The Framework and Business Rules for the Domain Name Shared Registry - October 2001

Table of Contents

Introduction 3

1 Authorising Registrars 4
The Authorisation Contract 4
InternetNZ's Obligations 4
The Registrar's Obligations to InternetNZ 5
Cancelling a Registrar's Authorisation Status 6
By the Registrar 6
By InternetNZ 6
By the Registry 6
Impact of Cancellation 6
Liability, Exclusions and Compensation 7
Dispute Resolution 7

2 The Registry - Registrar Relationship 8
The Connection Agreement 8
The Registry's Obligations 8
The Registrar's Obligations 8
Technical Requirements 9
Registry Charges 9
Setting the Level of the Monthly Fee 10
Registry Billing 10
Liability, Exclusions and Compensation 11
Dispute Resolution 11

3 The Registrar - Registrant Relationship 12
The Registrant Contract 12
The Registrar's Obligations 12
The Registrant's Obligations 13
Cancellation of the Contract 14
Cancellation of the Domain Name Registration 14
Liability and Exclusions 14
Dispute Resolution 14

4 Transactions with the Register 15
Overview 15
Registering a Domain Name 15
Registration Grace Period 15
Moderated Domains 16
Maintaining a Domain Name 16
Locking a Domain Name 17
Generating a New Unique Domain Authentication ID 17
Changing Registrars 17
Cancelling a Domain Name 17
Re-instating a Cancelled Domain Name 18
Register Queries 18
Whois Query Interface 18
Availability Query 18
General Register Query 18
The Billing Process 19
Notifications to Registrars 20
Maintaining Registrar Details 21
Registry Functionality 21
Transfer of Multiple Domain Names between Registrars 21
Managing Cancelled Domain Names 21
Administer Registrar Details 21
Notice of Cancelled Registrar 22
Whois Query 22
Whois Web Query 22
Whois Server Query 22
DNS Push 22
Security and Access Control 23
Audit Trails 23
Activity Log 23

5 Other 24
General Information 24
Software Development Kit 24
Migration 24

Appendix I 25
The Key Entities in the .nz Domain Name Space 25

Appendix II 27
Registry Data 27
Contact Details 28
Registrar Details 29

Introduction

A shared registry system establishes a single register for registering domain names and associated technical and administrative information. The registration of domain names and modification of information associated with that name on the register can be effected only by authorised registrars.

Registrars are responsible for managing their relationship with registrants. There is no communication between the registry and registrants, except where a registrar is de-authorised by InternetNZ and a registrant is asked to choose a new registrar. A description of the major entities in the .nz shared registry system is detailed in Appendix I.

This document outlines the key entities in the shared registry system, the relationships between them, the key business processes of the registry, and the business rules that underpin these.

1 Authorising Registrar

1 Any organisation accessing the .nz registry to register domain names has to be an authorised registrar. The authorisation process will be managed by InternetNZ (through the office of the ccTLD manager) and will involve the registrar:

• signing the standard InternetNZ Registrar Authorisation Agreement;

• paying a one-off, non-refundable application fee (a standard fee that will recover the average costs of the authorisation process).

2 Authorised registrars will have to meet the following minimum requirements at the time they apply for authorisation and while they continue as an authorised registrar:

• be an incorporated entity;

• be solvent - requiring a letter from a bank recommending them as an entity who can pay their day to day debts as they become due;

• meet the technical requirements for being a registrar (outlined in paragraph 20 below);

• have in place customer support services, including billing systems and processes;

• have in place public liability insurance to the value of NZ$250,000 with a reputable insurance provider with the rating of A or better, naming InternetNZ and the registry as additional parties insured.

InternetNZ will be able to carry out additional third party checks to confirm the information provided by the registrar in support of their authorisation application.

3 Registrars will be required also to sign a separate agreement (a Connection Agreement) with the registry before they can access the register. The registry will provide a test system for registrars to test their registry-registrar interface before being given access to the production system.

4 There will be no limit on the number of registrars authorised to operate in the .nz domain name space.

5 The registrar's authorisation status is not able to be transferred or assigned to a third party. For example, company A buys company B. Company B is an authorised registrar. Company A does not automatically become the authorised registrar - they would need to go through the authorisation process. But Company A can continue to operate Company B as an authorised registrar.

This does not prevent a registrar transferring the domain names for which they are the designated registrar to another authorised registrar.

The Authorisation Contract
InternetNZ's Obligations

6 These include:

• providing and maintaining policies for .nz;

• contracting for registry services that conform to best practice standards;

• maintaining active oversight and management of the .nz domain name space;

• notifying each registrar when they have met the requirements for authorisation;

• exercising all its responsibilities in a fair, open, transparent and timely manner;

• regularly convening a Committee of representatives of registrars and the registry to discuss issues regarding the management of the .nz domain name space.

