.secure Pre-Register Domain - .secure Domain Information

The mission of .Secure is to enable people to navigate the Internet with safety and confidence. This safety will be insured through a combination of operational excellence, a culture of continuous security improvement and technical innovation.

Unlike other gTLDs, .Secure is not a category. It is an expression of a user's intent. Our goal is to honor a user's request to browse safely without bombarding them with obtuse technical language, making them look for subtle user interface clues or asking them questions they are not qualified to answer.

Here are three examples of situations that will be safer with .Secure:

- A woman in Kenya receives an SMS message regarding her online payments balance. The limited screen space of her phone makes it difficult for her to trust a link in a text message, so she types in the .Secure address of her provider to guarantee that she is communicating with the intended party.
- A political activist is trying to access a social network and check in with his friends. There have been rumors of widespread monitoring of social network activity and possible repercussions based upon private messages, but he feels confident that while using the .Secure address his traffic will not be hijacked and monitored.
- A business executive in Singapore receives a confidential message from an accountant in Tokyo. She is pleased to see that her vendor sent the sensitive spreadsheet from a .Secure domain to her .secure email address, so she knows that it was encrypted in transit.

How does .Secure provide these individuals with confidence to go about their business online? Through three principals: Verify, Secure and Enforce.

Verify - The .Secure registry will require registrants to submit identity documentation and will perform a human-powered verification and search for related IP rights. There will be multiple levels of validation for commercial, non-profit and personal domains, and the verified identity of the owner will be available to the end-user via innovations described herein.

Secure - All registrants will be required to agree to a code of conduct and to live up to substantial security standards for services offered under the .Secure namespace. These standards will, at a minimum, include mandatory DNSSEC signing of their zone, the use of TLS for all HTTP sessions, DKIM signing and required TLS for SMTP transport.

Enforce - The .Secure Registry will continuously scan sub-domains for compliance with our security standards, as well as for violations of our Code of Conduct. Such violations would include the hosting of malware or phishing sites, and the Registry team will swiftly respond to violations and abuse complaints.

Internet users will immediately benefit from the identity verification and Code of Conduct enforcement, with additional security benefits appearing as software vendors adopt our technical innovations. To foster such innovation we are working with leading technology firms to form the Domain Policy Working Group (DPWG): an open, non-profit organization that will coordinate security protections between gTLD registries, Internet software providers and domain end-users. The DPWG will create a suite of new security standards for submission to the IETF.

The DPWG's first standard will be the DPF, Domain Policy Framework, a DNS-based language that describes the security posture of a domain and provides the verified identity of the domain holder. Combined with DNSSEC and DANE, DPF could allow for any TLD registry to secure communication with its registrant customers and optionally enforce a minimum standard for sub-domains. DPF will also contain a mechanism for communicating the verified identity of a domain registrant. The website of the Domain Policy Working Group is available at http://www.domainpolicy.org.

The .Secure registry will be operated by Artemis Internet Inc., a subsidiary of NCC Group plc. The NCC Group is an international provider of security and software escrow services, and is trusted to solve the security problems of many of the world's most selective enterprises. The technological and financial strength of NCC Group will be a key component of establishing the trustworthiness of the .Secure brand. More information about the NCC Group is available at http://www.nccgroup.com, and updates on Artemis and the .Secure registry will be available at http://www.artemis.net.

i. Service Level and Reputation

The goal of .Secure is to create a safe, dependable mechanism for end-users to operate on the Internet. As we stated in 18a, .Secure focuses on honoring users' intention to safely access any service, so individuals, organizations and corporations of any size and in any industry will be allowed to register under .secure. All registrants will need to comply with our Security and Code of Conduct policies. Continuous automated and manual enforcement of these policies will help cement .Secure's reputation as a trustworthy TLD for businesses to host critical services that users feel safe visiting.

