Home / Blogs

Should a Domain Name Registrar Run from a PO Box?

Protect your privacy:  Get NordVPN  [73% off 2-year plans, 3 extra months]

In 2008 KnujOn published a report indicating that 70 ICANN accredited Registrars had no publicly disclosed business location. The fundamental problem was one of community trust and consumer faith. Registrars extend their legitimacy to their domain customers who then transact and communicate with the public. It is difficult enough when registrants conduct illicit commerce and wrap themselves in mystery, for a Registrar to do the same shames the entire industry. Much to our shock, we found that Registrars were not required to publicly disclose their address. Since then the ICANN Registrar directory has been updated to include all the addresses and the Registrar Accreditation Agreement has been amended to include the following language:

“3.16 Registrar shall provide on its web site its accurate contact details including a valid email and mailing address.” (source)

But what constitutes a “valid mailing address” other than it can accept mail.

This probably would have been better worded as “valid business address” as we recommended, but that will have to wait for the next round of RAA changes. In the meantime we ask the question, does it support openness and accountability if the gatekeepers of domain registration run out of public mailboxes? Some may immediately argue that it is an immediacy of running a small business since they may not have to staff or facilities to accept mail. And I would guess this would be the case for companies like Domain Monkeys, LLC who use a P.O. box but have a real brick-and-mortar shop just up the street. The same goes for DomainsToBeSeen.com, DOMERATI and Sundance Group. But we are puzzled by Hosting.com, Inc., which has a P.O. Box in Kentucky when their business is really in Colorado.

Honestly, the issue disappears if the Registrar clearly posts its business address where consumers can find it. Enetica Pty Ltd uses a PO box in Australia but clearly states its street address on their website. Contrast this with DomReg Ltd. (AKA LIBRIS.COM), which runs from a PO box in Russia and has no other contact information posted on its website not even a phone number.

Now, we have many Registrars using P.O. boxes in the Cayman Islands and other Caribbean locations. DirectNIC, LTD, AKA Intercosmos, used to have an address in New Orleans but now has a PO box in the Caymans. Bargin Register also has a Caymans PO box listed as their address. It has been explained to us multiple times that “all addresses in Caymans are PO boxes,” but this is only partly true. For the purposes of mailing in the Caymans PO Boxes must be used, however, all businesses do in fact have street addresses. Example, The Royal Bank of Canada in the Caymans lists two addresses on its website: 24 Shedden Road, George Town, Grand Cayman (street address) and PO Box 245 Grand Cayman KY1-1104 (mailing address). In this case the Registrar can and should list both addresses but DirectNIC and Bargin Register do not.

And then there are “suites.” Suite is a deceptive address term since it could mean a leased space in an office building or hotel, but suite is also the term UPS and other private mailbox services use to refer to their rented postal boxes. There are at least a dozen Registrars with suite numbers in their addresses that need to be clarified. Estdomains ran out of a Delaware proxy address and business registration. This was part of their overall policy of hiding any information concerning the true nature of the Registration business (related story). Secrecy and misdirection are primary indications of potential fraud.

Of course all of these issues are moot in the face of a falsified address as in the case of Parava Networks, AKA 10-Domains. Parava was later de-accredited for other contract violations (pdf). In the name of accountability and transparency we need to know that the Registrars are legitimate companies, the first step is identification.

This brings us to the most extreme case of location obfuscation: OnlineNIC. OnlineNIC claims to be in the U.S. but they are not. The California address they feature on their website and in the ICANN directory is an auto-body shop or barren lot. There are two other addresses they use and one is a residential address with no apparent business taking place. The second is an office building, however we could not find OnlineNIC there, but we did find a UPS Store. There are actually more red-herring California addresses for OnlineNIC, but the point is made. It is no surprise to many people that documents related to OnlineNIC lead back to Hong Kong and ultimately to mainland China. Does ICANN even know where OnlineNIC really is? Why are they pretending to be in the United States when other Chinese Registrars operate with full location disclosure? This is a shameful charade that has mislead consumers for too long. We’re calling for OnlineNIC to publicly disclose their address and for ICANN to post that real address in the directory.

Address disclosure is critical to consumer trust and ICANN’s pledge of transparency and openness. The public should see the same address used in Registrar accreditation applications.

By Garth Bruen, Internet Fraud Analyst and Policy Developer

Filed Under

Comments

Holding registrars accountable Howard Hoyt  –  Jan 30, 2010 11:30 PM

So true, but without government help, what hope ?
Certainly NOT ICANN help- such a joke, and yet not suprised. Suprised by failure of US tho.
The US Govt appears to have washed their hands.
CN continues to have a field day.
Now hidden entity RU emerges, how to control #1 URIBL @
http://rss.uribl.com/nic/ which appears not even accredited and provides
zero contact (gee, I wonder why ???).
Q: How to feel positive when ICANN is clueless/dn care and the governments only look for job creation, albeit spam factories of cn, etc ???

Rather total-laissez faire, don’t you think ??

Between $ICANN$ incompetency, US ostrich, RU/CN factories I cannot be optimistic.
OTH, I salute Knujon for forwarding the concept that Registrars must be made accountable. Question is-
by WHO ?

Formal request coming Garth Bruen  –  Jan 31, 2010 10:07 PM

We will be issuing a formal request, RE: OnlineNIC and providing information on how anyone may support or otherwise comment on the issue to ICANN.