The Registrar's Obligations to InternetNZ

7 These include:

• safeguarding the rights of registrants for whom they act through

• having a signed, written agreement with each registrant for whom they act in a form which is approved by InternetNZ;

• complying with the registrant's lawful directions regarding their .nz domain name in a diligent and timely manner. (e.g. registration, registration period, cancellation, amendment, transfer, inaccuracy of information and any technical support and billing matters);

• disclosing accurately and completely all their terms and conditions associated with domain name registration and management in the .nz domain name space including price and billing information;

• providing registrants with confirmation of the registration of their domain name including details of: the domain name, their registrar, the registration period, the Unique Domain Authentication ID, and obligations of the registrant;

• complying with and accurately representing all .nz policies at all times;

• complying with all relevant legislation including the Fair Trading Act 1986 and the Privacy Act 1993 (New Zealand);

• making available to InternetNZ (or anybody authorized by them) all information requested by InternetNZ about their activities as a registrar and to provide access to their premises during normal business hours for that purpose; and to ensure that all information they provide about themselves is accurate and complete;

• complying with any order of any authority having jurisdiction regarding a domain name of any registrant for whom they act;

• maintaining all documentation regarding their activity as a registrar for 7 years;

• advising InternetNZ and the registry if the registrar or their officers or management:

• are adjudicated bankrupt;

• have a receiver appointed for any of their assets;

• go into liquidation;

• are convicted of an offence involving: dishonesty, fraud, misuse of funds, misuse of information, or found to have breached the Privacy Act;

• die or become incapacitated from carrying on business.

• maintaining a public record of .nz domain names registered in their name, any entity in which they have an interest, or any entity which has an interest in them;

• not misusing personal information relating to registrants that they collect while registering or managing their domain names for any reason other than for reasonable purposes associated with that, unless this has been expressly agreed to by the registrant;

• informing registrants about the existence of InternetNZ and its activities;

• not engaging in any activity which could or does bring management of the .nz domain name space into disrepute;

• responsibility for the actions of any agents they appoint.

Cancelling a Registrar's Authorisation Status

8 This can occur in a number of ways:

• by the registrar (e.g. no longer wishes to be a registrar);

• by InternetNZ;

• as a result of the cancellation of the Connection Agreement with the registry.

By the Registrar

This requires two months notice in writing to InternetNZ.

By InternetNZ

The Authorisation Agreement will be cancelled by InternetNZ where:

• the registrar has transferred their authorisation status to another party;

• the Connection Agreement with the registry is cancelled by either party.

The Authorisation Agreement may be cancelled by InternetNZ where

• the registrar has not met their duties to InternetNZ under the Authorisation Agreement;

• for any other reason (with one months notice) - this is a "last resort", safeguard clause.

By the Registry

The Connection Agreement will be cancelled where:

• the registrar has given two months notice in writing to the registry to cancel the Connection Agreement;

• the Authorisation Agreement with the registrar is cancelled by either party.

The Connection Agreement may be cancelled by the registry where the registrar has not met their duties under the Connection Agreement (including not paying their invoices). Safeguards for registrars will be written into the contract between InternetNZ and the registry operator - to ensure that registrars are given a reasonable period of notice to rectify any deficiencies/faults. The registry will be required to get the written consent of InternetNZ (delegated to the ccTLD Standing Committee or ccTLD Manager) before they can cancel a Connection Agreement with any registrar.

9 The combined effect of the contracts and the delegations will ensure that no registrar's authorisation status will be cancelled without the written consent of InternetNZ.

Impact of Cancellation

10 Where a registrar does not want to continue being a registrar, it is their responsibility to arrange the transfer of registered domain names for which they are responsible to another .nz registrar in line with the registrant transfer policy (this will require communication with the registrant).

11 Where InternetNZ cancels a registrar's authorisation, InternetNZ will authorise the registry to email each registrant of the domain names managed by that registrar, requesting that they select a new registrar within a specified period (using the standard trasnfer registrar process). Where a registrant does not reply, management of those remaining unallocated domain names will be put up for tender as a single block (generally) amongst the remaining authorised registrars and then transferred as a single transaction by the registry.

12 The exiting registrar can no longer hold themselves out as an authorised registrar. The registrar is required to work co-operatively with the registry and other registrars, and to continue to act to safeguard the rights of registrant, for whom they act, while they remain as their registrar.

Liability, Exclusions and Compensation

13 The Authorisation Agreement contains standard commercial exclusion of liability clauses.

14 The maximum compensation payable by InternetNZ to a registrar is the amount of the one-off application fee paid by the registrar to InternetNZ.

Dispute Resolution

15 Any claim or dispute by a registrar against InternetNZ has to be initiated within 60 days of the date that the issue arose or incident occurred. There is provision for the appointment of an independent person (appointed by the President (or Vice-President) of the NZ Law Society) to resolve the dispute, with the costs to be equally shared by both parties.

2 The Registry - Registrar Relationship

16 InternetNZ will contract with the registry for the management of the register for the .nz domain name space. The registry operator can not also be a registrar.

The Connection Agreement

17 Authorised registrars will be required to sign a Connection Agreement with the registry, before they are allowed access to the register. This agreement covers the following issues:

• access to the register;

• mutual obligations and commitments;

• charging policies and consequences;

• transferability/non-transferability of responsibilities under the agreement;

• dispute resolution;

• liability and compensation;

• changes to systems;

• general contractual provisions (for example, law and jurisdiction covering the agreement, ability to change the agreement with notice etc).

