> The special 
> circumstances are as
> follows: The domain is past expiration, the owner renews the 
> domain at the current registrar, the owner then transfers 
> away with in 45 days of the anniversary of the creation date.
> 
> Do not renew your domain at your old registrar during the 
> grace period and then transfer out. Instead, directly 
> transfer out or pay your renewal fee, wait until day 46 after 
> the old expiration and then transfer out. You will loose one 
> year of registration if you pay first then leave.
> 
> Verisign could fix the hole by requiring a registrar to send 
> an explicit renewal command, but the command doesn't exist right now.

There is an explicit renewal command but, as I understand it, it
wouldn't solve the problem if an auto-renewal had already occurred.  In
that scenario it would add another year.
> 
> According to the Official ICANN FAQ at
> http://www.icann.org/compliance/faq.html, it says:
> 
> My domain name has just expired. Can my registrar require me 
> to pay for a renewal before I can transfer to a new registrar?
> 
> No. Your new registrar of choice can initiate a transfer 
> request on an expired domain name once they receive the 
> required authorization from you.
> Expiration or nonrenewal of a domain name is not a valid 
> reason for denial of a transfer request.
> 
> Note that if the registrar has already begun the deletion 
> process on the domain name and its status shows it to be 
> within a 30-day Redemption Grace Period, the name must be 
> .restored. by your current registrar before it can be transferred.
> 
> This loophole most likely exists at other registries as well 
> because most registries are modeled around Verisign's 
> registry. However Verisign has the biggest marketshare of the 
> other registries and so it could be costing consumers millions a year.
> 
> 
> 
>       
> ______________________________________________________________
> ______________________
> Luggage? GPS? Comic books? 
> Check out fitting gifts for grads at Yahoo! Search 
> http://search.yahoo.com/search?fr=oni_on_mail&p=graduation+gifts&cs=bz
>