Registrar’s Accreditation Agreement

Introduction

This doc­u­ment pro­vides some “plain lan­guage” sum­ma­riza­tion of terms relat­ed to reg­is­trant rights and respon­si­bil­i­ties as set out in the reg­is­trar Accred­i­ta­tion Agree­ment (RAA), for post­ing on Reg­is­trar web­sites. While some of the terms includ­ed here do not specif­i­cal­ly refer to reg­is­trants, those terms are includ­ed because of the poten­tial import to under­stand­ing registrar/registrant rela­tions. This doc­u­ment also sum­ma­rizes reg­is­trant rights and respon­si­bil­i­ties that arise with­in ICANN Con­sen­sus Poli­cies and spec­i­fi­ca­tions, as those poli­cies and spec­i­fi­ca­tions are incor­po­rat­ed into the RAA.’

The sum­ma­riza­tion of terms with­in this doc­u­ment do not over­ride or replace the terms set forth in the RAA or with­in those spec­i­fi­ca­tions or pol­i­cy.

Preamble

In order to reg­is­ter a domain name, a Reg­is­tered Name Hold­er (also known as a Reg­is­trant) has to use the ser­vices of an ICANN-accred­it­ed Reg­is­trar. In order to become an ICANN-accred­it­ed Reg­is­trar, the Reg­is­trar must enter into a con­tract with ICANN, referred to as the Reg­is­trar Accred­i­ta­tion Agree­ment or the RAA. The RAA sets out var­i­ous rights and respon­si­bil­i­ties for Reg­is­trants, and Reg­is­trants have addi­tion­al rights and respon­si­bil­i­ties that are set forth in sep­a­rate ICANN poli­cies and spec­i­fi­ca­tions that the Reg­is­trars agree to fol­low.

The RAA and the relat­ed poli­cies are draft­ed in very spe­cif­ic, often legal ter­mi­nol­o­gy. In order to help Reg­is­trants bet­ter under­stand the rights and respon­si­bil­i­ties that come along with the reg­is­tra­tion of a domain name, these rights and respon­si­bil­i­ties are being sum­ma­rized and pre­sent­ed with­in a sin­gle doc­u­ment. The sum­maries pro­vid­ed here do not over­ride or replace the actu­al terms as writ­ten in the RAA or the relat­ed poli­cies and spec­i­fi­ca­tions.

RAA Terms of Interest

As the RAA is between ICANN and a Reg­is­trar, no one else — includ­ing a Reg­is­tered Name Hold­er — may sue ICANN or the Reg­is­trar to claim a breach of the RAA.

Reg­is­trars may not make claims that they can pro­vide reg­is­trants with supe­ri­or access to any rel­e­vant TLD in com­par­i­son to oth­er Reg­is­trars.

Some of the Reg­is­trar oblig­a­tions are depen­dent upon Reg­is­tered Name Hold­ers ful­fill­ing cer­tain respon­si­bil­i­ties, par­tic­u­lar­ly as it relates to pay­ment of reg­is­tra­tion fees, sub­mis­sion of required data points to the Reg­is­trars, and sub­mis­sion of accu­rate data and time­ly updates to that required data. Reg­is­trars also have spe­cif­ic items on which they must pro­vide notice to Reg­is­tered Name Hold­ers, includ­ing noti­fi­ca­tions of the end of a reg­is­tra­tion term, use of Reg­is­tered Name Holder’s Per­son­al Data, and notices regard­ing escrow­ing of data for domain names reg­is­tered through pri­va­cy or proxy reg­is­tra­tion ser­vices, as well as the post­ing of fees for the recov­ery of reg­is­tered names.