The Registry's Obligations

18 These include:

• notifying registrars when they have met the access requirements and are permitted access to the register;

• maintaining the register in line with the requirements of the InternetNZ - Registry agreement;

• using people with sufficient technical training, experience and skills to respond to and fix all problems associated with the register and its links;

• providing registrars with the level of technical and customer service support required by the InternetNZ - Registry agreement;

• complying with the terms of agreements between registrars and registrants, and the Privacy Act 1993, in the management of personal information held on the register;

• taking reasonable steps to protect a registrar's personal information against loss or unauthorised access, use, disclosure or other misuse;

• exercising its responsibilities in a fair, open, transparent, and timely manner;

• attending the Registry-Registrar Committee meetings convened by InternetNZ.

The Registrar's Obligations

19 These include:

• supplying the domain name data in the format required by the technical specifications;

• making sure all information they provide is accurate and complete and that they have the authority to enter into the connection agreement;

• accessing the registry for the sole purpose of managing the domain names for which they are the designated registrar;

• complying with all the registry's policies, directions, and instructions concerning access to the register and use of their interface with the register;

• preventing their access to the registry systems from being used to send unsolicited communications to registrants except to registrants for whom they act who have authorised such communications;

• providing information requested by the registry regarding their obligations under the Connection Agreement within 7 days;

• notifying the registry immediately where they lose or wish to change their identification and/or logon information.

Technical Requirements

20 Registrars will be required to:

• demonstrate at any time that their interface with the register works correctly;

• maintain a business operation and the technical equipment capable of handling the volumes of transactions managed by them, including using people with an appropriate level of training, experience and skill to respond to and fix all technical problems concerning their use of the register and all links connected to it;

• ensure that their activities are carried out in a prudent and competent manner and according to best practice standards to prevent technical failure, breach of security, and disruption to the register - for example - to prevent malicious and/or accidental disruption to their operations including loss, wrongful access, misuse or unauthorised disclosure of information;

• have sufficient offsite backup to enable disaster recovery;

• maintain a daily backup of their registration data and offsite storage of this on a minimum of a weekly basis;

• keep copies of all transactions, correspondence and communications with the registry for a period of not less than seven years after the end of a contract with a registrant.

21 The registry will be able to suspend a registrar's access to the register in limited circumstances, including where the registrar is having technical problems in their interface with the register which puts the integrity of the registry systems at risk.

22 Where the registry wishes to make changes to their systems and interfaces, they will be required to follow the processes to be established by InternetNZ. At a minimum, this will include consultation with registrars through the Registry-Registrar Committee, and one months notice of the changes prior to their implementation. The exception to this if where (in the opinion of InternetNZ), the integrity of the registry systems is at risk.

Registry Charges

23 There are two aspects to this - the domain name registration charges and charges for (any) additional services provided by the registry.

24 The principles of the domain name charges are:

• Domain name registrations will be charged on a monthly basis

• All registrars will be charged on the same basis regardless of the number of registrations for which they are the designated registrar

• Registrants can, at their discretion, choose to purchase multiples of months (up to a maximum of 120 months) for their domain name registration(s)

• Where a registrant wishes to purchase multiple months, their registrar is obliged to make this entry/transaction in the register.

25 Registrars will independently set their own fees for registering and maintaining domain names in the register. Registrars however must provide the registrant with the Unique Domain Authentication ID at any time and for no charge.

26 The registry will have competent technical support available for registrars in both the test and production environments. Registrars will be provided with a facility to test their interface and there will be a designated amount of technical support granted to each registrar. However the registry will reserve the right to charge for support over and above this where a registrar is having difficulty with testing their interface. Similarly for the production environment. The registry will be required to notify a registrar before any charge for technical assistance is incurred.

Setting the Level of the Monthly Fee

27 The fee level will be set by InternetNZ (through the ccTLD Standing Committee) and will cover the following:

• The operating costs of the registry (which at its most minimal form can be an individual managing a range of contracts - with InternetNZ, registrars, and outsourced technical and billing/accounting service providers);

• The "public good" activities of the Office of the ccTLD manager; and

• Some advocacy on policy/legislative issues for the continued development of the infrastructure required to support the Internet within NZ.

28 The method of setting the fee level will be transparent, but will also need to protect any commercial confidentiality around service contracts. Changes to the registration domain name charges will require notification a month in advance.

Registry Billing

29 The registrar will be invoiced for all domain names for which they are the authorised registrar. A credit limit will be established by the registry for each registrar, which is a business matter to be agreed between the registry and each registrar. When a registrar reaches their credit limit, the registry may stop them from registering any new domain names until their account has credit available. The registry may require a registrar to deposit a sum of money not exceeding their credit limit with the registry or to provide a letter of credit from a financial institution for the amount of their credit limit.

30 To minimise the registry's operating costs, payment to the registry will be by direct debit from the registrar's (New Zealand) bank account on the 20^th of the month following the invoice date. Registrars will be able to negotiate alternative arrangements (for example, credit card payments) with the registry but these may incur additional charges to reflect the actual costs of these individual arrangements (e.g. up to 5% credit card fees). The arrangements that an individual registrar seeks to put in place to suit their business model should not be one that is carried by others.

