‘Whois’ is pronounced as the phrase ‘who is’.

Public Perception
The public perception of Whois auditing may be mixed because it is so common to use False Whois information, not necessarily to cover criminal activity but to avoid the risk of identity theft or maintain privacy. However, in the case of a technical malfunction on the registrant’s website or a Domain Name Hijacking attempt, it is important for the registrant’s contact information to be correct so that they can be informed in a timely manner.

Outcome
More frequent Whois audits can encourage more open behavior in the domain name industry and provide accountability. Hopefully, people concerned about privacy and security will seek additional fee-based privacy or proxy services or sign up with a registrar that provides such services for free instead of risking their domain name by using false Whois information.

See these quotes at: https://icannwiki.org/Whois_Audits_and_Verification

What are top-level domains?

gTLD: generic top-level domain, such as .com / .net / .org (/ .co)
ccTLD: country code top-level domain, such as .nl / .eu
nTLD: new top-level domain program – in October 2013; new TLDs were delegated, such as .frl
brandTLD: brand top-level domain, such as .amazon
geoTLD: geographic top-level domain, such as .wales

Root Zone Database https://www.iana.org/domains/root/db: ‘generic’ versus ‘country-code’.

What about control?

A country code top-level domain is quite autonomous, for example the .nl zone: https://sidn.nl (SIDN B.V.)

Which authority is above web facilities in the Netherlands?

The Dutch State Inspectorate as of January 1, 2023: https://www.rdi.nl
(‘Rijksinspectie Digitale Infrastructuur’ – Ministerie van Economische Zaken en Klimaat)

How to use the Whois method to check domain information?

• With all efforts to really improve input, updates must be legitimate;
• If a registrant’s name matches, this is not yet a unique identifier. Compare the RISN – Dutch Fiscal Number for a legal person, and the transition to IBAN – International Bank Account Number;
• The forms in the SIDN interface process less than ten percent of the input. Transparency and continuous public supervision are important to SIDN and its customers. In this way, public becomes aware of unexpected data. From the point of view of administrative organization, this acts as a control loop. A domain holder is sensitive to criticism from customers;
• Correct input forms are not a solution to correct long-standing data;
• A professional checklist could become routine during the (semi) annual audit;
• Example of Whois: https://www.sidn.nl/en/whois?q=webhostingtech&lang=en.

How to improve the Whois method for the public?

• A radio commercial by SIDN about the holder name, was an eye-opener for many. Its text could serve well as a quote;
• Effective framing of Whois usage, based on the six purposes and added purposes, may reduce registrar nonsense;
• Form fields provide explanations in a professional way on https://en.internet.nl/. A screenshot of such an explanation can be a solid problem statement for maintenance;
• Putting an arrow on a – still illegal – screenshot of SIDN’s Whois can be difficult, because of protected field names. SIDN can easily improve by adding a ‘registrant_protected’ form field;
• The Whois screen can replace hard-to-find web pages about terms and conditions, and key case law. Modular explanation makes maintainable;
• Access to a domain provider’s Whois menu differs from optimal to none. Smooth auditing requires user-friendly public Whois;
• Maintenance of Whois data would improve with minimal knowledge on the part of those responsible.

Are privacy requirements finished?

In order to improve privacy in the .nl zone, SIDN changed rules from 1st March 2016. If a domain is for ‘private use’, then the holder name is protected by default in Whois. Country-specific requirements require a generic Whois standard.

Some business transparency issues

• For a ‘registrant_trade_name’ as compared to ‘registrant_personal_name’, privacy is less of a legal issue;
• For Dutch proprietorship (Dutch: ‘eenmanszaak’) there is no fiscal RSIN number, no legal person, and often a home address. In terms of global standardization, these types of specific situations do not fit into a data structure;
• For business use by a natural person, ‘registrant_personal_public’ no/yes would work;
• A new ‘registrant_protected’ field can communicate tiered / layered access for a natural person’s privacy;
• Transparency and reporting a leak of data, may require in the future the real ‘registrant_trade_name’, which is mandatory in some zones;
• Having the name of a hosting provider as the holder, the real holder is no longer visible (just a click away, called ‘privacy protection’);
• Manually forwarding email to the real domain holder slows down the handling of an issue. This delay could become part of regulation;
• To enforce compliance, the only possible sanction of removal will often harm the public interest and thus be unacceptable to a court;
• In the EU, customer protection authorities may sanction in addition to already functioning data protection authorities.

Four kinds of Whois email contacts for gTLD

See eg https://domain-contact.org; Contact you would like to send a message to: Owner, Admin, Tech or Billing.

The analyzed six legal Whois purposes for gTLD

gTLD Registration Directory Services and the GDPR
Part 1 (Hamilton law firm, 16th October 2017)

(i) The use of Whois data, for instance by registrars and network operators, for invoicing, support and other administration actions in relation to registered domain names.
(ii) The use of Whois data for safeguarding the rights of registrants, for instance by retention of the data in escrow with escrow agents, for recovery in the event of e.g. a distressed registrar or registry or failure by a registrar or registry to fulfill its obligations.
(iii) The use of Whois data by law enforcement agencies to investigate and counter serious crime, terrorism, fraud, consumer deception, intellectual property violations or other violations of law.
(iv) The use of Whois data by intellectual property rights holders to investigate intellectual property rights infringements.
(v) The use of Whois data by the general public to verify the identity of a provider of goods or services on the internet, including for consumer protection purposes.
(vi) The use of Whois data to identify the owner of a domain for business purposes, for instance in relation to a purchase of the domain name or other transactions.

How to maintain terms and conditions of SIDN, and elsewhere?