Our goal of serving the most important applications and brands on the Internet requires us to provide a level of customer service and reliability well above other gTLDs. This is why we very carefully selected a premier registry services provider, ARI, and why we are supplementing their already excellent capabilities with our own customer service staff and redundant systems.

ii. Differentiation

Our .Secure offering will create a trustworthy portion of the namespace for corporations, non-profits and individuals who care about the security of their online transactions. We will have significant differentiation from other gTLDs based upon our unique and rigorous authentication procedures, our meaningful security standards, and our ongoing enforcement program. We will also be technically innovative, openly collaborating to develop and deploy new standards. While we intend to be the safest and most secure gTLD on the Internet, we are also striving to improve security for all users and gTLDs via our technical leadership.

The three core principals of .Secure are Verify, Secure and Enforce. These principals differentiate our offering in these ways:

Verify- Unlike the vast majority of new gTLDs, .Secure will require the submission of verifiable documentation as to the identity of a Registrant, and every domain will be examined and approved by a human expert. The creation of a trustworthy namespace will set .Secure apart from other TLD options.

Secure- We are building ground-breaking technology with the help of major software developers and web properties. .Secure will differentiate itself by being an early user of this technology and the enforcement of security standards on all registrants, but we hope that our open standards will be adopted by other TLDs to improve security across the Internet.

Enforce- The .Secure gTLD will be unique for running a continuous automated enforcement program that detects and scans subdomains for violations of our security or acceptable use policies. Enforcement actions will be undertaken by human domain abuse experts, and will range from increasingly urgent notifications to suspension of domain resolution.

iii. User Experience

Our goal is to provide effortless security to end-users. Securely using the Internet currently requires constant vigilance and a significant amount of technical knowledge. How many end users send sensitive data without the protection of a securely configured HTTPS connection? How many click through the various warning presented to them by their browser? How many install email encryption software and then distribute their keys to their friends?

We aim to give users effortless security. The user only needs to type .Secure after their intended address to insure that their software knows that they wish to utilize optimal protections during their session.

The new gTLD process provides us with a novel opportunity to create a portion of the Internet that requires the most secure configurations and technologies. We intend our .Secure domain to be the leader in this space, although our goal is to work through the Domain Policy Working Group to help secure other new gTLDs and to create technologies that provide these security upgrades to all namespaces.

iv. Registration Policies

Our registration process will be based upon the standard domain and EPP lifecycle. We will use existing EPP and SRS facilities, such as the ServerHOLD state, to delay activation (DNS resolution) of purchased domains while our identity verification procedures are executed. The initial registration steps of finding and purchasing a domain will be equivalent to other gTLDs. We will offer registrants differentiated validation levels based upon their intended use of the domain, and they will be required to upload documentation appropriate to their domain type. Artemis staff will then validate the documents and measure the application against the .Secure registration policy, effectively guarding against typo-squatters and trademark infringement.

RESERVED NAMES

The following classes of domain names will not be available to registrants at Sunrise, Landrush or subsequent periods:

- Classes and groups of names listed in Specification 5 of the new gTLD Registry Agreement.
- Geographic names, also described in Specification 5 as detailed in Q22 and mentioned in Q21.
- Following past gTLD practices, .Secure will reserve its own name, registry operations names and variations of each (i.e. nic.secure, and registry.secure). These will redirect to our website or will be used to support related registry infrastructure services.
- ICANN and Internet standards bodies will have domains related to them reserved in the .Secure namespace. These bodies may request use of these reservations by following a request process we will make publically available at a later date.

The .Secure reserved name list will be published to the general public at least 30 days prior to the start of our Sunrise period to inform registrars, potential registrants and interested end-users.

PREMIUM NAMES:

- The .Secure Registry will also designate a set of "premium names," which will be set aside for distribution via special mechanisms. Premium names have been a standard feature of gTLD and ccTLD rollouts since 2005. The list of premium names will be published publicly before the Sunrise period begins, so that registrars and potential registrants will know which names have been set aside.

- .Secure will distribute names in a transparent and ethical manner. To this end we will create and enforce ethical distribution policies and procedures. For example, in the case of distribution by auction, insiders (defined as employees and contractors) will be prohibited from participating.

- In Q.29 we discuss rights protection measures at length. .Secure intends to extend it's use of the Trademark Claims Service to notify mark holders of matching registrations not only through the Sunrise and Landrush periods, but also throughout General Availability.