31 The separation of the register and billing transactions means that any billing issues arising between the registry and registrar will not impact on the registration status of any registered domain name. Where a registrar does not pay the registration fees owing to the registry, the registry can:

• charge them interest on the unpaid amount

• stop accepting new domain name registrations from the registrar;

• call up any letter of credit given by the registrar;

• apply any funds held by the registry to the outstanding amount;

• charge the registrar for any reasonable costs incurred in collecting the outstanding money owed.

As a final remedy, the registry could seek approval from InternetNZ to cancel the Connection Agreement with a registrar.

32 There will be a minimum monthly charge for registrars set at the level of 50 one monthly domain name charges. Further detail on the billing processes is outlined in paragraphs 94 - 106.

Liability, Exclusions and Compensation

33 The Connection Agreement contains standard commercial exclusion of liability clauses

34 The maximum compensation payable by the registry to a registrar is the amount of the most recent monthly charge paid by that registrar to the registry.

Dispute Resolution

35 Any claim or dispute by a registrar against the registry has to be initiated within 60 days of the date that the issue arose or incident occurred. There is provision for the appointment of an independent person (appointed by the President (or Vice-President) of the NZ Law Society) to resolve the dispute, with the costs to be equally shared by both parties.

3 The Registrar - Registrant Relationship

36 The SRS removes the direct access rights of registrants to the register, unless a registrant chooses to meet the requirements of becoming an authorised registrar. It is essential therefore that the rights of registrants are protected and that the SRS environment fosters adequate competition to provide registrants with genuine choice.

37 Registrars will not be obliged to accept any application for a domain name. When the register accepts an application for a domain name in the .nz domain name space there are the following protections:

• it is registering a domain name to the registrant because no other person has it according to the records of the register;

• it is not representing anything else to anybody regarding that domain name or any other domain name. The entry of a domain name in the "who is" database is not be taken as evidence of anything other than such registration;

• registrars are responsible for notifying the registrant that use of the domain name may breach third party legal rights and that it is the registrant's responsibility to ensure that such legal rights are not infringed and to protect everyone from any claim arising out of the domain name being registered to them.

38 Registrants will be able to confirm the information held on the register associated with their domain name through doing a "whois" search on the register.

39 Registrants with complaints about their registrar will be required to take this matter up with their registrar in the first instance before the ccTLD manager will investigate a complaint about a registrar.

The Registrant Contract

40 The registrar-registrant relationship is governed by a contract which must be entered into before a registrar registers a domain name for that registrant. Registrars can either submit their contract for approval by the ccTLD manager or use the standard term contract that has been developed.

41 The standard contract covers the following issues:

• mutual obligations and commitments;

• charging policies and consequences;

• cancellation provisions;

• dispute resolution;

• liability and exclusions;

• general contractual provisions (for example, law and jurisdiction covering the agreement, ability to change the agreement with notice etc).

The Registrar's Obligations

42 These include:

• maintaining their status as a registrar authorized by InternetNZ and a reliable and secure connection with the register;

• not engaging in any direct or indirect activity which is designed to bring, or has the effect of bringing, the management of the .nz domain space into disrepute;

• complying with all .nz policies and accurately representing these to registrants;

• disclosing accurately and completely all their terms and conditions associated with registering and maintaining a domain name, including price and billing information;

• processing any new .nz domain name registrations with the registry within [ hours] from the time the registrar receives all the information required to complete a registration if it is within the registrar's advertised business hours of [ ][ ], and otherwise within [ hours];

• complying with the registrant's lawful directions in a diligent and timely manner regarding their .nz domain name, (for example, cancellation, amendment and associated technical support);

• notifying the registrant of the registration of their domain name(s), including the details of: the domain name, the registrant's contact details, the registrar's contact details, the registration period, the unique domain authentication ID for their domain name and their obligations as a registrant;

• arranging for correction of any error in the information in the register about any domain name registered to that registrant when requested;

• providing to the registrant, or to someone the registrar reasonably believes to be acting on the registrant's behalf, the unique domain authentication ID for their domain name when requested and for no charge;

• using a registrant's personal information only as authorized by them;

• taking all reasonable steps to safeguard and protect all information about registrants stored in their databases and system(s);

• complying with any order of any authority having jurisdiction regarding any domain name registered to a registrant;

• using their best endeavours to deal with any complaints a registrant may have about the services the registrar provides;

• informing registrants about InternetNZ and its activities.

The Registrant's Obligations

43 These include:

• complying with the .nz policies;

• making sure all information they give the registrar is accurate and complete, keeping them informed of changes to any information they have given, and that they have the authority to enter into the agreement;

• keeping the unique domain authentication ID for their domain name, and any other security information the registrar gives them, confidential, safe and secure;

• ensuring that their use of a domain name will not infringe anybody's intellectual property rights and to protect the registrar, and everybody the registrar is in any business relationship with to provide services to the registrant, from any such claim;

• ensuring that they use the registrar's services for a lawful purpose only;

• ensuring that their use of any domain name registered to them does not interfere with other users of the Internet;

• ensuring that any order of any authority having jurisdiction regarding any domain name registered to that registrant is complied with;

• keeping the registrar (and everyone they are in a business relationship with) protected against any legal action taken against the registrar as a result of the registrant using their services or relying on information supplied by them;

• ensuring everyone the registrant is responsible for or who uses a domain name registered to them, also meets the registrant's obligations.