1. issue: A registrar has to correct a clearly wrong name of the registrant.
   issue: A person with primary responsibility is required; a registrar is limited.
   issue: Eg for the .eu zone https://whois.eurid.eu/nl/complaint/ is not effective.
   suggestion: Naming to correct, even for a non-existent name, cannot be a shared responsibility.
   suggestion: Model a naming request text to someone’s supplier.
   Expected holder names, of started political parties:
   2000-02-27 https://www.sidn.nl/whois?q=fvd.nl&lang=en (reported+fixed)
   2018-02-20 https://whois.domaintools.com/voltnederland.org
   2019-02-18 https://www.sidn.nl/whois/?q=boerburgerbeweging.nl&lang=en (reported+fixed)
   Unexpected holder names, of started political parties:
   2017-09-10 https://whois.domaintools.com/bij1.org
   2019-11-27 https://www.sidn.nl/whois?q=bewegingdenk.nl&lang=en
   2020-12-02 https://www.sidn.nl/whois/?q=ja21.nl&lang=en (reported)
   2003-12-30 https://www.sidn.nl/whois?q=bvnl.nl&lang=en
2. issue: A third party is allowed and must therefore be able to notify a registrar.
   suggestion: Make abuse contact details mandatory, or disallow a third party;
3. issue: A ‘privacy protected’ email address, obliges only the hosting provider to reply
   suggestion: Require the real holder to answer a contact request.
   Eg at a political party https://www.sidn.nl/whois/?q=ja21.nl&lang=en
4. issue: Whois screens are improved for privacy since GDPR.
   suggestion: Allow Whois screenshots for financial statements;
5. issue: Key case law and expertise must reach the public
   suggestion: Describe an informative Whois screen;
6. issue: Changes in data are unclear to a holder.
   suggestion: Communicate listed data after a change;
7. issue: In court decisions, all kinds of spelling mistakes require correction.
   issue: Reporting a misspelling gets stuck in process descriptions for registrars.
   issue: The direct responsibility of a registrar for its own naming seems too new.
   suggestion: SIDN works / communicates towards customer protection through auditing;
8. issue: Abuse is answered by support without name and function.
   suggestion: Try to achieve ‘abuse’ mail account naming and clear responsibility texts;
9. issue: The registrar process and fee information got hidden for public.
   suggestion: Go back to policy of communicating process and rate information;
10. issue: I cannot find the ‘Aanvullende Voorwaarden’ for eg a former EU country.
    suggestion: Really don’t block the transparency of internet usage;
11. issue: Naming of a holder differs from legal spelling, such as ‘nv’, ‘bv’, ‘b.v.’ and ‘BV’.
    need: Integral control by and at the expense of SIDN of registrar names.
    suggestion: Support promotes that a trade name corresponds to the Business Register.

How can SIDN’s Whois be improved?

suggestion 1-7: Clearer agreement than with general terms and conditions

Choose from six possible purposes, eg: My use of Whois is to verify the identity of a supplier.
(The various purposes are clear, wrote Mrs. mr. C. Ebbers and drs. J. Jansen, 2019-03-01)
A screenshot no longer reveals confidential information after the privacy regulation.
Checking a supplier is not yet common practice.

suggestion 2-7: Clearer explanation of a holder name

Whois information exceeds intellectual property rights. Someone must be in charge. A ‘registrant_trade_name’ is not necessarily a legal entity. A change of registrant requires agreement of both parties. Strictly speaking, a domain with a ‘registrant_trade_name’, or ‘registrant_personal_name’, that does not exist, does not have an holder; a court decision can then provide a solution; a typo can be corrected at an early stage.

suggestion 3-7: Clearer about protected information, in relation to the right to view in GDPR

Field checking does not work with the sentence ‘The registrant’s details can be withheld from public view.’. A modeled ‘registrant_protected’ form field is derived from existing data. A ccTLD can still fine-tune a country-specific form.

SIDN: ‘From August 10, 2017, the registration data about each domain name will include contact details for reporting abuse to the registrar. ‘Abuse’ means any form of internet crime. The additional information will soon be available from the Whois on our website. Easy access to abuse contact details will mean that issues involving the domain name can be dealt with more quickly.’

suggestion 4-7: Clearer abuse contact, instead of hiding if not set, which was a step back

nl_NL: Contactgegevens niet beschikbaar -> Contactgegevens om misbruik te melden kunnen verplicht worden voor een registrar.
en_US: Contact details are not available -> Contact details to report abuse may become mandatory for a registrar.
Legitimate notifications by a third party will not work without the registrar’s email address, so information cannot be optional.

suggestion 5-7: Clearer explanation of an administrative contact

As administrative contact preferably choose the person who manages the administrative affairs. This email address must already be accessible when creating the domain and is preferably from another domain.

suggestion 6-7: Clearer explanation of a technical contact

As technical contact preferably choose the person who can take immediate action in case of a technical issue.

suggestion 7-7: Clearer information in email

Start differently in any email content for ‘admin-c’, ‘admin-t’ and the registrar.

Plus: SIDN’s turnover figures could be clearer

Renewal of existing domain registrations
Registering of new domains (with a calculated rate of 50%)
Transaction revenues domain data (to change to rate zero)
Transaction revenues registrar data (to change to rate zero)
Other

Gross turnover total

-/- Volume discount (to scale down)
-/- Direct debit discount (to phase out)
-/- New registration discount (works great)
-/- Multi-year registration discount (to phase out)
-/- Proper registration rewards (to phase out)

-/- Direct costs

Net turnover total

Note: A comparison with the previous financial year is also useful.