Reg­is­trar Sub­mis­sion of Data to Reg­istry Oper­a­tors

For each rel­e­vant TLD, Reg­is­trars must sub­mit cer­tain data points relat­ing to each Reg­is­tered Name with­in a TLD:

• The name of the Reg­is­tered Name being reg­is­tered (3.2.1.1);
• The IP address­es of the pri­ma­ry name­serv­er and sec­ondary nameserver(s) for the Reg­is­tered Name (3.2.1.2);
• The cor­re­spond­ing names of those name­servers (3.2.1.3);
• Unless auto­mat­i­cal­ly gen­er­at­ed by the reg­istry sys­tem, the iden­ti­ty of the Reg­is­trar (3.2.1.4);
• Unless auto­mat­i­cal­ly gen­er­at­ed by the reg­istry sys­tem, the expi­ra­tion date of the reg­is­tra­tion (3.2.1.5); and
• Any oth­er data the Reg­istry Oper­a­tor requires be sub­mit­ted to it (3.2.1.6).

Reg­is­tered Name Hold­ers are nor­mal­ly required to pro­vide the Reg­is­trar with infor­ma­tion relat­ing to name­servers (3.2.1.2 — 3), and there may be addi­tion­al data required under Sec­tion 3.2.1.6 that the Reg­is­tered Name Hold­er must pro­vide. If the Reg­is­tered Name Hold­er pro­vides an update on these data points, the Reg­is­trar has five (5) days to pro­vide the update to the Reg­istry Oper­a­tor.

Whois Data

Reg­is­trars are required to have an inter­ac­tive web page and port 43 Whois ser­vice that is avail­able to the pub­lic to query free of charge. The RAA spec­i­fies cer­tain data points that must be pro­vid­ed in response to a query:

• The Reg­is­tered Name (3.3.1.1);
• The names of the pri­ma­ry name­serv­er and sec­ondary nameserver(s) for the Reg­is­tered Name (3.3.1.2);
• The iden­ti­ty of Reg­is­trar (which may be pro­vid­ed through Registrar’s web­site) (3.3.1.3);
• The orig­i­nal cre­ation date of the reg­is­tra­tion (3.3.1.4);
• The expi­ra­tion date of the reg­is­tra­tion (3.3.1.5);
• The name and postal address of the Reg­is­tered Name Hold­er (3.3.1.6)
• The name, postal address, e‑mail address, voice tele­phone num­ber, and (where avail­able) fax num­ber of the tech­ni­cal con­tact for the Reg­is­tered Name (3.3.1.7); and
• The name, postal address, e‑mail address, voice tele­phone num­ber, and (where avail­able) fax num­ber of the admin­is­tra­tive con­tact for the Reg­is­tered Name (3.3.1.8).

These data points are com­mon­ly referred to as Whois data. As dis­cussed below, Reg­is­tered Name Hold­ers are required to pro­vide a Reg­is­trar with time­ly updates to Whois data for a Reg­is­tered Name. Upon receiv­ing the update, a Reg­is­trar is to “prompt­ly” update the Whois data. Reg­is­trars may con­tract out the main­te­nance of the pub­lic query func­tion.

The RAA allows Reg­is­trars to pro­vide bulk access to Whois data to third par­ties. When pro­vid­ing bulk access or access to the Whois data through the pub­lic query func­tion, the Reg­is­trar is required to restrict access for high vol­ume queries or oth­er restric­tions on uses of Whois data as spec­i­fied in the RAA, includ­ing mar­ket­ing activ­i­ties and mass solic­i­ta­tions. If a Reg­is­trar con­tracts the pub­lic func­tion query to an out­side par­ty, the Reg­is­trar must require any con­trac­tor pro­vid­ing the port 43 ser­vice to impose the same restric­tions on access to and use of the Whois data.

Com­mu­ni­ca­tions with Reg­is­tered Name Hold­ers

Reg­is­trars are required to main­tain records of all com­mu­ni­ca­tions with Reg­is­tered Name Hold­ers, as well as records of infor­ma­tion pro­vid­ed to Reg­istry Oper­a­tors.

Escrow of Reg­is­tered Name Hold­er Data

A Reg­is­trar is required to main­tain a data­base of all Whois data for all Reg­is­tered Names reg­is­tered through the Registrar’s accred­i­ta­tion, as well as all data the Reg­is­trar sub­mits to the Reg­istry Oper­a­tor. In addi­tion, the Reg­is­trar must include in the data­base the name and (where avail­able) postal address, e‑mail address, voice tele­phone num­ber, and fax num­ber of the billing con­tact for each Reg­is­tered Name.

