Each Registry Operator will receive authentication credentials from the TMDB to be used:
-
during the Sunrise Period to fetch the SMD Revocation List from the TMDB via the sy interface (Section 4.3.11),
-
during the Trademark Claims Period to fetch the DNL List from the TMDB via the dy interface (Section 4.3.3), and
-
during the NORDN process to notify the LORDN to the TMDB via the yd interface (Section 4.3.7).
Note: Credentials are created per TLD and provided to the Registry Operator.
Each Registry Operator
MUST provide the TMDB with all IP addresses, which will be used to:
-
fetch the SMD Revocation List via the sy interface (Section 4.3.11),
-
fetch the DNL List from the TMDB via the dy interface (Section 4.3.3), and
-
upload the LORDN to the TMDB via the yd interface (Section 4.3.7).
This access restriction
MAY be applied by the TMDB in addition to HTTP Basic access authentication (see [
RFC 7617]). For credentials to be used, see
Section 5.1.1.1.
The TMDB
MAY limit the number of IP addresses to be accepted per Registry Operator.
Each Registry Operator
MUST fetch the PKIX certificate [
RFC 5280] of the ICANN TMCH-CA (Trust Anchor) from <
https://ca.icann.org/tmch.crt> to be used:
-
during the Sunrise Period to validate the TMV certificates and the TMV CRL.
The TMDB
MUST provide each Registry Operator with the public portion of the PGP Key used by the TMDB, which is to be used:
-
during the Sunrise Period to perform integrity checking of the SMD Revocation List fetched from the TMDB via the sy interface (Section 4.3.11) and
-
during the Trademark Claims Period to perform integrity checking of the DNL List fetched from the TMDB via the dy interface (Section 4.3.3).
Each ICANN-Accredited Registrar will receive authentication credentials from the TMDB to be used:
-
during the Sunrise Period to (optionally) fetch the SMD Revocation List from the TMDB via the sr interface (Section 4.3.12) and
-
during the Trademark Claims Period to fetch TCNs from the TMDB via the dr interface (Section 4.3.6).
Each Registrar
MUST provide the TMDB with all IP addresses, which will be used to:
This access restriction
MAY be applied by the TMDB in addition to HTTP Basic access authentication (for credentials to be used, see
Section 5.1.2.1).
The TMDB
MAY limit the number of IP addresses to be accepted per Registrar.
Registrars
MAY fetch the PKIX certificate of the ICANN TMCH-CA (Trust Anchor) from <
https://ca.icann.org/tmch.crt> to be used:
-
during the Sunrise Period to (optionally) validate the TMV certificates and TMV CRL.
Registrars
MUST receive the public portion of the PGP Key used by TMDB from the TMDB administrator to be used:
-
during the Sunrise Period to (optionally) perform integrity checking of the SMD Revocation List fetched from the TMDB via the sr interface (Section 4.3.12).
.------------. .-----------. .----------.
| Registrant | | Registrar | | Registry |
'------------' '-----------' '----------'
| | |
| Request DN | |
| registration | |
| (with SMD) | |
|---------------->| Check DN availability |
| |---------------------------->|
| | |
| | DN unavailable .-------------.
| DN unavailable |<--------------------( DN available? )
|<----------------| no '-------------'
| | | yes
| | DN available |
| |<----------------------------|
| | |
| | Request DN registration |
| | (with SMD) |
| |---------------------------->|
| | |
| | .------------------------------.
| | | DN registration validation / |
| | | SMD validation |
| | '------------------------------'
| | |
| Registration |.-----------. Error .----------------------.
| error || TRY AGAIN |<-----( Validation successful? )
|<----------------|| / ABORT | no '----------------------'
| |'-----------' | yes
| | |
| | DN registered |
| DN registered |<----------------------------|
|<----------------| |
| | |
Figure 3 represents a synchronous DN registration workflow (usually called first come first served).
Registries
MUST perform a minimum set of checks for verifying each DN registration during the Sunrise Period upon reception of a registration request over the ry interface (
Section 4.3.5). If any of these checks fail, the Registry
MUST abort the registration. Each of these checks
MUST be performed before the DN is effectively allocated.
In case of asynchronous registrations (e.g., auctions), the minimum set of checks
MAY be performed when creating the intermediate object (e.g., a DN application) used for DN registration. If the minimum set of checks is performed when creating the intermediate object (e.g., a DN application), a Registry
MAY effectively allocate the DN without performing the minimum set of checks again.
