URS High Level Technical Requirements for Registries and Registrars
17 October 2013

The following Technical Requirements are to be followed by Registry Operators and Registrars
to support the Uniform Rapid Suspension System (URS). The URS Rules and URS Procedures
governing
theURS
areavailable
on
ICANN’sWebsiteathttp://newgtlds.icann.org/en/applicants/urs.
The terms MAY, MUST, MUST NOT, SHOULD and SHOULD NOT are used in accordance with RFC
2119, which is available at http://www.ietf.org/rfc/rfc2119.txt.

1. Definitions:
URS Lock: A combination of statuses that prevents a domain name from being
updated, transferred or deleted. A request to activate a URS Lock will comefrom the URS Provider to the Registry Operator as specified by the URS Rules.
 The Registry Operator MUST activate the following EPP-statuses when adomain name is in URS Lock:I. serverUpdateProhibited
II. serverTransferProhibitedIII. serverDeleteProhibited Note: If a domain name transitions from URS Suspension to URS Lock, theRegistry Operator MUST update the domain name to set the nameserver (NS) and delegation signer (DS) information that was
originally present in the domain name before the URS Suspension.
If glue records were removed when the Registry Operator
activated the URS Suspension, the Registry Operator MUST restore
the required glue records.

URS Suspension: A domain name MAY be suspended as part of the final decisionof a URS Complaint (as defined in the URS Rules). A URS Suspended domainname will be redirected to a webpage that mentions that the domain name has
been suspended because of a URS Complaint. In order to redirect a URS
Suspended domain name to the suspension website, the URS Provider will
specify the NS and dsData (including keyData) information (if the URS Provider

does not support DNSSEC, the Registry Operator MUST remove the old DSrecords) to the Registry Operator in the email that instructs the Registry
Operator to suspend the domain name.
Non-URS State (URS Rollback): This is the state of a domain name that is notunder either URS Lock or URS Suspension. If the domain name is in URS Lock or
URS Suspension, and if the URS Provider requests that the domain name betransitioned to a Non-URS State, the Registry Operator MUST restore the original
information of the domain name. The reversion of a domain name to a Non-URS
State is referred to as a URS Rollback.
 Note: The Registry Operator MUST update the domain name to set theNS and DS information that was originally present in the domainname before the URS Suspension. If glue records were removed
when the Registry Operator activated the URS Suspension, theRegistry Operator MUST restore the required glue records.

2. Registry Operator Requirements:
Registry Requirement 1: Registry Operator MAY appoint a Back End Registry
Operator (“BERO”) to act on Registry Operator’s behalf to fulfill Registry
Operator’s obligations under the URS (“Agreed Obligations”) by writtenagreement between Registry Operator and the BERO. Once appointed, theBERO should receive URS requests from the URS Provider and may send
notifications to the URS Provider. For the avoidance of doubt, the appointmentof a BERO shall not relieve Registry Operator of its obligations under the Agreed
Obligations and Registry Operator shall remain liable to perform the Agreed
Obligations should the BERO fail to discharge the Agreed Obligations in whole orpart in accordance with the Registry Operator’s Registry Agreement.

Registry Requirement 2: The Registry Operator MUST activate a URS Lock within
24 hours of the Registry Operator’s receipt of an email from a URS Provider
requesting that the URS Lock be activated on the domain name.
 Note: For security purposes all emails sent by URS Providers to Registry
Operators, Registrars and BEROs will be cryptographically signed
using PGP.

Registry Requirement 3: The Registry Operator MUST activate URS Suspension
on a URS Locked domain name within 24 hours of the Registry Operator’s receiptof an email from a URS Provider requesting that the URS Suspension be activatedon the domain name. In addition, the Registry Operator MUST cause the Whois
information to reflect that the domain name is not able to be transferred,
deleted or modified for the life of the registration.
Registry Requirement 4: The Registry Operator MUST complete a URS Rollback
for a domain name within 24 hours of the Registry Operator’s receipt of an email
from a URS Provider requesting that the URS Rollback be performed on thedomain name.