In some instances, a reg­is­trant may choose to lim­it the amount of per­son­al infor­ma­tion that a Reg­is­trar makes avail­able in a Whois query. To do so, the name may be reg­is­tered through a pri­va­cy ser­vice (allow­ing a reg­is­trant to con­ceal per­son­al iden­ti­fy­ing infor­ma­tion and often replac­ing it with the infor­ma­tion of the pri­va­cy ser­vice). Cus­tomers may also choose to reg­is­ter names through a proxy ser­vice, where the proxy ser­vice is the Reg­is­tered Name Hold­er, and the proxy ser­vice licens­es the use of the domain name to the cus­tomer. In that sit­u­a­tion, the proxy ser­vice, as the Reg­is­tered Name Hold­er, has its infor­ma­tion list­ed for most or all required data points.

When a Reg­is­tered Name is reg­is­tered through a pri­va­cy or proxy reg­is­tra­tion ser­vice, that affects the infor­ma­tion that is placed in the data­base, and a Reg­is­trar must do one of two things: The Reg­is­trar must either (1) include in the data­base the name and postal address, e‑mail address, and voice tele­phone num­ber pro­vid­ed by the cus­tomer in con­nec­tion with each reg­is­tra­tion, even when a pri­va­cy or proxy reg­is­tra­tion is used; or (2) at the time that a cus­tomer elects to use a pri­va­cy or proxy reg­is­tra­tion ser­vice, dis­play a notice that the customer’s data is not being escrowed. When a customer’s data is not being escrowed, only the con­tact infor­ma­tion asso­ci­at­ed with the pri­va­cy or proxy reg­is­tra­tion ser­vice will be escrowed. If a customer’s data is not escrowed, and only the infor­ma­tion of the proxy or pri­va­cy ser­vice is main­tained in the data­base, in the event of Reg­is­trar or Reg­istry fail­ure future notices may only be sent to the con­tact infor­ma­tion with­in the data­base.

Reg­is­trar Busi­ness Deal­ings with Reg­is­trants

The RAA impos­es many require­ments on a Registrar’s busi­ness deal­ings, includ­ing its deal­ings with Reg­is­tered Name Hold­ers.

A reg­is­trar may not acti­vate a Reg­is­tered Name until it receives rea­son­able assur­ance from the Reg­is­tered Name Hold­er that the reg­is­tra­tion fee will be paid.

The RAA sets forth actions the Reg­is­trar may take at the con­clu­sion of the reg­is­tra­tion peri­od if a Reg­is­tered Name Hold­er has not pro­vid­ed con­sent to renew the reg­is­tra­tion, includ­ing the Reg­is­trar can­celling the reg­is­tra­tion at the end of the cur­rent reg­is­tra­tion term. If the Reg­is­tered Name Hold­er did not con­sent to renew­al, the Reg­is­trar must make sure that a Reg­is­tered Name is delet­ed from the Reg­istry data­base with­in 45 days of the end of the reg­is­tra­tion term.

This right for the Reg­is­trar to can­cel the reg­is­tra­tion and the oblig­a­tion to the delete the domain name is not absolute. Sec­tion 3.7.5.1 of the RAA sets forth a list of poten­tial “exten­u­at­ing cir­cum­stances,” that, if exist, allows the Reg­is­trar to renew the domain name even with­out the con­sent of the Reg­is­tered Name Hold­er. These cir­cum­stances include the Reg­is­tered Name being sub­ject to a UDRP action, court order, bank­rupt­cy pro­ceed­ing, or billing dis­pute, among oth­er items. The Reg­is­trar must keep a record of rea­sons why the Reg­is­trar renewed a reg­is­tra­tion with­out the con­sent of a Reg­is­tered Name Hold­er.