DISPUTE RESOLUTION MECHANISMS:

As required by ICANN and in support of the mission of .Secure we provide several transparent dispute mechanisms to address claims for .Secure domain names. These include:
- We will offer a specific Sunrise Dispute Policy. This dispute procedure will be active during the Sunrise Period for the protection of qualified trademark holders. This is detailed in Question 29.
- We will support the Uniform Dispute Resolution Policy (UDRP) as required by ICANN. This is detailed in Question 29.
- We will comply with the URS specifications in Applicant Guidebook Module 5 to offer a Universal Rapid Suspension service. This is detailed in Question 29.
- Our service provider ARI has provisioned systems to take in and administrate cases as required in ICANN's Registrar Transfer Dispute Resolutions Policy. We detail this in Question 28.

v. Privacy

One of the key goals of .Secure is to improve the safety of end-users data on the Internet. .Secure domains will be required to adhere to a strict code of conduct that will include industry leading privacy and disclosure requirements. The ubiquitous use of security technologies by .Secure registrants will reduce the risk of privacy breaches by unauthorized access, and our validation requirements and swift action on abuse complaints will help weed out scammers and other malicious actors bent on leveraging a user's private information for economic gain.

Where required by local law, .Secure will support related and required privacy measures in the display and release of registry related data.

In respect of Article 2.17 in the new gTLD Registry Agreement, our registrars will be required to gain the permission of each registrant for the collection and use of Personal Data as required by the registry. Required uses of data include the publishing of said data in Whois and sharing of such data with outside parties, as required by our contract with ICANN or by lawful order. We will notify the registrars of any intended change to any policies relating the use of this Personal Data.

i. Resolving Multiple Registrants

The .Secure domain will run Sunrise and Landrush periods before general availability to manage conflicts over trademarked and generic terms. These periods are described in detail in the answer to Question 28.

One of the fundamental precepts of the .Secure gTLD is the idea of verified identity. Trademark holders and holders of existing gTLD domains will be allowed to apply for those domains during the 30 day Sunrise period for no additional cost above normal registration fees. A subsequent 14 day landrush period will conclude with auctions for contested generic names. All applicants for Sunrise and Landrush domains will need to submit their verification details and operate their sites in compliance with our security and acceptable use policies.

Registration Phases:

Phase 1 (Sunrise): Operated for a limited scheduled time period preceding Landrush and General Availability (30 days).

Through our Sunrise Policy we will offer a single, 30-day Sunrise round. Trademark holders satisfying (i), (iii) and (iv) of the Sunrise Eligibility requirements (SERs) and any general eligibility requirements (as identified in our response to Question 18) proposed in the Applicant Guidebook at Trademark Clearinghouse s6.2.3 will be eligible to apply for a domain name. Our Sunrise Policy will specify that applications satisfying the SERs received by a Registrar within the 30-day sunrise period will be accepted for participation in the sunrise. This will be the first opportunity for registration in our TLD.

Our Sunrise Policy will mandate that the trademarks upon which sunrise applications are based must fall within s7.2 of the Applicant Guidebook (Trademark Clearinghouse), be supported by an entry in the TMCH, or registered with a trademark authority/database of national effect. Additional acceptable qualifying Intellectual Property for Sunrise applications may also include exact match legacy domain registrations in existing gTLDs prior to a certain cutoff date.

Allocation will start at the end of the 30-day Sunrise period. Where only one validated application is received for a domain name, that domain will be allocated to the applicant during the period between the close of the Sunrise applications period and start of the Landrush. Where multiple validated applications are received for the same domain name applicants will be invited to participate in an auction to determine the party to which the domain will be allocated.

Phase 2 (Land Rush): Operated during a scheduled time period preceding General Availability (21 days).

Application will be open during Sunrise to all potential registrants who commit to conformance with the .secure Acceptable Use Policy and RRA. .Secure will accept applications for 21 days and begin processing them at the end of the Landrush period. Allocation will start at the end of the 21-day landrush period. Where multiple validated applications are received for a domain name, applicants will be invited to participate in an auction to determine the party to which the domain will be allocated.

