Inviting ccTLD Operators to Join and Benefit From ICANN Domain Metrica

Authors:
Siôn Lloyd, Principal Security, Stability and Resiliency Scientist
Sam Cheadle, Machine Learning Engineer
Samaneh Tajalizadehkhoob, Director, Security, Stability and Resiliency Research
Carlos Hernandez Gañán, Principal Security, Stability & Resiliency Scientist

ICANN Domain Metrica is evolving to better serve the community with expanded features and data access. The ICANN Domain Metrica team invites country code top-level domain (ccTLD) operators to sign up and gain access to key data we hold on domains within their top-level domains (TLDs).

ICANN Domain Metrica offers both an online dashboard and an application program interface (API), providing insights into domain activity and DNS. Currently, the online dashboard includes general statistics and visuals as well as the ability to "search" on domains, generic top-level domains (gTLDs), and registrars.

The system has two types of user groups: contracted parties (gTLD registry operators and registrars) and all other ICANN community members. All ICANN community members can access the aggregate data that's available via the dashboard and API. Contracted parties have additional access to detailed, domain-level data related to their own portfolios, including domains that have been reported for DNS Abuse. This access is available via the dashboard and through ICANN's Monitoring System API (MoSAPI).

What Is New for ccTLDs?

Until now, ICANN Domain Metrica only included gTLD data, and ccTLDs were not part of the initial release. We are now addressing this gap and expanding the platform with new features to support ccTLD operators.

How to Get Started

ccTLD operators who were NOT part of the Domain Abuse Activity Reporting (DAAR) project, but wish to participate, can begin the onboarding process and request access to MoSAPI. To sign up, send an email to ICANN Global Support - full instructions and details are available on the MoSAPI webpage.

If a ccTLD operator was part of the DAAR project, it is already automatically enrolled in ICANN Domain Metrica and should have access to MoSAPI and its data.

MoSAPI access includes private access to Domain Metrica daily statistics for phishing, malware, and botnet command and control, as well as lists of reported domain names based on reputation block lists (RBLs), all within our sharing limits.

Data Differences Between gTLDs and ccTLDs

There are differences in both how data is processed and the amount of data shared with ccTLDs compared to gTLDs, mostly due to zone file access.

For gTLDs, ICANN has access to the full zone data. This allows us to:

1. Remove domains that appear in RBLs but do not appear to be delegated per day.
2. Calculate the zone size, which can be used as a normalisation factor when comparing different TLDs.

However, ccTLD zone files are not always available to ICANN. In the DAAR project, participation required providing access to ccTLD zone files. While this allowed us to deliver tailored monthly reports, including DNS Abuse report numbers for the operator's own ccTLDs, along with comparisons to other ccTLDs; it also excluded many ccTLD operators that were unable to participate simply because sharing zone data was not possible.

With Domain Metrica, we are taking a different approach.

Flexible Participation for ccTLD Operators

All ccTLD operators can now participate even without sharing their zone files. However, this means that, for those ccTLDs, the DNS Abuse counts will include domains that are no longer active or have been suspended. As an alternative to zone files, we are considering issuing DNS queries for all reported domains directly to authoritative ccTLD servers to confirm their status. This approach avoids DNS cache issues, but would increase the load placed on those authoritative servers. For this reason, we still encourage ccTLDs to provide their zones if they can.

What Is Next?

Our goal is to make ccTLD data as accessible and useful as possible. In the future, we plan to include ccTLDs in the online dashboard's search feature. To enable this, we first need a reliable method of normalizing counts to the size of the zone, with or without access to the zone file. To achieve this, our options could include asking ccTLD operators to self-report zone sizes, or using third-party estimates of zone size.

We encourage all ccTLD operators to sign up and explore the valuable insights that ICANN Domain Metrica can provide. Your participation helps improve the overall understanding and mitigation of DNS Abuse across the ecosystem.