Reg­is­trars have to pro­vide each new reg­is­trant with notice of the Registrar’s dele­tion and auto-renew­al poli­cies. If the Registrar’s dele­tion pol­i­cy changes dur­ing the time of the reg­is­tra­tion agree­ment, the Reg­is­trar has to make efforts to inform the reg­is­trants of those pol­i­cy changes. Details of the dele­tion and auto-renew­al poli­cies have to be dis­played on any web­site the Reg­is­trar oper­ates for domain name reg­is­tra­tion and renew­al, and the Reg­is­trar should also state on those sites any fee that will be charged for the recov­ery of a domain name dur­ing the Redemp­tion Grace Peri­od (the 30 day peri­od of time dur­ing which the name is in “Pend­ing Delete” sta­tus with the Reg­istry).¹

If a Reg­is­tered Name is the sub­ject of a UDRP dis­pute at the time of dele­tion or expi­ra­tion of the reg­is­tra­tion, the UDRP com­plainant has the right to renew (or restore, in the case of a dele­tion) the domain name. If the com­plainant renews or restores the name, the Reg­is­trar must place the name in a HOLD or LOCK sta­tus,² and must mod­i­fy the Whois infor­ma­tion to show that the name is sub­ject to dis­pute. Sec­tion 3.7.5.7 of RAA also pro­vides for a right for the orig­i­nal domain name reg­is­trant to recov­er or renew the name in the event the UDRP com­plaint is ter­mi­nat­ed with­out deci­sion, or the UDRP com­plaint is decid­ed in favor of the orig­i­nal domain name reg­is­trant.

The Registrar/Registered Name Hold­er Agree­ment

Reg­is­trars are required to enter into elec­tron­ic or paper reg­is­tra­tion agree­ments with all Reg­is­tered Name Hold­ers. Accord­ing to the RAA, the Registrar/Registered Name Hold­er Agree­ment must include — at min­i­mum — the fol­low­ing items (as stat­ed at Sec­tions 3.7.7.1 — 12 of the RAA):