Cancellation of the Contract

44 Both the registrant and the registrar can cancel the agreement by giving each other one months notice.

Cancellation of the Domain Name Registration

45 Registrars can cancel a registrant's domain name as a result of the registrant not paying their charges, provided they give the registrant 14 days notice of this before they cancel the registration.

Liability and Exclusions

46 The standard Registrant Agreement contains standard exclusion of liability clauses.

Dispute Resolution

47 Registrants with complaints about their registrar will be required to take this matter up with their registrar in the first instance before the ccTLD manager will investigate a complaint about a registrar. There is reference also to use of the Disputes Tribunal by either the registrar or registrant.

4 Transactions with the Register

Overview

48 The register is the correct and the authoritative record for domain name registrations.

49 It is intended that all processes on the register will be performed via XML-based peer-to-peer transactions. The register will be a 24 x 7 operation, with proposed service availability of between 99.9 -99.95%. In addition, there will be target processing time and performance standards set for specific transactions by the register.

Registering a Domain Name

50 When registering a new domain name, the registrar will supply the following data:

• domain name;

• name server list;

• registrant contact details;

• administrative contact details;

• technical contact details;

• billing term.

Further details around the register data are contained in Appendix II.

51 The registrar may also include their own registrant customer ID to assist with reconciliation/customer management.

52 A basic level of validation will be applied to ensure that the domain name is available, that mandatory fields have been supplied, and that relevant fields have valid formats (e.g. domain name format, e-mail address format).

53 When a domain name is a moderated second-level domain name, the system will ensure that the registrar is authorised to register it.

54 A full copy of the domain name record will be returned to the registrar as confirmation, including the system-generated Unique Domain Authentication ID. The registrar is required to pass a copy of this record onto the registrant.

Registration Grace Period

55 A grace period of five days will be provided following a new registration to enable registrars to cancel the registration where they have made an error in the registration (e.g. - in the spelling of the domain name). Where the domain name is cancelled during the grace period, it will be removed from the register and will not be billed. The registration and cancellation will still be recorded for audit purposes.

56 A registrant will not be able to transfer the management of their domain name to another registrar during the grace period.

57 The registration grace period will be a fixed system parameter that will be modifiable by the registry.

Moderated Domains

58 The operating principles are:

• That approval for use of the moderated name occurs prior to the registrar registering the domain name in the register;

• The registry will not be involved in that approval process;

• Moderators will either need to establish themselves as a registrar or set up a relationship with a registrar(s);

• Moderators will be responsible for notifying the ccTLD Manager and the registry of their accredited registrar(s).

Maintaining a Domain Name

59 Registrars will be required to maintain the details of the domain names for which they are the registrar. They will be able to amend/update the following fields:

• Name Server List

• Registrant Contact Details

• Registrant Customer Id

• Administrative Contact Details

• Technical Contact Details

• Billing Term

60 The registrar will never be able to amend the actual domain name itself. If there has been an error in the spelling of a domain name, it will need to be cancelled and a new registration created.

61 Registrars will have considerable flexibility to run the amend/update function to suit the individual circumstance of each transaction. Updating will be on an individual field basis, including the ability to update sub-fields individually (e.g. Technical Contact E-mail Address), and they will be able to include as many fields as required in a single update transaction. By doing so, the opportunity is provided to fully replace all domain name details in a single transaction.

There will be two methods provided to define the scope of an update transaction.

• Apply the update to all domain names held by the registrar.

• Apply the update only to the domain name(s) indicated in the transaction.

62 A transfer of the domain name to a new registrant is handled by the registrar sending an amendment to the registrant name (and contact details and any other details as required). If the Registrant Name is updated in any way (for example, a change of surname only or a change in the spelling), a new Unique Domain Authentication ID will be generated by the register and notified to the registrar.

63 If a name server or IP address is updated, it is the registrar's responsibility to notify the name server manager. An e-mail address can usually be obtained by querying the name server itself.

64 A full copy of the new domain name record will be returned to the registrar as confirmation. This will occur even when the domain name record is updated by the registry

65 The registry will be able to update all fields which registrars can update, but this would only be used in extraordinary circumstances (for example - to give effect to a court order). In addition, the registry will be able to update all fields related to the status of the domain name or the billing of the domain name

Locking a Domain Name

66 The registry only will be provided with a facility to lock, and unlock, a domain name. Locked domain names will not be able to be updated, cancelled, re-instated, or released and their billing will be suspended while the lock is in place, except as a manual transaction by the registry.

67 There will be detailed rules governing the use of this functionality. It is intended for situations where a court (or other recognised authority) orders a "freeze" in respect of a domain name until a full hearing on the issue can be held.

