Getting the Drop on Domain-Name Abuse

A loophole in the process that assigns Web addresses not only aids those who play fast and loose with the rules, it's also hurting small businesses

We Americans have a big problem -- actually, it's everybody's problem -- and it hurts all Internet users. More than 3.5 million good .com domain names on any given day are made unavailable to small businesses and others who would actually register and use them in ways for which the names were intended.

The root of the problem is a loophole in the way domain names are registered that gives name registrars a five-day window during which names can be dropped, risk-free.

It began as a grace period for correcting mistakes and reversing fraudulent registrations. But it has turned into a mechanism that lets groups park on a Web site, collect money generated by clicks on those pages, delete the name and then reregister, time and again. All the while, they're paying nothing for a name that could otherwise be used by someone else.


  Before I explain how it works in detail -- and propose a remedy -- here's a brief breakdown of the players. First, there's the registry. This is the organization responsible for operating and maintaining the database and parent name servers for a given Top Level Domain (TLD). For example, VeriSign (VRSN) is the registry that manages .net and .com.

Then there are the registrars. These organizations are accredited by the Internet Corporation for Assigned Names & Numbers (ICANN), the nonprofit organization responsible for the technical coordination of the Internet. The registrars help end-users, or registrants, see if a domain name is available and then help them get registered. Currently there are more than 600 ICANN-accredited registrars. Among them is my company,

Here's where it gets interesting. All ICANN-accredited registries are required, per their agreement with ICANN, to implement what's called an Add Grace Period (AGP), a five-day window during which a newly registered domain name can be deleted or dropped. In that case, the registration fee is refunded.

The AGP was set up to create a window of opportunity for correcting or retracting errors in domain name registrations -- for example, if someone misspells the domain name they were trying to register, or if a registrar discovers that a fraud was perpetrated during the registration process (e.g., by someone using a stolen credit card). But today the AGP is being misused. This abuse is known as the add/drop scheme.


  The scheme traces its roots to the arrival of the search engines. Registrars and other enterprising individuals quickly learned the value of including sponsored search-engine links on Web pages. When Net surfers land on those pages and click the links, the controlling party collects a pay-per-click fee.

The registrars that participate in the add/drop scheme begin the process by making a large cash deposit with the VeriSign registry -- which essentially gives them a line of credit for registrations. They then grab and register as many names as their funds permit -- tens of thousands of domain names, possibly even a million or more.

For every name registered, they have a system that puts up a smart Web page designed to benefit from pay-per-click. The page will have traffic links tailored to that domain name, so if an Internet user lands there, he or she might click one of the associated links. When that happens, money has been made.


  If there is enough traffic and enough clicks to pay for the registration fee and still make a profit, that domain name is kept. The rest are deleted before the end of the five-day period, and the registrar receives a full refund of the registration fee. They essentially get a free five-day trial.

However, what is happening more frequently is that some domain names are being registered and then deleted again and again, giving the registrar (or its customer) repeated five-day AGPs to further track traffic and clicks. This extends their free trial indefinitely. Throughout, they are making money from clicks on their pages. They may ultimately pay nothing for the domain name.

The deposit required to register a .com name is $6.00. If an add/drop registrar has an annual interest cost of 6%, the name need only earn 36 cents to keep it in their portfolio (36 cents = $6.00 x 6%). It doesn't take much revenue to exceed the opportunity cost on a .com registration.

So what's wrong with all this? On Mar. 31, 2006, 764,672 .com names were registered. Of those, only 61,169 were retained after the five-day period expired. The balance, a staggering 92%, was dropped just before the grace period expired. For the entire month of March, a total of 27,660,668 .com names were dropped just before the grace period expired. From March, 2005 to March, 2006, the scheme increased fifteenfold, data published by each ICANN registry shows.


  This scheme is so lucrative that more companies are joining every day. It is affecting .net and .org, too. Unless the add/drop scheme is checked, the problem will assume gigantic proportions.

Writing about this won't win me many friends in the industry, but my primary concern is for the protection of legitimate Internet domain name registrations. For the record, and its affiliates do not participate in the add/drop scheme.

As an industry, we need to collectively rise up and stop this abuse. We will need the help of the registries and ICANN. Incidentally, the registries believe there is nothing illegal about the add/drop scheme and contend they cannot stop it.

But there is a simple solution: a nonrefundable fee of 25 cents to be paid to ICANN by the registrars. Right now, ICANN receives that amount for every .com name kept past the grace period. This ICANN fee is tabulated for each registrar and paid quarterly. Of course, legitimate registrations that are legitimately deleted during the Add Grace Period would be affected by this new nonrefundable fee, but experience tells us that the numbers of those affected would be low; a legitimate percentage of new registrations deleted in the Add Grace Period is typically less than 5% and often as low as 2%.

If we made the ICANN fee apply to the registration of every domain name, including those deleted within the five-day Add Grace Period, the problem would be resolved. The net effect would be that every time a domain name is registered, the registrar would have to pay ICANN 25 cents. This would bring the problem to a screeching halt, freeing up domain names for those who would use them honestly.

Before it's here, it's on the Bloomberg Terminal.