Cayman Addresses John Berryhill  –  Feb 1, 2010 3:13 PM

Yes, Garth, there are street addresses in Cayman, but the Cayman Islands Postal Service will not deliver mail to street addresses.  Hence the problem of publishing a street address is that people will attempt to send mail to it, the mail will be returned, and then the address will be claimed as “incorrect”.  We’ve run this drill before, and that is precisely what happens.  You cannot send mail to the Royal Bank of Canada, which indeed is located at 24 Shedden Road, using an address of “24 Shedden Road”.  Our experience has been that publishing a street address results in more “incorrect address” complaints than publishing the only address to which mail will be delivered.  Maybe your experience is different, but I doubt you have any relevant experience with this particular problem.

http://www.caymannewresident.com/page_id_36.html
“Post to Cayman must have a PO Box number and a postal code written on the envelope.”

http://www.caymanpost.gov.ky/portal/page?_pageid=1327,1736927&_dad=portal&_schema=PORTAL
“Mail is delivered via private letterboxes at post offices. For effective mail/parcel delivery, there must be a P.O. Box reference included in the address”

Already said all of that Garth Bruen  –  Feb 1, 2010 4:14 PM

John, I’m aware of the Cayman’s postal policy which is why I explained it. The issue here is one of transparency. Posting the real street address erases doubt that the company actually exists in that location. You also fail to address the issue of the person living or traveling in the Cayman’s who wants to visit the business in person. The address should not be secret. The problem you describe above of people trying to send mail to the street address is a lesser issue in the face of disclosure to the consumer. If the Registrar posts both addresses and clearly states that mail to the street address cannot be processes then the issue has been thwarted, it is then the mailer’s fault for not following instructions.

Personal visits? John Berryhill  –  Feb 1, 2010 6:25 PM

No, you didn’t say all of that.  You implied that it was only “partly true” that “all addresses in Cayman are PO boxes”.  The assertion, and your characterization, both miss the mark.  The point is that “only PO boxes are lawful mailing addresses in Cayman.” 

If you attempt a personal visit to NSI without an invitation, you will be escorted off of the property by an armed guard.  That has happened.  And, again, because you do not have actual experience with the full range of correspondence received by registrars, you are not familiar with some of the less well-balanced individuals who constitute frequent registrar correspondents.  Such communications run the gamut from the mildly strange, to the outright criminally threatening.

“The problem you describe above of people trying to send mail to the street address is a lesser issue in the face of disclosure to the consumer.”

Those are glib, easy words, which convey no tangible comparison of quantifiable data.  I can’t quantify “the face of disclosure to the consumer”, but I can quantify numbers of complaints under actually tested scenarios, in contrast to rhetoric. Being able to receive written communications is of primary importance to any business, and being able to send them in an unambiguous manner is of primary importance to consumers.  Again, we tried this already, and it is absolutely true that a higher level of complaints were generated by using the street address.  This is even true if you publish both addresses, because there will always be that contingent who believes the street address is somehow “better”, regardless of whatever other text is present.  That’s just the way it is.  Being able to say it’s “the mailer’s fault” is of no great consolation, when you have to answer the umpteenth compliance inquiry from ICANN because yet another person had their mail returned to them.  It is even worse when some junior law firm associate believes that better “notice” is served by using the street address instead.  It really doesn’t matter what sort of instructions you provide.  As a programmer, you should know Troutman’s Fifth Programming Postulate.

Posting a “real street address” to “erase doubt” seems a bit odd.  I have been on Shedden Road quite a few times, and yes RBC has one of its offices there.  In fact, you can save a few bucks on parking if you snag a spot in their lot during off hours and are discreet about it, instead of using the paid lot at the duty free mall next door.  But if the issue is one of a rogue registrar intentionally engaging in obfuscatory behavior, you are going to be none the wiser if they publish a street address consisting of one of the high security office buildings in the Georgetown area because, again, you cannot get into the lobby without being pre-cleared for entry.  There is no question that rogue operations are capable of publishing a street address which, in some sense, conveys an impression of reality.

The CIPS has been trying to get businesses to stop publishing street addresses.  It is easy for you to pontificate about what is a “lesser problem”, but you should really take a look at the photographs of this “lesser problem” published here:

http://www.caymannetnews.com/cgi-script/csArticles/articles/000014/001466.htm

“With more than 14,000 pieces of undeliverable mail, some weeks and an average of 90,000 letters being returned each quarter the Cayman Islands’ central sorting office in Grand Cayman is literally being buried in undeliverable mail.”

But the notion that registrars should operate tours for random visitors, as if it was Universal Studios, is cute.

Comment Title:

  Notify me of follow-up comments

We encourage you to post comments and engage in discussions that advance this post through relevant opinion, anecdotes, links and data. If you see a comment that you believe is irrelevant or inappropriate, you can report it using the link at the end of each comment. Views expressed in the comments do not represent those of CircleID. For more information on our comment policy, see Codes of Conduct.

CircleID Newsletter The Weekly Wrap

More and more professionals are choosing to publish critical posts on CircleID from all corners of the Internet industry. If you find it hard to keep up daily, consider subscribing to our weekly digest. We will provide you a convenient summary report once a week sent directly to your inbox. It's a quick and easy read.

Related

Topics

Threat Intelligence

Sponsored byWhoisXML API

Brand Protection

Sponsored byCSC

IPv4 Markets

Sponsored byIPv4.Global

Cybersecurity

Sponsored byVerisign

Domain Names

Sponsored byVerisign

DNS

Sponsored byDNIB.com

New TLDs

Sponsored byRadix