Generating a New Unique Domain Authentication ID

68 A facility will be provided for registrars and the registry to generate a new Unique Domain Authentication ID at any time. The new ID will be notified to the registrar regardless of who initiated the process. This process will not be available for domain names that have been locked.

Changing Registrars

69 A registrant can approach another registrar to act for them at any time, except during the initial registration grace period. The gaining registrar will initiate a transaction to transfer a domain name from the current registrar to themselves, at the request of the registrant. This will result in a change to the Designated Registrar field.

70 Registrant authority is provided through the Unique Domain Authentication ID and other identification to confirm their identity.

71 Upon transfer, the losing registrar is notified immediately that the transfer has occurred, and the domain name is assigned a new Unique Domain Authentication ID, which is notified to the gaining registrar.

72 If, as the result of a transfer, other domain name details need changing (e.g. Name Server List, Registrant Customer ID, Administrative and Technical Contact Details), the registrar does this by initiating an update transaction in the standard manner. Industry standards need to be agreed around the losing registrar maintaining the domain name in their name server(s) for a specified period following a transfer (e.g. until the next zone push).

73 A domain name that is locked cannot be transferred except through a manual transaction undertaken by the registry.

Cancelling a Domain Name

74 Registrars will be able to cancel domain names on behalf of their registrants. Unlike the current system, domain names will not automatically lapse if they are not renewed. The registration has to be actively cancelled by the registrar.

75 Cancelled domain names will be assigned a status of 'pending release' and will not become available for reuse for a period of 90 days. Cancelled domain names, either pending release or released, will not be included in the next zone file pushed to the DNS.

76 Domain names that are locked cannot be cancelled.

77 If a renewed domain name is cancelled during the five day grace period, it will not be billed for the new term. This means registrars can keep domain names active until the very end of their term, allowing the registrar to cancel them within the grace period of the new term without being billed.

Re-instating a Cancelled Domain Name

78 During the 'pending release' period, the registrar will able to fully re-instate the domain name for the registrant, so that it becomes active again.

79 The billing process will be unaffected by the cancellation and any re-instatement. Although the domain name will not have been billed for the period that it was pending release, once it has been re-instated the billing process will generate 'catch-up' transactions, from the original cancellation date.

80 Domain names that have been locked while they have the status of 'pending release' cannot be re-instated by a registrar. If this was required, the registrar would need to contact the registry to do this as a manual transaction.

Register Queries

81 Registrars and the registry will be able to initiate a number of queries to the register, using XML-based transactions. All queries will gain their information from the register, not the DNS.

Whois Query Interface

82 This will give a registrar access to the XML transaction that services the public whois query. The query results returned will therefore be identical to those returned through the public query.

Availability Query

83 A query will be provided for registrars to query the availability of one or more domain names and receive a yes/no answer. A registrar could supply a list containing one or more domain names. The query results will have a yes/no answer associated with each domain name, indicating whether or not the domain name is available for registration at the current date and time.

General Register Query

84 For querying the domain names they administer, registrars will have access to a multi-purpose query with functionality and flexibility for a variety of different uses.

85 When initiated by the registry it will encompass the entire register. When initiated by a registrar, it will be limited to the domain names that are administered by that registrar.

86 Search criteria can be supplied for any register field, and any number of fields can be combined in a single query. The query will allow partial matching of field values using a commonly used method (e.g. * or %). If no fields are supplied, the query will return all records. Date fields will be searchable on either a 'from' or 'to' basis, or both if a range is required.

87 It will be possible to nominate, in each individual query, which fields are to be returned in the query results. This will enable registrars to tailor the amount of information being transferred to suit their own requirements. The system will default to providing all fields from the register.

88 An option will be provided for the query to provide a 'snapshot' of the register as at any point in time, indicated by a date supplied in the query. In doing so, the query results will look exactly the same as if the query had been executed at that time. The query will default to the current date and time.

89 An option will be provided to include a change history of the query along with the standard query results. The change history will include a summary of every transaction that occurred on a domain name prior to the query date and time, in reverse chronological order, and will include the date and time of the transaction and the user's ID.

90 The registry will be able to filter queries by registrar.

91 All queries will return the number of records retrieved, the query parameters, and the date and time of the query at the top of the query results.

92 Query results will be presented alphabetically by domain name.

The Billing Process

93 The domain name billing will be based on a monthly billing period. Registrars will be obliged to disclose the billing term arranged between a registrar and a registrant to the registry through the registration transaction, so they are billed for the same period that they have billed their registrants, on an individual domain name basis.

94 The extraction of billing details from the register will be performed on a daily basis. This will enable registrars to query their billing transaction items progressively during the month, receiving accurate, up to date information at any time.

95 A domain name's billing period will begin on its registration date, or renewal date, and extend for the number of monthly increments indicated by the billing term. Billing transactions will be generated as early as possible within a new billing period, normally on the first day. The billing extraction however will not occur until after the registration grace period (five days) for each billing term. If the domain name is cancelled during the grace period, it will not be billed.