• The Reg­is­tered Name Hold­er must pro­vide “accu­rate and reli­able con­tact details” and must “prompt­ly cor­rect and update them” dur­ing the reg­is­tra­tion term. The details required are stat­ed in Sec­tion 3.7.7.1.: “the full name, postal address, e‑mail address, voice tele­phone num­ber, and fax num­ber if avail­able of the Reg­is­tered Name Hold­er; name of autho­rized per­son for con­tact pur­pos­es in the case of an Reg­is­tered Name Hold­er that is an orga­ni­za­tion, asso­ci­a­tion, or cor­po­ra­tion; and the data ele­ments list­ed in Sub­sec­tions 3.3.1.2, 3.3.1.7 and 3.3.1.8.”
• If a Reg­is­tered Name Hold­er inten­tion­al­ly pro­vides inac­cu­rate or unre­li­able infor­ma­tion, inten­tion­al­ly fails to prompt­ly update the infor­ma­tion, or fails to respond over fif­teen (15) days to Reg­is­trar inquiries about the accu­ra­cy of the con­tact details, the Reg­is­tered Name Hold­er will be in mate­r­i­al breach of the agree­ment and the reg­is­tra­tion may be can­celled.
• Who­ev­er is list­ed as the Reg­is­tered Name Hold­er must pro­vide full con­tact infor­ma­tion, and is the Reg­is­tered Name Hold­er of record. Some­times a Reg­is­tered Name Hold­er may reg­is­ter a domain name and then allow anoth­er per­son to use the domain name (such as a web­site design­er reg­is­ter­ing a domain name for a client). If this hap­pens, and the per­son actu­al­ly using the name did not enter into the Registrar/Registered Name Hold­er Agree­ment (referred to as a “third par­ty” in the RAA), the Reg­is­tered Name Hold­er could be account­able for wrong­ful use of the domain name by the third par­ty. This will hap­pen if the Reg­is­tered Name Hold­er is pro­vid­ed with “rea­son­able evi­dence of action­able harm” from the third party’s use of the domain name. In that sit­u­a­tion the Reg­is­tered Name Hold­er will “accept lia­bil­i­ty for harm caused by wrong­ful use of the Reg­is­tered Name,” unless the Reg­is­tered Name Hold­er dis­clos­es the user’s iden­ti­ty and cur­rent con­tact infor­ma­tion.
• The Reg­is­trar must pro­vide notice of how it intends to use data pro­vid­ed by the Reg­is­tered Name Hold­er and who will received the Reg­is­tered Name Holder’s data. The Reg­is­trar must also pro­vide notice of how Reg­is­tered Name Hold­ers may access and update data. Addi­tion­al­ly, the Reg­is­trar must iden­ti­fy which data points the Reg­is­tered Name Hold­er must pro­vide to the Reg­is­trar, and what infor­ma­tion can be pro­vid­ed on a vol­un­tary basis. The Reg­is­tered Name Hold­er must con­sent to all of these data pro­cess­ing terms.
• If a Reg­is­tered Name Hold­er pro­vides the Reg­is­trar with Per­son­al Data on behalf of any per­son who did not enter into the Registrar/Registered Name Hold­er Agree­ment (the “third par­ty” dis­cussed above), the Reg­is­tered Name Hold­er must con­firm that it (1) pro­vid­ed those third-par­ty indi­vid­u­als with the same data pro­cess­ing notices that the Reg­is­trar pro­vides, and (2) received the same con­sents from the third par­ty regard­ing the Registrar’s data pro­cess­ing terms.
• A Reg­is­trar may only process the Reg­is­tered Name Holder’s data as stat­ed in the data pro­cess­ing notices described above.
• A Reg­is­trar has to agree that it will take rea­son­able pre­cau­tions to pro­tect the Reg­is­tered Name Holder’s data from “loss, mis­use, unau­tho­rized access or dis­clo­sure, alter­ation, or destruc­tion.”
• Reg­is­tered Name Hold­ers must rep­re­sent that: “to the best of the Reg­is­tered Name Holder’s knowl­edge and belief, nei­ther the reg­is­tra­tion of the Reg­is­tered Name nor the man­ner in which it is direct­ly or indi­rect­ly used infringes the legal rights of any third par­ty.” This means that the Reg­is­tered Name Hold­er must rep­re­sent to the Reg­is­trar that the domain name is not being reg­is­tered for use in a way that would vio­late the legal rights of oth­ers. An exam­ple of this “infringe­ment” could be a reg­is­tra­tion of a domain name that vio­lates a trade­mark or copy­right held by some­one that is not the Reg­is­tered Name Hold­er.³
• If there is a dis­pute in con­nec­tion with the use of the reg­is­tered name, the Reg­is­tered Name Hold­er must agree to juris­dic­tion of the courts in at least one of two places: where the Reg­is­trar is locat­ed (often stat­ed on the web­site or in the Registrar/Registered Name Hold­er Agree­ment) or the “Reg­is­tered Name Holder’s domi­cile.” “Domi­cile” is a word with legal­ly-spe­cif­ic mean­ing, but typ­i­cal­ly will be the loca­tion the Reg­is­tered Name Hold­er pro­vides to the Reg­is­trar in the required Per­son­al Data. Agree­ing to juris­dic­tion means that the Reg­is­tered Name Hold­er agrees that the courts in those loca­tions have the pow­er to decide these types of cas­es.⁴
• The Reg­is­tered Name Hold­er must agree that its reg­is­tra­tion is sub­ject to “sus­pen­sion, can­cel­la­tion, or trans­fer” for the rea­sons stat­ed in Sec­tion 3.7.7.11. Those rea­sons include: if an ICANN adopt­ed spec­i­fi­ca­tion or pol­i­cy requires it or if a reg­is­trar or reg­istry pro­ce­dure requires it “to cor­rect mis­takes by Reg­is­trar or the Reg­istry Oper­a­tor in reg­is­ter­ing the name or for the res­o­lu­tion of dis­putes con­cern­ing the Reg­is­tered Name.” For exam­ple, the UDRP is an ICANN adopt­ed pol­i­cy that spec­i­fies that an admin­is­tra­tive pan­el hear­ing a domain name dis­pute could order that a domain name reg­is­tra­tion be sus­pend­ed, trans­ferred or can­celled, and the Reg­is­tered Name Hold­er has to agree that this is a pos­si­bil­i­ty.
• The Reg­is­tered Name Hold­er shall “indem­ni­fy and hold harm­less the Reg­istry Oper­a­tor and its direc­tors, offi­cers, employ­ees, and agents from and against any and all claims, dam­ages, lia­bil­i­ties, costs, and expens­es (includ­ing rea­son­able legal fees and expens­es) aris­ing out of or relat­ed to the Reg­is­tered Name Holder’s domain name reg­is­tra­tion.” At its sim­plest, this means that if the Reg­istry Oper­a­tor (or its employ­ees, etc.) for the reg­is­tered name is sued because of the Reg­is­tered Name Holder’s domain name reg­is­tra­tion, the Reg­is­tered Name Hold­er will pay the Reg­istry Oper­a­tor for all fees and expens­es in defend­ing against the suit as well as pay for any judg­ments or lia­bil­i­ties award­ed. This “indem­ni­fi­ca­tion” is not sole­ly lim­it­ed to court cas­es.