Performing the minimum set of checks, Registries
MUST verify that:
-
an SMD has been received from the Registrar, along with the DN registration,
-
the certificate of the TMV has been correctly signed by the ICANN TMCH-CA (the certificate of the TMV is contained within the SMD),
-
the datetime when the validation is done is within the validity period of the TMV certificate,
-
the certificate of the TMV is not listed in the TMV CRL file specified in the CRL distribution point of the TMV certificate,
-
the signature of the SMD (signed with the TMV certificate) is valid,
-
the datetime when the validation is done is within the validity period of the SMD based on <smd:notBefore> and <smd:notAfter> elements,
-
the SMD has not been revoked, i.e., is not contained in the SMD Revocation List, and
-
the leftmost DNL of the DN being effectively allocated matches one of the label (<mark:label>) elements in the SMD. For example, if the DN "xn--mgbachtv.xn--mgbh0fb" is being effectively allocated, the leftmost DNL would be "xn--mgbachtv".
These procedures apply to all DN effective allocations at the second level, as well as to all other levels subordinate to the TLD that the Registry accepts registrations for.
A new SMD Revocation List
MUST be published by the TMDB twice a day, by 00:00:00 and 12:00:00 UTC.
Registries
MUST refresh the latest version of the SMD Revocation List at least once every 24 hours.
Note: The SMD Revocation List will be the same regardless of the TLD. If a Backend Registry Operator manages the infrastructure of several TLDs, the Backend Registry Operator could refresh the SMD Revocation List once every 24 hours, and the SMD Revocation List could be used for all the TLDs managed by the Backend Registry Operator.
.----------. .------.
| Registry | | TMDB |
'----------' '------'
| |
.----------------. |
| Periodically, | |
| at least | |
| every 24 hours | |
'----------------' |
| |
|----------------------------------------------------->|
| Download the latest SMD Revocation List |
|<-----------------------------------------------------|
| |
| |
Figure 4 depicts the process of downloading the latest SMD Revocation List initiated by the Registry.
Registries
MUST refresh their local copy of the TMV CRL file at least once every 24 hours using the CRL distribution point specified in the TMV certificate.
Operationally, the TMV CRL file and CRL distribution point are the same for all TMVs and (at publication of this document) are located at <
http://crl.icann.org/tmch.crl>.
Note: The TMV CRL file will be the same regardless of the TLD. If a Backend Registry Operator manages the infrastructure of several TLDs, the Backend Registry Operator could refresh the TMV CRL file once every 24 hours, and the TMV CRL file could be used for all the TLDs managed by the Backend Registry Operator.
.----------. .---------------.
| Registry | | ICANN TMCH-CA |
'----------' '---------------'
| |
.----------------. |
| Periodically, | |
| at least | |
| every 24 hours | |
'----------------' |
| |
|-------------------------------------------->|
| Download the latest TMV CRL file |
|<--------------------------------------------|
| |
| |
Figure 5 depicts the process of downloading the latest TMV CRL file initiated by the Registry.
The Registry
MUST send a LORDN file containing DNs effectively allocated to the TMDB (over the yd interface; see
Section 4.3.7).
The effective allocation of a DN
MUST be reported by the Registry to the TMDB within 26 hours of the effective allocation of such DN.
The Registry
MUST create and upload a LORDN file in case there are effective allocations in the SRS that have not been successfully reported to the TMDB in a previous LORDN file.
Based on the timers used by TMVs and the TMDB, the
RECOMMENDED maximum frequency to upload LORDN files from the Registries to the TMDB is every 3 hours.
It is
RECOMMENDED that Registries try to upload at least two LORDN files per day to the TMDB, with enough time in between, in order to have time to fix problems reported in the LORDN file.
The Registry
SHOULD upload a LORDN file only when the previous LORDN file has been processed by the TMDB and the related LORDN Log file has been downloaded and processed by the Registry.
The Registry
MUST upload LORDN files for DNs that are effectively allocated during the Sunrise or Trademark Claims Periods (same applies to DNs that are effectively allocated using applications created during the Sunrise or Trademark Claims Periods in case of using asynchronous registrations).
The yd interface (
Section 4.3.7)
MUST support at least one (1) and
MAY support up to ten (10) concurrent connections from each IP address registered by a Registry Operator to access the service.
The TMDB
MUST process each uploaded LORDN file and make the related log file available for Registry download within 30 minutes of the finalization of the upload.