96 Immediately following the billing of a domain name for a multiple number of months, the billing term will be re-set to one month. To continue billing the domain name for a multiple term at renewal, the registrar will have to set the billing term again, using the standard update process. This will prevent domain names which have been billed for a longer term being automatically renewed for the same term, before the registrar has determined the terms of the renewal, or even if a renewal is required.

97 In the event that a domain name is transferred one or more times during a billing period, the registrar that administered the domain name at the start of the period will be billed.

98 The billing extraction process will not generate credits. In the event that credits are required, these will be handled outside the register, through the registry's invoicing system.

99 Billing will not extend past the month in which a domain name was cancelled. If necessary, multiple billing transactions will be generated for a single domain name, to enable billing to 'catch up' to the current period.

100 The billing extraction process will not occur for domain names that have been locked. Once a domain name is unlocked, billing 'catch-up' transactions will be generated in the normal manner.

101 Billing details will be transmitted to an independent billing system as invoice line item transactions, in whatever interface format the billing system requires.

102 The invoice will contain summary transactions only for the period in question (e.g. 150 domain names at $n per name). The individual domain name transactions will be itemised with the invoice in the manner of an appendix.

103 For reconciliation purposes, a facility will be provided for registrars to download their billing transactions in text format, based on invoice number. These will be provided in XML format.

104 The interaction between the billing module and the register will be such that the billing status of a registrar will not directly affect the status of an individual domain name in the register.

105 Registrars will be provided with a facility to query their billing transactions at any time.

Notifications to Registrars

106 All automated notification messages to registrars will be handled through XML transactions.

107 When a transaction is received from a registrar, the register will either accept the transaction and perform the process or deny the transaction because an insufficient level of valid information has been provided. In both cases, the system will immediately advise the registrar of the success of the transaction or otherwise. Registrars will have the option to decide which messages (by type) they want to receive, which will enable them to reduce the amount of communication coming from the registry, should their own systems not require it.

108 Messages for registrars initiated by the registry will be queued (for example, a domain name has been transferred to another registrar). Registrars will then poll the queues for waiting messages at whatever frequency they desire.

Maintaining Registrar Details

109 Registrars will be provided with a facility enabling them to alter permissible details about themselves held by the registry (see Appendix II).

Registry Functionality

110 The registry will have full access to all processes in the system, including all those provided to registrars.

Transfer of Multiple Domain Names between Registrars

111 A batch transfer facility will be provided for use by the registry, for situations for example, where a registrar's business is sold to another authorised registrar. The registry will transfer all domain names managed by one registrar to another by changing the Designated Registrar field. Notification will be sent to both the losing and gaining registrars, itemising the transferred domain names. This process will not include domain names that have been locked. The registry will need to manually transfer any locked domain names.

112 After the transfer, the gaining registrar is required to update the domain name details as required (e.g. Name Server List, Administrative and Technical Contact Details). This will be handled by initiating an update process in the standard manner.

113 A new Unique Domain Authentication ID will be generated for each domain name and this will be included in the notification to the gaining registrar (but not the losing registrar).

Managing Cancelled Domain Names

114 An automated process will perform the housekeeping tasks necessary to manage cancelled domain names. This process will be capable of running as a scheduled job (possibly daily) or being initiated by the registry on an ad hoc basis.

115 The system will check all cancelled domain names that are pending release. If the domain name has passed out of its pending release period it will be released, thus becoming available for anyone else to register. Domain names that have been locked will not be released.

116 The pending release period will be a fixed system parameter that, although unlikely to change, will be modifiable by the registry.

117 When they are released, domain names will be removed from the register. In the unlikely event that a released domain name has not had its final billing (up to and including the month in which it was cancelled), the system will ensure that the billing is completed.

Administer Registrar Details

118 There will be some registrar details that only the registry can maintain. These include:

• creating new registrars in the system;

• allocating a new password to a registrar;

• updating registrar details.

119 The registry will use the security system to control registrar access to the various processes in the system.

120 Moderators of second-level domain names (2LDs) will designate the registrars that are permitted to register their 2LDs. No other registrars will be permitted to register these 2LDs.

Notice of Cancelled Registrar

121 The registry will be provided with a facility to automatically generate an e-mail message to all registrants belonging to a specified registrar, requesting the registrants to select a new registrar as their current registrar is no longer an authorised registrar. The text of the message will be supplied by the ccTLD Manager. Optionally, the system will generate a list of registrant mail address information for use by a mail-merge program. This will be in XML format.

Whois Query

Whois Web Query

122 A publicly available whois query will be provided through a web page to enable any person to inquire about a domain name. The query will ask the user to supply the full domain name and will only respond if there is an exact match.

123 The following details will be provided:

• Domain Name;

• Designated Registrar;

• Name Server List;

• Registrant Contact Details;

• Administrative Contact Details;

• Technical Contact Details;

• Registration status ;

• Date registered;

• Date registered until.

Whois Server Query

124 A whois query will be provided that meets the requirements of a stand-alone whois server, responding to a whois query initiated from a TCP based command line query.125 The whois server will be monitored to detect high transaction rates that might be the result of someone checking large numbers of domain names in a speculative manner.

DNS Push

126 The system will generate the same zone and configuration files for the Domain Name System as the current system. These will be produced on a regularly scheduled basis, currently twice daily.

