ICANN policy may restrict bulk domain registrations by AI

ICANN is exploring policy changes that could make bulk domain registrations more difficult, a move that may impact agentic AI systems. The proposals, currently in the early stages of a Policy Development Process (PDP), aim to introduce "friction" into registration workflows for untrusted or new accounts. While the initial focus was on API-based registrations—often linked to abusive activities like malware and spam—the draft charter now uses "technology neutral" language, signaling broader applicability to emerging tools, including AI-driven registrations.

Policy scope and timeline

The proposed PDP would require ICANN-accredited registrars and their resellers to implement safeguards preventing untrusted registrants from immediately accessing large-scale domain registrations. Key details, such as the numerical threshold for "at scale" registrations and the criteria for establishing "trustworthiness," remain undefined and would be determined by the PDP working group. The earliest possible approval for the policy is late 2027, with implementation potentially following in 2028.

The initiative is part of ICANN’s Domain Abuse Mitigation efforts, launched last year under pressure from governments and studies like ICANN’s INFERMAL report. That report found registrars with freely available APIs were significantly more likely to be exploited for abusive purposes. While the draft charter does not explicitly mention AI, its technology-neutral framing suggests agentic AI systems could fall under the proposed restrictions.

Industry implications

If adopted, the policy could reshape how businesses and AI-driven tools interact with domain registration systems. Registrars would need to develop mechanisms to verify registrant trustworthiness before allowing bulk registrations, potentially introducing delays or additional verification steps. For legitimate users, such as domain investors or large organizations, this could complicate workflows that rely on rapid, high-volume registrations.

The policy’s impact on abusive registrations remains uncertain. While the intent is to reduce malware, spam, and other malicious activities, the effectiveness of the proposed safeguards will depend on how they are defined and enforced. Critics may argue that the measures could disproportionately affect legitimate users while doing little to deter determined bad actors.

What to watch

The PDP working group has yet to be formed, and the policy’s final shape will depend on stakeholder input. Key areas to monitor include:

• The definition of "at scale" registrations and how it applies to different use cases.
• The methods for establishing and verifying registrant trustworthiness.
• The timeline for implementation and any transitional periods for compliance.

Registrars and resellers should prepare for potential changes to their registration workflows, particularly those serving high-volume or automated customers. The policy’s technology-neutral approach means it could adapt to future tools, including AI systems not yet widely deployed.