Shorter domain verification window could create more problems than it solves: Tucows

Data suggests more harm than good from reducing 15-day verification deadline.

Tucows published an analysis this stretch suggesting that shortening the timeframe in which registrants must confirm their contact information would not meaningfully impact DNS abuse.

Right now, registrants have 15 days to verify their information, typically by clicking a link in an email. Domains are suspended following 15 days if this action isn’t taken.

Tucows noted that some are pushing for a reduction from 15 days or even requiring domains to be verified ahead of they are activated.

It analyzed registrant behavior at one of its wholesale registrars (it owns Enom, OpenSRS, and Ascio), and found that shortening the window would impact legitimate registrants while making only a modest dent in abuse.

Nearly half of registrants verified on the same day they registered their domains. Another quarter didn’t verify on time and had their domains suspended.

The remaining quarter verified following the first day and ahead of the deadline. There were spikes on the days that Tucows sent reminder emails to the registrants.

This means that shortening the window could result in suspensions for people who would have confirmed ahead of the deadline. This includes registrants who have by now launched websites or set up email, and would see these services go down. (I’d point out that more people are setting up sites quickly thanks to AI-powered development tools.)

On the flip side, the firm found that over 95% of domains flagged for abuse were verified by registrants.

Remember, verification merely means having a valid email address to receive the notice and click a confirmation link.

If anything, I think the Tucow’s analysis suggests that the verification system ought to be scrapped entirely. Confirming an email address clearly doesn’t prevent people from using domains for abuse, and it creates a phishing opportunity against domain registrants.