Registry Requirement 5: The Registry Operator MUST promptly notify the URS
Provider via email that the action (e.g. activation of URS Lock, activation of URS
Suspension or completion of a URS Rollback) requested by the URS Provider has
been completed on the domain name. If URS Suspension is activated on adomain name, the Registry Operator MAY notify the Registrars of domain namesthat may be affected by potential resolution issues of child hosts that depend onthe URS Suspended domain name.
 Note: For security purposes emails sent by the Registry Operator andBERO (if one has been appointed) to the URS Provider MUST be
cryptographically signed using PGP.

Registry Requirement 6: The Registry Operator MUST promptly notify the URSProvider via email if a URS Locked or URS Suspended domain name has been: (a)deleted or (b) purged (if the Registry Operator implements RGP).

Registry Requirement 7: The Registry Operator MUST provide ICANN with a URS
point of contact (e.g., name, position, phone number, email address), and PGP
public key, which ICANN will make available to the URS Providers, for thepurposes of receiving and sending URS communications. If the Registry Operator
appoints a BERO, the Registry Operator MUST provide ICANN with a BERO pointof contact, which ICANN will make available to the URS Providers, for thepurposes of receiving and sending URS communications. If the Registry Operator
appoints a BERO, the PGP public key of the BERO SHOULD be provided instead ofthe PGP public key of the Registry Operator. ICANN will make available to theRegistry Operator and the BERO (if one has been appointed) the list of PGP
public keys used by URS Providers, for the purpose of validating URScommunications.

Registry Requirement 8: Following the activation of a URS Lock or, if applicable,URS Suspension on a domain name, if the Registry Operator in its good faithbelief concludes that the activation of URS Suspension on the domain name islikely to create a present or imminent security incident to the TLD or the DNS(e.g. indirect effects on a significant number of domain names related to possible
child hosts that would result in resolution issues after activating the URS
Suspension), the Registry Operator MAY submit an “Expedited Registry Security
Request” to ICANN requesting that ICANN grant the Registry Operator a waiverfrom compliance with these Technical Requirements in order to deactivate theURS Lock or URS Suspension on the domain name (“ERSR Waiver”). ICANN willpromptly engage all parties related to the ERSR Waiver on a case by case basis toreach a final resolution to the concerns that led to the Registry Operator’s ERSR
Waiver request.

3. Domain Name Life-Cycle:
Registry Requirement 9: Registry Operator MUST follow the normal domainname life-cycle for a URS Locked domain name. The Registry Operator SHOULD
deactivate the serverDeleteProhibited EPP status at expiration of a URS Locked
domain name. Alternatively, if the Registry Operator decides not to deactivate
the serverDeleteProhibited EPP status at the expiration of a URS Locked domain
name, the Registry Operator MUST process the deletion of such URS Locked
domain name through an offline process with the Registrar.
 Note: If a domain name that is subject to a URS procedure is purged (ifthe Registry Operator implements Redemption Grace Period(RGP)), or deleted, the URS procedure will automatically terminate.

Registry Requirement 10: In cases where a URS Complainant (as defined in theURS Rules) has prevailed, Registry Operator MUST offer the option for the URS
Complainant to extend a URS Suspended domain name's registration for anadditional year (if allowed by the maximum registration policies of the TLD),
provided, however, that the URS Suspended domain name MUST remain
registered to the registrant who was the registrant at the time of URS
Suspension. Registry Operator MAY collect the Registrar renewal fee if the URS
Complainant elects to renew the URS Suspended domain name with thesponsoring Registrar.

Registry Requirement 11: The Registry Operator MUST deactivate theserverDeleteProhibited EPP status at expiration of a URS Suspended domain
name.

4. Registry-Registrar Agreement:
The Registry Operator MUST specify in the Registry-Registrar Agreement for theRegistry Operator’s TLD that the Registrar MUST accept and process payments
for the renewal of a domain name by a URS Complainant in cases where the URS
Complainant prevailed.

The Registry Operator MUST specify in the Registry-Registrar Agreement for theRegistry Operator’s TLD that the Registrar MUST NOT renew a domain name to aURS Complainant who prevailed for longer than one year (if allowed by themaximum validity period of the TLD).

5. Registrar Requirements:
Registrar Requirement 1: Registrar MUST provide ICANN with a URS point ofcontact (e.g., name, position, phone number, email address), which ICANN will
make available to the URS Providers, for the purposes of receiving URS
communications. ICANN will make available to the Registrar the list of URS
Providers point of contacts, for the purpose of receiving URS communications.