.----------. .------. .-----. .-----.
| Registry | | TMDB | | TMV | | TMH |
'----------' '------' '-----' '-----'
| | | |
.------------------. | | |
| Periodically | | | |
| upload LORDN | | | |
| file | | | |
'------------------' | | |
| | | |
.--------->| Upload LORDN | | |
| |-------------------->| | |
| | | | |
| | .-------------------------. | |
| | | Verify each domain name | | |
| | | in the uploaded file | | |
| | | (within 30') | | |
| | '-------------------------' | |
| | | ._____.| |
| | Download Log file | | END || |
| |<--------------------| '-----'| |
| | | ^ | |
| .-----------------. .---------------. | | |
| | Check whether | / everything fine \ no | | |
| | Log file | ( (i.e., no errors )---' | |
| | contains errors | \ in Log file )? / | |
| '-----------------' '---------------' | |
| | | yes | |
| .---------------. | | |
| / everything fine \ yes | | |
|( (i.e., no errors )-----. | Notify TMVs | |
| \ in Log file )? / | | on the LORDN | |
| '---------------' | | pre-registered | |
| | no v | with said TMV | |
| .----------------. .------. |--------------->| |
'-| Correct Errors | | DONE | | | |
'----------------' '------' | | Notify each |
| | | affected TMH |
| | |-------------->|
| | | |
Figure 6 depicts the process to notify the TMH of Registered Domain Names.
The format used for the LORDN is described in
Section 6.3.
Registrars
MAY choose to perform the checks for verifying DN registrations, as performed by the Registries (see
Section 5.2.2) before sending the command to register a DN.
The processes described in Sections [
5.2.3.1] and [
5.2.3.2] are also available for Registrars to optionally validate the SMDs received.
.------------. .-----------. .----------. .------.
| Registrant | | Registrar | | Registry | | TMDB |
'------------' '-----------' '----------' '------'
| Request DN | | |
| registration | | |
|--------------->| Check DN availability | |
| |--------------------------->| |
| | DN unavailable .-------------. |
| DN unavailable |<-------------------( DN available? ) |
|<---------------| no '-------------' |
| | DN available | yes |
| |<---------------------------| |
| | Request lookup key | |
| |--------------------------->| |
| |.__________. .---------. |
| || CONTINUE | / Does DN \ |
| || NORMALLY |<--------( match DNL ) |
| |'----------' no \ of PRM? / |
| | '---------' |
| | Lookup key | yes |
| |<----------------------------' |
| | |
.-----. | | Request TCN |
|ABORT| | Display |---------------------------------------->|
'-----' | Claims | Return TCN |
^ | Notice |<----------------------------------------|
| no |<---------------| |
| .------. yes | |
'-( Ack? )----------->| Register DN (with TCNID) | |
'------' |--------------------------->| |
| Registration | Error .----------------------. |
| error |<-------------( Validation successful? ) |
|<---------------| no '----------------------' |
| | | yes |
| | DN registered | |
| DN registered |<---------------------------| |
|<---------------| | |
Figure 7 represents a synchronous DN registration workflow (usually called first come first served).
During the Trademark Claims Period, Registries perform two main functions:
-
Registries MUST provide Registrars (over the ry interface; see Section 4.3.5) the lookup key used to retrieve the TCNs for DNs that match the DNL List.
-
Registries MUST provide the lookup key only when queried about a specific DN.
In the following instances, a minimum set of checks are described:
-
For each DN matching a DNL of a PRM, Registries MUST perform a minimum set of checks for verifying DN registrations during the Trademark Claims Period upon reception of a registration request over the ry interface (Section 4.3.5). If any of these checks fail, the Registry MUST abort the registration. Each of these checks MUST be performed before the DN is effectively allocated.
-
In case of asynchronous registrations (e.g., auctions), the minimum set of checks MAY be performed when creating the intermediate object (e.g., a DN application) used for DN effective allocation. If the minimum set of checks is performed when creating the intermediate object (e.g., a DN application), a Registry MAY effectively allocate the DN without performing the minimum set of checks again.
-
Performing the minimum set of checks, Registries MUST verify that:
-
The TCNID (<tmNotice:id>), expiration datetime (<tmNotice:notAfter>), and acceptance datetime of the TCN have been received from the Registrar, along with the DN registration.
If the three elements mentioned above are not provided by the Registrar for a DN matching a DNL of a PRM, but the DNL was inserted (or reinserted) for the first time into the DNL List less than 24 hours ago, the registration MAY continue without this data, and the tests listed below are not required to be performed.