Phase 3 (General Availability):

We believe sufficient opportunity will have been provided to IP holders upon completion if the sunrise and land rush periods and their associated ʺquietʺ or ʺprocessing periodsʺ. We also believe Landrush has a cooling effect on speculators, and we also note the operating requirements of .Secure for registrants are themselves a powerful deterrent to speculative registration. We will now begin live registrations on a first come, first serve basis in General Availability.

ii. Cost Benefits

A critical component of consumer acceptance of .Secure will be encouraging registrants to go live soon after obtaining their domain. To encourage this behavior we plan to run a pioneer program to encourage major brands to take their sites live on .Secure. This program will offer discounts on long-term registration in return for a promise to launch a fully functional consumer experience under the .Secure domain within six months of delegation. Additional discounts and offers will be discussed and considered with Registrar partners after the application period closes.

iii. Price Increases

Our current financial model is intended to cover expected operating costs for several years without price increases. Although we have no plans for a price change in the foreseeable future, we do understand the market can be unpredictable. Hence, we intend to respect and allow the open market to help us determine any pricing changes, if and when they are needed.

We have engaged ARI Registry Services (ARI) to deliver services for this TLD. This response describes protection of geographic names as implemented by ARI.

1 PROTECTION OF GEOGRAPHIC NAMES

In accordance with Specification 5 of the New gTLD Registry Agreement, the registry operator must initially reserve all geographic names at the second level, and at all other levels within the TLD at which the registry operator provides for registrations.

ARI supports this requirement by using the following internationally recognized lists to develop a comprehensive master list of all geographic names that are initially reserved:
- The 2-letter alpha-2 code of all country and territory names contained on the ISO 3166-1 list, including all reserved and unassigned codes [http://www.iso.org/iso/support/country_codes/iso_3166_code_lists/iso-3166-1_decoding_table.htm].
- The short form (in English) of all country and territory names contained on the ISO 3166-1 list, including the European Union, which is exceptionally reserved on the ISO 3166-1 List, and its scope extended in August 1999 to any application needing to represent the name European Union [http://www.iso.org/iso/support/country_codes/iso_3166_code_lists/iso-3166-1_decoding_table.htm#EU].
- The United Nations Group of Experts on Geographical Names, Technical Reference Manual for the Standardization of Geographical Names, Part III Names of Countries of the World. This lists the names of 193 independent States generally recognized by the international community in the language or languages used in an official capacity within each country and is current as of August 2006 [http://unstats.un.org/unsd/geoinfo/ungegn%20tech%20ref%20manual_M87_combined.pdf].
- The list of UN member states in six official UN languages prepared by the Working Group on Country Names of the United Nations Conference on the standardization of Geographical Names [http://unstats.un.org/unsd/geoinfo/UNGEGN/docs/9th-uncsgn-docs/econf/9th_UNCSGN_e-conf-98-89-add1.pdf].

Names on this reserved list in ARI's registry system are prevented from registration.

A corresponding list of geographic names will also be available to the public via the registry operators website, to inform Registrars and potential registrants of reserved names. The lists noted above, are regularly monitored for revisions, therefore the reserved list (both within the registry and publicly facing) will be continually updated to reflect any changes.

In addition to these requirements, ARI are able to support the wishes of the Governmental Advisory Council (GAC) or any individual Government in regard to the blocking of individual terms on a case by case basis. ARI's registry system allows such additions to be made by appropriately authorized staff, with no further system development changes required.

The following applies to all Domain Names contained within the registry's reserved list:
- Attempts to register listed Domain Names will be rejected.
- WhoIs queries for listed Domain Names will receive responses indicating their reserved status.
- Reserved geographic names will not appear in the TLD zone file.
- DNS queries for reserved domain names will result in an NXDOMAIN response.

2 PROCEDURES FOR RELEASE

We understand that if we wish to release the reserved names at a later date, this will require agreement from the relevant government(s) or review by the GAC, and subsequent approval from ICANN.