Registrar Requirement 2: Registrar MUST follow the normal domain name lifecycle for a URS Locked domain name. If the domain name registrant elects torenew, elected to auto-renew or restore the domain name registration, Registrar
MAY accept such renewal and/or restoration (if the Registry Operator
implements RGP).

Registrar Requirement 3: Registrar MUST offer the option for the URS
Complainant to extend a URS Suspended domain name's registration for up toone additional year (if allowed by the maximum validity period of the TLD) incases where the URS Complainant prevailed. Registrar MUST pay the renewal feefor such domain name to the Registry Operator.

Registrar Requirement 4: Following notice from a Registry Operator that a URS
Suspension has been activated on a domain name, Registrar MAY notify theregistrants of domain names that depend on the resolution of the URSSuspended domain name so that they can remediate potential indirect effects ofthe URS Suspension (e.g., possible resolution issues for child hosts that dependon the URS Suspended domain name).
Registrar Requirement 5: Registrar SHOULD NOT modify the contact data (i.e.
contacts and registrant data) of a URS Locked or URS Suspended domain name.

Non-Repudiation mechanism:URS Providers, Registrars, ICANN, and Registries MUST support the OpenPGP standard asdescribed in RFC 4880 for signing messages, message format, etc. Several files are provided byICANN at the repository located at https://urs.icann.org. In order to access the repository, HTTP
Basic access authentication MUST be used. Credentials for accessing the repository will be
provided by ICANN to Registries, Registrars, and URS Providers.

Generals:Date and time, datetime: Date and time are specified following the standard "Date andTime on the Internet specification" in RFC 3339.

URS Provider Information:
URS Provider PGP Keys:
oThe URS Provider PGP Keys (URSPK) is an ASCII-armored PGP key-ring file that contains thePGP keys used by URS Providers to sign the notifications sent by email to Registries andRegistrars.

oURSPK is located at https://urs.icann.org/urs/urs-pgp-keys.asc

oThe URSPK MUST be used to validate the PGP signature in the notifications sentfrom the URS Provider.

oAfter accessing https://urs.icann.org/urs/urs-pgp-keys.asc, the server will respond with anHTTP 302 status code redirecting to the latest URSPK. The filename of the URSPK is urs-pgpkeys.<YYYYMMDDvv>.asc, Where:
YYYY: year that the URSPK was updated.

MM: zero-padded month that the URSPK was updated.

DD: zero-padded day that the URSPK was updated.

vv: zero-padded version of the URSPK, "00" is used for the first version of the day.

Registry Operator PGP Requirement 1: The Registry Operator MUST download at least
every 24 hours the URSPK. If the URSPK is newer than the local copy based on thefilename, the Registry Operator/BERO MUST use the downloaded file.

Registrar PGP Requirement 1: The Registrar MUST download at least every 24 hours theURSPK. If the URSPK is newer than the local copy based on the filename, the Registrar
MUST use the downloaded file.

Registrar Provider Information:
Registrar Provider Contacts CSV:
oThe Registrar Contacts CSV (RrCC) contains a list of Registrar and URS point of contact.

oThe RrCC is located at https://urs.icann.org/registrar/registrar-contacts.csv, the RrCC iscontained in a CSV-like formatted file that has the following structure:first line: <version>,<RrCC creation datetime>. Where:<version>, version of the file, this field MUST be 1.

<RrCC creation datetime>, datetime in UTC that the RrCC was created.

line: a header line as specified in RFC 4180, With the header names as follows:IANA-Registrar-ID,contact-email-address

One or more lines with: <IANA-Registrar-ID>,<contact-email-address>, where:<IANA-Registrar-ID>, IANA Registrar ID as defined in
http://www.iana.org/assignments/registrar-ids/registrar-ids.xml

<contact-email-address>, where email messages shall be sent to by theRegistry Operator / BERO or URS Provider.

Registry PGP Requirement 2: The Registry Operator/BERO MAY download at least every
24 hours the RrCC. If the <RrCC creation datetime> value in the downloaded file isnewer than the local copy, the Registry Operator/BERO MUST use the downloadedcopy.