-
The TCN has not expired (according to the expiration datetime sent by the Registrar).
-
The acceptance datetime is within the window of time defined by ICANN policy. In the gTLD round of 2012, Registrars verified that the acceptance datetime was less than or equal to 48 hours in the past, as there were no defined ICANN policies at that time. Implementers should be aware that ICANN policy may define this value in the future.
-
The TCN Checksum is computed using the leftmost DNL of the DN being effectively allocated, the expiration datetime provided by the Registrar, and the TMDB Notice Identifier extracted from the TCNID provided by the Registrar. Verify that the computed TCN Checksum matches the TCN Checksum present in the TCNID. For example, if the DN "xn--mgbachtv.xn--mgbh0fb" is being effectively allocated, the leftmost DNL would be "xn--mgbachtv".
These procedures apply to all DN registrations at the second level, as well as to all other levels subordinate to the TLD that the Registry accepts registrations for.
A new DNL List
MUST be published by the TMDB twice a day, by 00:00:00 and 12:00:00 UTC.
Registries
MUST refresh the latest version of the DNL List at least once every 24 hours.
.----------. .------.
| Registry | | TMDB |
'----------' '------'
| |
.----------------. |
| Periodically, | |
| at least | |
| every 24 hours | |
'----------------' |
| |
|-------------------------------->|
| Download the latest DNL List |
|<--------------------------------|
| |
| |
Figure 8 depicts the process of downloading the latest DNL List initiated by the Registry.
Note: The DNL List will be the same regardless of the TLD. If a Backend Registry Operator manages the infrastructure of several TLDs, the Backend Registry Operator could refresh the DNL List once every 24 hours, and the DNL List could be used for all the TLDs managed by the Backend Registry Operator.
The NORDN process during the Trademark Claims Period is almost the same as during the Sunrise Period, as defined in
Section 5.2.3.3; the difference is that only registrations subject to a Trademark Claim (i.e., at registration time, the name appeared in the current DNL List downloaded by the Registry Operator) are included in the LORDN.
For each DN matching a DNL of a PRM, Registrars
MUST perform the following steps:
-
Use the lookup key received from the Registry to obtain the TCN from the TMDB using the dr interface (Section 4.3.6). Registrars MUST only query for the lookup key of a DN that is available for registration.
-
Present the TCN to the Registrant, as described in Exhibit A of [RPM-Requirements].
-
Ask the Registrant for acknowledgement, i.e., the Registrant MUST consent with the TCN, before any further processing. (The transmission of a TCNID to the Registry over the ry interface (Section 4.3.5) implies that the Registrant has expressed their consent with the TCN.)
-
Perform the minimum set of checks for verifying DN registrations. If any of these checks fail, the Registrar MUST abort the DN registration. Each of these checks MUST be performed before the registration is sent to the Registry. Performing the minimum set of checks, Registrars MUST verify the following:
-
The datetime when the validation is done is within the TCN validity based on the <tmNotice:notBefore> and <tmNotice:notAfter> elements.
-
The leftmost DNL of the DN being effectively allocated matches the label (<tmNotice:label>) element in the TCN. For example, if the DN "xn--mgbachtv.xn--mgbh0fb" is being effectively allocated, the leftmost DNL would be "xn--mgbachtv".
-
The Registrant has acknowledged (expressed their consent with) the TCN.
-
Record the date and time when the registrant acknowledged the TCN.
-
Send the registration to the Registry (via the ry interface; see Section 4.3.5) and include the following information:
-
TCNID (<tmNotice:id>)
-
Expiration date of the TCN (<tmNotice:notAfter>)
-
Acceptance datetime of the TCN
Currently, TCNs are generated twice a day by the TMDB. The expiration date (<tmNotice:notAfter>) of each TCN
MUST be set to a value defined by ICANN policy. In the gTLD round of 2012, the TMDB set the expiration value to 48 hours into the future, as there were no defined ICANN policies at that time. Implementers should be aware that ICANN policy may define this value in the future.
Registrars
SHOULD implement a cache of TCNs to minimize the number of queries sent to the TMDB. A cached TCN
MUST be removed from the cache after the expiration date of the TCN, as defined by <tmNotice:notAfter>.
The TMDB
MAY implement rate limiting as one of the protection mechanisms to mitigate the risk of performance degradation.
The TCNs are provided by the TMDB online and are fetched by the Registrar via the dr interface (
Section 4.3.6).
