That DNS abuse rankings vary widely depending on blocklist source — ICANN warns
Abuse rankings shift dramatically between open source and commercial blocklists, exposing blind spots in DNS monitoring.
Many research organizations publish lists of top level domains and domain registrars that they claim have high rates of abuse. But the lists are only as good as their inputs.
That’s the crux behind fresh data from ICANN, which tracks abuse metrics on its own Domain Metrica system.
In a post this stretch, the organization noted that abuse rankings differ significantly based on whether the data comes from open source abuse lists or commercial ones.
ICANN states that commercial reputation blocklists (RBLs) tend to capture more abuse than open source lists, as the latter are maintained by volunteers rather than for-profit firms.
The top two top level domains are the same on both lists and then they diverge widely.
| Commercial Rank | Open Source Rank | |
|---|---|---|
| TLD_1 | 1 | 1 |
| TLD_2 | 2 | 2 |
| TLD_3 | 3 | 10 |
| TLD_4 | 4 | 14 |
| TLD_5 | 5 | 20 |
| TLD_6 | 6 | 4 |
| TLD_7 | 7 | 12 |
| TLD_8 | 8 | 51 |
| TLD_9 | 9 | 16 |
| TLD_10 | 10 | 7 |
ICANN notes that coverage discrepancies have real-world impacts. They can impact the reputations of registrars and registries, and skew whether certain types of DNS abuse policies are more effective than others.
It notes:
In short, relying on a limited set of blocklists, especially open-source ones, can leave significant gaps in DNS Abuse coverage and skew interpretation. For researchers, policymakers, and industry stakeholders, the takeaway is clear: robust DNS Abuse measurement demands a multi-source approach, blending open and commercial RBLs. Only by acknowledging and addressing these blind spots can we build a more accurate, actionable view of the DNS Abuse landscape – and ensure that our metrics and responses truly reflect reality.
