Registry Services Technical Evaluation Panel (RSTEP) Report on Public Interest Registry's Request to Implement Technical Bundling in .NGO and .ONG

On 12 March 2014, Public Interest Registry (PIR), the registry operator for .NGO and .ONG TLDs, submitted a request to provide a new registry service to offer support for mandatory technical bundling of second level domains for .NGO and .ONG. The proposal provides an explanation of the proposed technical bundling, the implementation of the EPP commands, the handling of DNSSEC, handling of second-level IDN variants, and WHOIS service. The proposal, which was submitted through the Registry Services Evaluation Policy (RSEP) process, was referred to the Registry Services Technical Evaluation Panel (RSTEP) and the RSEP proposal and RSTEP report were respectfully opened for public comment as required by the RSEP.

Pursuant to Section 2.7 of the Registry Services Evaluation Policy (RSEP), the Board had 30 calendar days following receipt of the Registry Services Technical Evaluation Panel's report on 24 July 2014 to reach a decision. The Board could decide to 1) approve the request, 2) decline the request, or 3) defer the request for more information.

What is the proposal being considered?

The Board's action today is to take action on the report of the RSTEP, which evaluated the security and stability issues that may be associated with PIR's RSEP request to implement a new registry service to allow for mandatory "technical bundling" of second level domain names. PIR's request states, "[a] Technical Bundle is a set of two domain names in different TLDs, with identical second level labels for which the following parameters are shared:

Registrar Ownership
Registration and Expiry Dates
Registrant, Admin, Billing, and Technical Contacts
Name Server Association
Domain Status
Applicable grace periods (Add Grace Period, Renewal Grace Period, Auto-Renewal Grace Period, Transfer Grace Period, and Redemption Grace Period)
And for which at least the following parameters are unique: 'DS records as required based on RFC 5910.'"

Which stakeholders or others were consulted?

ICANN staff initiated a public comment forum from 10 June 2014 to 8 July 2014, inviting the community to provide feedback on PIR's RSEP proposal. During the public comment period, no comments were received. The final report of public comments can be found at: https://www.icann.org/public-comments/tech-bundling-2014-06-10-en.

Additionally, the RSTEP review team was consulted to conduct a technical evaluation of the proposed registry service with respect to the likelihood and materiality of effects on security and stability, including whether the proposed registry service would create a reasonable risk of a meaningful adverse effect on security or stability. On 24 July 2014, the RSTEP report [PDF, 1.02 MB] was delivered to the ICANN community. ICANN initiated a public comment forum from 29 July 2014 to 5 August 2014, inviting the community to provide feedback on the RSTEP report. During the public comment period, no comments were received. The final report of public comments can be found at: https://www.icann.org/public-comments/rstep-technical-bundling-2014-07-2....

What concerns or issues were raised by the community?

No comments were provided for the RSEP proposal public comment period and the RSTEP report public comment period. However, the following technical and implementation issues were identified in the report of the RSTEP and by ICANN, which will need to be addressed by PIR [and/or the community] as part of the development of an amendment to the .NGO and .ONG Registry Agreements to implement the new registry service:

Analysis on the implications of "unbundling", that is if at some point in the future, the decision is made by PIR (or a successor registry) to remove the explicit association between .NGO and .ONG.

Implicit in the PIR proposal is an assertion that the contents of the .NGO and .ONG domains are "the same" (hence they are bundled together), however there is no mechanism by which this similarity can be enforced at all levels within the DNS, nor will applications such as web servers, mail servers, etc., understand that .NGO and .ONG domains should be treated identically without explicit configuration. This may lead to confusion both by client end users (e.g., "why does EXAMPLE.SOMETHING.ONG resolve when EXAMPLE.SOMETHING.NGO doesn't?") and by registrants ("why do I have to configure my web server to understand every third-level domain for both my second-level domain in .NGO and .ONG?"). Additional information is needed to address this potential for confusion within the PIR proposal;

The label similarity issue, specifically two labels are interpreted to be "the same" even though the strings that make up those labels are different, implicit in the PIR proposal, of which bundling is a potential solution, can and likely will be viewed as functionally equivalent to a component of the "IDN variant" issue. The community has been working on solutions to the variant issue for a number of years and full resolution has not yet been reached. It is possible the community working on the variant issue will view an acceptance of the technical bundling of .NGO and .ONG as an inappropriate "end run" around the policies and processes being established for the handling of variants; and

Technical bundling is being considered as a potential solution to address IDN variants, however the community has not developed a framework for its use nor approved this approach for implementation. Acceptance of the PIR proposal, and going forward without further community input on technical bundling, may raise concerns with IDN variant applicants and other interested community members who would want discussion on this topic for the implementation of IDN variant TLDs.

What significant materials did the Board review? What factors did the Board find to be significant?

The Board reviewed several materials in taking its action today. The Board also considered several significant factors during its deliberations about whether or not to approve the request. The significant materials and factors that the Board considered as part of its deliberations, included, but are not limited to the following:

PIR's Registry Service Evaluation Policy (RSEP) Request [PDF, 24 KB] (12 March 2014)

Letter to Public Interest Registry [PDF, 320 KB] (4 June 2014)

Letter from Public Interest Registry [PDF, 88 KB] (5 June 2014)

Letter to RSTEP [PDF, 952 KB] (6 June 2014)

Public Comment on RSEP Proposal (10 June 2014)

RSTEP Report on Internet Security and Stability Implications of the PIR Technical Bundling Proposal [PDF, 1.02 KB] (24 July 2014)

Public Comment on RSTEP Report (29 July 2014)

Are there positive or negative community impacts? Are there fiscal impacts or ramifications on ICANN (strategic plan, operating plan, budget); the community, and/or public? Are there any security, stability or resiliency issues relating to the DNS?

PIR identified that the benefits of introducing the mandatory technical bundling would be two-fold: (1) it eliminates the likelihood of public confusion that reasonably may ensue if different gTLD entities were able to register the same second-level domain and (2) it provides the registrant with a defensive registration to ensure that the gTLD is able to focus on its mission and outreach in a transparent and effective manner. However, additional information is needed to understand additional potential impacts on the community associated with the broader implications of this service when introduced to the DNS.

The eventual implementation of this registry service may have a fiscal impact on ICANN, the community or the public, as there may be additional costs associated with the broader implications of this registry service.

The RSTEP report identified the technical evaluation of this proposed registry service with respect to the likelihood and materiality of effects on security and stability concludes that it does not create a reasonable risk of a meaningful adverse effect on security and stability.

Various communities, in particular those interested in IDN variants, have been working on solutions to label similarity issues, of which the technical bundling of .NGO and .ONG is an example, for a number of years and full resolution has not yet been reached. It is possible those communities would be able to provide insights in resolving the similarity questions and consultations with those communities may be appropriate. The Board's action is in no way intended to create a precedent or a requirement for the treatment of IDN variant issues, and each circumstance must be evaluated on its own merits.

Is this either a defined policy process within ICANN's Supporting Organization or ICANN's Organizational Administrative Function decision requiring public comment or not requiring public comment?

The Registry Services Evaluation Policy is an ICANN consensus policy, effective as of 15 August 2006. Consistent with the policy on 29 July 2014, the RSTEP report was posted for public comment. The public comment period concluded on 13 August 2014 and no public comments were submitted. Additionally, on 10 June 2014, ICANN posted PIR's RSEP request for public comment. The public comment concluded on 30 July 2014 and no public comments were submitted.