To get access to the TCNs, the Registrar needs the credentials provided by the TMDB (
Section 5.1.2.1) and the lookup key received from the Registry via the ry interface (
Section 4.3.5). The dr interface (
Section 4.3.6) uses HTTPS with Basic access authentication.
The dr interface (
Section 4.3.6)
MAY support up to ten (10) concurrent connections from each Registrar.
The URL of the dr interface (
Section 4.3.6) is:
https://<tmdb-domain-name>/cnis/<lookupkey>.xml
Note that the "lookupkey" may contain slash characters ("/"). The slash character is part of the URL path and
MUST NOT be escaped when requesting the TCN.
The TLS certificate (HTTPS) used on the dr interface (
Section 4.3.6)
MUST be signed by a well-know public CA. Registrars
MUST perform the certification path validation described in
Section 6 of
RFC 5280. Registrars will be authenticated in the dr interface using HTTP Basic access authentication. The dr interface (
Section 4.3.6)
MUST support HTTPS keep-alive and
MUST maintain the connection for up to 30 minutes.
During the
OPTIONAL Qualified Launch Program (QLP) Period (see [
QLP-Addendum]), effective allocations of DNs to third parties could require that Registries and Registrars provide Sunrise and/or Trademark Claims services. If required, Registries and Registrars
MUST provide Sunrise and/or Trademark Claims services, as described in Sections [
5.2] and [
5.3].
The effective allocation scenarios are as follows:
-
If the leftmost DNL of the DN being effectively allocated (QLP Name in this section) matches a DNL in the SURL and an SMD is provided, then Registries MUST provide Sunrise Services (see Section 5.2), and the DN MUST be reported in a Sunrise LORDN file during the QLP Period. For example, if the DN "xn--mgbachtv.xn--mgbh0fb" is being effectively allocated, the leftmost DNL would be "xn--mgbachtv".
-
If the QLP Name matches a DNL in the SURL but does not match a DNL in the DNL List and an SMD is NOT provided (see Section 2.2 of [QLP-Addendum]), then the DN MUST be reported in a Sunrise LORDN file using the special SMD-id "99999-99999" during the QLP Period.
-
If the QLP Name matches a DNL in the SURL and also matches a DNL in the DNL List and an SMD is NOT provided (see Section 2.2 of [QLP-Addendum]), then Registries MUST provide Trademark Claims services (see Section 5.3), and the DN MUST be reported in a Trademark Claims LORDN file during the QLP Period.
-
If the QLP Name matches a DNL in the DNL List but does not match a DNL in the SURL, then Registries MUST provide Trademark Claims services (see Section 5.3), and the DN MUST be reported in a Trademark Claims LORDN file during the QLP Period.
The following table lists all the effective allocation scenarios during a QLP Period:
QLP Name Match in the SURL |
QLP Name Match in the DNL List |
SMD Was Provided by the Potential Registrant |
Registry MUST Provide Sunrise or Trademark Claims Services |
Registry MUST Report DN Registration in <type> LORDN File |
Y |
Y |
Y |
Sunrise |
Sunrise |
Y |
N |
Y |
Sunrise |
Sunrise |
N |
Y |
-- |
Trademark Claims |
Trademark Claims |
N |
N |
-- |
-- |
-- |
Y |
Y |
N (see Section 2.2 of [QLP-Addendum])
|
Trademark Claims |
Trademark Claims |
Y |
N |
N (see Section 2.2 of [QLP-Addendum])
|
-- |
Sunrise (using special SMD-id) |
Table 1: QLP Effective Allocation Scenarios
The TMDB
MUST provide the following services to Registries during a QLP Period:
The TMDB
MUST provide the following services to Registrars during a QLP Period:
A new SURL
MUST be published by the TMDB twice a day, by 00:00:00 and 12:00:00 UTC.
Registries offering the
OPTIONAL QLP Period
MUST refresh the latest version of the SURL at least once every 24 hours.
.----------. .------.
| Registry | | TMDB |
'----------' '------'
| |
.----------------. |
| Periodically, | |
| at least | |
| every 24 hours | |
'----------------' |
| |
|------------------------------->|
| Download the latest SURL |
|<-------------------------------|
| |
| |
Figure 9 depicts the process of downloading the latest SURL initiated by the Registry.
Note: The SURL will be the same regardless of the TLD. If a Backend Registry Operator manages the infrastructure of several TLDs, the Backend Registry Operator could refresh the SURL once every 24 hours, and the SURL could be used for all the TLDs managed by the Backend Registry Operator.