ICANN is testing a new authentication system intended to help law enforcement obtain non-public domain-registration data quickly in cases involving imminent threats to life, serious bodily injury, critical infrastructure or child exploitation. The proof of concept will connect authenticated agency users with ICANN’s Registration Data Request Service (RDRS), which routes disclosure requests for generic top-level domain registration data to the relevant registrar.
The initiative follows an update to ICANN’s Registration Data Policy requiring contracted parties to respond to authenticated urgent requests within 24 hours. The urgent-request provisions have not yet taken effect because ICANN must first establish an authentication mechanism for law enforcement users. ICANN says complex requests may require additional processing time.
The organization’s preferred technical approach is based on Security Assertion Markup Language, or SAML, a standard commonly used for enterprise single sign-on. ICANN says it is working with the FBI and Interpol to evaluate how existing law enforcement identity systems could interoperate with RDRS or a successor service. A proof of concept is expected to launch by December 2026, according to the Law Enforcement Agency Authentication Mechanisms Input Group.
The proposed system would not give every officer unrestricted access. Agencies would nominate personnel authorized to submit requests, with permissions conveyed through authentication tokens exchanged during the SAML login process. Registrars would continue to assess whether a request is lawful, sufficiently urgent and appropriate to disclose, rather than automatically handing over customer information.
That distinction matters because domain-registration data was once broadly exposed through WHOIS, but privacy regulations and registrar privacy services have made much of it non-public. The RDRS is designed to provide a controlled route for legitimate disclosure requests without restoring universal public access. ICANN emphasizes that the authentication group is handling operational and technical requirements, not deciding the wider policy questions governing acceptable use.
For defenders and investigators, the project could shorten the path to identifying domains used for phishing, malware delivery or command-and-control activity when a case meets the urgent threshold. It also creates a new requirement for agencies to maintain reliable identity, authorization and audit controls. ICANN is seeking community input as it develops the specification, including safeguards for protecting the identities of officers whose requests could expose them to harassment or retaliation.