Ver­i­fi­ca­tion of con­tact infor­ma­tion

As described in more detail below, there are spec­i­fi­ca­tions and poli­cies that may be cre­at­ed and that apply to the Reg­is­trars. Some of the spec­i­fi­ca­tions or poli­cies may address a Registrar’s oblig­a­tion to ver­i­fy the con­tact infor­ma­tion sup­plied by the Reg­is­tered Name Hold­er when the domain is first reg­is­tered, as well as set­ting out require­ments for peri­od­ic re-ver­i­fi­ca­tion of con­tact infor­ma­tion.

Reg­is­trars are also required to take “rea­son­able steps” to ver­i­fy con­tact infor­ma­tion in the event any per­son noti­fies the Reg­is­trar that con­tact infor­ma­tion for a Reg­is­tered Name is inac­cu­rate. The Reg­is­trar also has oblig­a­tions to act to cor­rect inac­cu­ra­cies in con­tact infor­ma­tion that the Reg­is­trar becomes aware of, even if the inac­cu­ra­cy was not report­ed by any­one.

The Reg­is­trar must also main­tain prop­er con­tact infor­ma­tion for itself, includ­ing a valid email and mail­ing address. This con­tact infor­ma­tion should be post­ed on the Registrar’s web­site.

Reseller arrange­ments

The RAA impos­es oblig­a­tions on Reg­is­trars work­ing with third-par­ty Resellers — per­sons or enti­ties that the Reg­is­trar con­tracts with to pro­vide Reg­is­trar Ser­vices. The RAA now requires Reg­is­trars to include spe­cif­ic items in the Registrar/Reseller Agree­ments, includ­ing: pro­hibit­ing the Reseller from mak­ing rep­re­sen­ta­tions that it is accred­it­ed by ICANN; requir­ing that all Reseller reg­is­tra­tion agree­ments include all pro­vi­sions that the Reg­is­trar is required to include in its Registrar/Registered Name Hold­er Agree­ment; requir­ing the post­ing of all links to all ICANN web­sites that the Reg­is­trar is oblig­at­ed to post; and iden­ti­fi­ca­tion of the spon­sor­ing reg­is­trar. The Reseller is also required to make sure that that if a cus­tomer is using a Reseller’s pri­va­cy or proxy reg­is­tra­tion ser­vice for a domain name reg­is­tra­tion, the Reseller does one of the fol­low­ing three things: (1) deposit the iden­ti­ty and con­tact infor­ma­tion of the cus­tomer with the Reg­is­trar; (2) deposit the iden­ti­ty and con­tact infor­ma­tion in escrow; or (3) posts a notice to the cus­tomer that their con­tact infor­ma­tion is not being escrowed.

The RAA also requires the Reg­is­trar to take com­pli­ance and enforce­ment action against a Reseller vio­lat­ing any of the required pro­vi­sions.