The Messaging, Malware and Mobile Anti-Abuse Working Group (M³AAWG) published the report DNS Abuse Prevention, Remediation, and Mitigation Practices for Registrars and Registries in January 2024. The document addresses the need for concrete best practices in preventing and mitigating Domain Name System (DNS) abuse.

While previous publications have focused on defining DNS abuse and reporting procedures, M³AAWG identified a need for formalized recommendations for registries and registrars to combat malicious or compromised domains. This document seeks to close the gap in operational anti-abuse mechanisms, inform DNS stakeholders, and foster a safer and more secure DNS ecosystem.

This document focuses on four primary types of DNS Abuse as defined by the Internet Corporation for Assigned Names and Numbers (ICANN) contracts: malware distribution, botnet command and control, phishing, and pharming. It outlines best practices for prevention, mitigation, and remediation.

Prevention. Some examples of prevention techniques include implementing strong authentication measures to prevent unauthorized account creation, applying domain registration policies to verify the legitimacy of domain registrants, executing security measures to prevent domain hijacking, and establishing policies and monitoring mechanisms to prevent domain misuse.

Mitigation. Mitigation techniques focus on reducing the harmful effects of abuse. This may involve implementing and developing incident response plans to quickly address and mitigate the impact of an abuse incident. The goal is to minimize the damage caused by the abuse and limit its impact on users and systems.

Remediation. Remediation techniques are aimed at undoing or reversing the effects of abuse. This may involve restoring compromised accounts or domains to their original state, and taking legal actions against abusers to stop their abusive activities. Remediation techniques aim to restore the affected systems or entities to a secure and functional state and prevent further abuse from occurring.

M³AAWG's DNS Abuse Prevention emphasizes collaboration among cybersecurity, law enforcement, and the internet community in combating DNS abuse.

The document also emphasizes the need to conduct analysis to determine the nature and contextual setting of a threat. This ensures that the actions taken by registries and registrars consider the potential impact on innocent and reputable entities.

M³AAWG advocates establishing clear evidentiary standards and escalation policies before taking any action. ICANN, in its guidelines on domain seizure, emphasizes the importance of assessing the potential collateral damage on innocent third parties before requesting a domain seizure.

The broad adoption of these best practices can strengthen the security and resilience of the DNS ecosystem. Stakeholders can actively contribute to a comprehensive defense strategy aimed at mitigating the impact of DNS abuse incidents, safeguarding internet users, and upholding the integrity and availability of the Domain Name System.

You can access this document and additional best practices published by M³AAWG here.