127 Only registered domain names will be pushed to the DNS. This does not include names that have the status of 'pending release'.

Security and Access Control

128 The security for the system will conform to industry best practice standards current at the time of implementation, to secure the data in the register against damage, loss or unauthorised access. The main requirement is that of integrity, both of the data held in the register and who is able to access it.

129 The security system will enable the registry to grant or deny specific users (the registrars and the registry) access to specific processes. Each user will be authenticated before being granted access to a process. With the exception of whois queries, registrars will only be able to access domain name records for which they are the designated registrar.

Audit Trails

130 All changes to data in the register will be logged, date and time stamped and identify the entity (specific registrar, registry) responsible for the change.

131 The registry will be able to reproduce all details associated with a domain name at any specified point in time. This includes

• An inquiry about a domain name or registrar details;

• The full change history of any domain name or registrar, for a specified period.

132 All transaction records will be held in perpetuity. These transactions will be stored in their native XML format. An archiving process will be provided that breaks the log into separate files based on an appropriate time period.

133 All transaction formats will have an additional, optional, field for registrars to record whatever information is relevant to them for audit purposes. For example, a registrar might choose to record their own user ID for the staff member who issued the transaction. This field will not be stored in the register.

Activity Log

134 The system will keep statistics on all transactions made on the system, including all queries and changes to data. The statistics logged will include:

• the type of transaction;

• the identity of the user;

• the start date and time of the transaction;

• the end date and time of the transaction.

135 A facility will be provided for the registry to query the activity log, by supplying any combination of criteria over any of the fields.

136 A facility will be provided also to automatically notify the registry of activity recorded in the activity log that meets certain customisable parameters. For example, this would immediately highlight a situation where a registrar was 'spamming' the register, possibly denying other registrars normal levels of access.

5 Other

General Information

137 A range of information about .nz policies, the shared registry system, registrant rights, and domain names in general will be publicly available on the Internet. This will include:

• a list of all authorised registrars, with links to their home pages;

• a list of current second level moderators, including contact details;

• current policy about domain names in .nz, dispute resolution, etc;

• frequently asked questions;

• links to other relevant sites.

Software Development Kit

138 The registry will provide a software development kit, including sample code and technical specifications, to enable registrars to develop their interface with the register. Registrars however will be fully responsible for the effectiveness, efficiency, accuracy, and operation of their own interface.

139 A test environment will be provided for registrars to test their interface.

Migration

140 There will be significant transition issues to work through, particularly relating to the transfer of domain names to authorised registrars.

141 As much as possible, migration will be a staged process. Registrars will be migrated to the new system at sufficient intervals to ensure the smooth running of the registry and the DNS, in a manner that minimises disruption to all parties.

Appendix I

The Key Entities in the .nz Domain Name Space

InternetNZ

The Internet Society of New Zealand Incorporated is the organisation authorised by the Internet Assigned Numbers Authority to manage the .nz domain name space. InternetNZ will establish an Office of the ccTLD Manager to oversee the management of the .nz domain name space.

Registrar

An entity that registers domain names with the registry on behalf of registrants (e.g. an Internet Service Provider). The registration of domain names is seldom the core business of a registrar.

Registrant

An entity that is allocated a domain name registered to them within the .nz name space. The registrant is currently called the name holder. Registrants are the ultimate customers of the SRS.

Registry

The organisation holding and operating the register, including the transfer to the zone files. Its operation is a natural monopoly.

Register

The central database of information about the .nz domain name space. The register is the authoritative source for the creation of the primary zone files for .nz.

The register is required to hold sufficient information about each domain name for the following purposes:

• to record a registrant's right to use a domain name, the current status of the domain name, and the 'registered until' date;

• to protect a registrant's right to use a domain name by recording sufficient registrant contact information to determine the true registrant;

• to hold sufficient information to properly update the Domain Name System.

Domain Name System

The Domain Name System (DNS) is the system used by the Internet to translate domain names such as isocnz.org.nz into network addresses that allow one computer to connect to another.

Moderators

An individual or organisation that has been appointed by a community of interest to consider all requests for domain names in their domain and accept or reject them according to the policies for that second level domain. There are moderators in place for the following moderated second level domains in .nz - .cri; .govt; .mil; .iwi.

Office of the ccTLD Manager

The ccTLD manager has the following key functions:

• Maintaining the policy and information for .nz domain name management. This includes recommending changes to existing policies/new policies and proposing the pricing policy for domain names on the .nz register;

• Contracting for registry services;

• Establishing and maintaining contracts with registrars;

• Running the process for the creation of new second level domain names and appointing moderators for moderated second level domains;

• Facilitating effective decision-making/information flows amongst key stakeholders through running/servicing the Registry-Registrar Committee;

• Monitoring of and influencing international developments in relation to the management of the DNS, in so far as they may impact on the .nz domain name space;

• Future strategy and options for .nz name space.

The Office may also have a role in a domain name disputes resolution procedure to be put in place for .nz.

 Appendix II

Registry Data

Contact Details

Registrar Details

The following information will be held about each registrar.