As the domain name industry gathers in Bali, Indonesia, for ICANN 87, a new and potentially game-changing community initiative has entered its final testing stage: the Domain Trust Badge.

Once it is ready—we are aiming for ICANN 88 in Lisbon in March 2027—the Badge will operate as a voluntary, free, industry-led endorsement mechanism through which registries and registrars can have their commitment to effective anti-abuse practices validated.

Finally, a tool to make their work against abuse visible to their customers, peers, and the domain industry.

A Change of Perspective

I personally joined the fight against domain abuse in 2008, as part of the security department of a large retail bank in Spain.

Back then, we knew domain abuse was one of the key enablers of cybercrime, and it still is. I remember feeling that we—the bank and beyond—were simply taking stabs in the dark. It was a feeling of helplessness.

Almost twenty years later, despite increasing societal and regulatory pressure and multiple efforts and success stories by the domain industry to address the issue, that feeling has never entirely disappeared.

The reality is that, even though many registries and registrars invest seriously in fighting abuse and are achieving positive results, the final picture tends to resemble a photographic negative, highlighting the dark areas—the “what is missing” bit—rather than the sources of light.

The Badge initiative was launched precisely to change that perspective and bring the light forward.

An Industry-Led Conversation

Inspired by MANRS and leveraging the previous work of its Domain Trust initiative, the Global Cyber Alliance, together with a working group of more than 30 organizations, including registries, registrars, industry associations, security companies, and data providers, set the Badge project in motion in July 2025.

The MANRS precedent helped define the parameters of the project: industry-led, consensus-based decision-making, with a focus on baseline actions, a transparent measurement framework, and a validation scheme accessible to the majority of operators that follow good practices. The working group’s discussions have ensured that the model reflects the reality, the challenges, and the sensitivities of the domain name registration business.

The Global Cyber Alliance acts as the secretariat, hosting and planning the meetings, structuring the conversations around recent best-practice recommendations issued by the industry, and keeping a foot on the gas pedal to deliver practical results within one year.

We delivered those results in June 2026, when we published the first description of the Badge. After that, we engaged in a three-month engineering marathon to turn that vision into a pilot that could test the validation scheme under real-world conditions.

On October 6, the pilot was presented to the working group, together with mechanisms to collect feedback.

The Badge in Action: Now You Can Try It

Let’s imagine that you are a registry or registrar interested in obtaining the Domain Trust Badge. What would you find?

First, you would enter the Domain Trust Badge Portal, where a free and anonymous Self-Assessment Tool guides you through 17 baseline requirements, grouped into three Actions: Policy, Coordination, and Response.

These cover your public commitments and procedures against abuse (Policy), your participation in the wider anti-abuse ecosystem (Coordination), and your capacity to detect and mitigate abuse (Response). For each requirement, you’re asked to provide evidence of compliance, normally through a public link or a supporting document. And, if you need help, you find a Resource Pool with tools, templates, organizations, and initiatives that can assist you in meeting the requirements.

But we did not want the Badge to become just another checklist of good intentions. We also wanted to introduce a measurement of results.

This is the role of the Domain Trust metric (DTm), one of the 17 requirements, which combines mitigation rate, abuse exposure, and mitigation time into a single indicator reflecting how an operator handles reported abuse over twelve months.

The calculation would be performed by participating trusted data sources, using their own datasets, and at the candidate’s request. The resulting value remains private, with no public scores or rankings, and the candidate only learna whether it meets the threshold established for its category: registrars, gTLDs, or ccTLDs.

A good DTm, however, would not be enough to obtain the Badge: under the current model, all 17 requirements must be met, with an individual review foreseen for operators without sufficient abuse data to produce a meaningful measurement.

The entire process to apply for the Badge is free, anonymous, and does not expose individual results.

Of course, there is one important detail: we are not issuing badges yet. We are testing whether this model actually works.

Your Turn to Help Shape the Badge

The pilot is now open, and we are looking for registries and registrars willing to go through the Self-Assessment Tool, anonymously, and tell us what they think. We want to know whether the requirements make sense, whether the evidence requested is reasonable, whether the process is clear, and, above all, whether this is something they would consider useful.

In parallel, we are inviting providers of abuse data to run the DTm algorithm against their full-year 2025 datasets. This is particularly important because we need to understand whether the same calculation produces reasonably consistent results when applied to different sources of information, each with its own methodology and coverage.

We are also looking for organizations offering anti-abuse tools, services, or expertise that could become part of the Resource Pool. The Badge should work as a sort of gravitational force, bringing together resources that already exist in the ecosystem, without interfering with their respective business models.

The testing period will remain open until the end of 2026, and practically everything is still subject to adjustment: the requirements, which of them should remain mandatory, the DTm thresholds, and the Portal itself. Our objective is to have the final process ready for ICANN 88 in Lisbon, in March 2027.

This is why participation at this stage is so important for us. We do not want to present the industry with a finished product and simply ask for its acceptance. We would rather have registries, registrars, and other actors help us identify what needs to be changed before the Badge becomes operational.

This initiative was born out of a community conversation, and it will only succeed if the industry finds it useful.

So, if you are interested, please have a look at the Domain Trust Badge Portal, where you will also find the project’s Guidelines (v0.1). And, if you would like to participate in the tests, or simply share your thoughts, you can reach me directly at [email protected].

We would really like to hear from you.