Testing an Upstream Intervention: The Impact of Category 1 Safeguards on DNS Abuse

Identity and registrant verification are becoming a more prominent part of Internet security policy. The premise is intuitive: make malicious registration harder, and less abuse should enter the ecosystem. Yet evidence that these controls measurably reduce abuse remains limited. For operators who ultimately absorb the consequences through DNS, hosting, threat intelligence, incident response, and takedown, this is not only a policy question. It is an operational one.
We test this premise using ICANN’s Category 1 safeguards as a real-world case study. Category 1 applies additional requirements to gTLDs associated with regulated or sensitive sectors. Importantly, the framework includes different registration models, from open registration with self-certification to restricted registration with eligibility or credential verification.
We analyze 1,106 new gTLDs monthly from 2023 through 2025. Rather than asking only whether safeguarded namespaces have "less abuse," we separate two processes that conventional abuse rates combine: whether maliciously registered domains appear at all, and how large campaigns become once they appear.
The result challenges a simple prevention story. After accounting for gTLD size, registry architecture, and common monthly conditions, Category 1 gTLDs are associated with abuse appearing in more months, but with substantially smaller campaigns when abuse occurs. The combined model predicts lower malicious-domain volume overall. The strongest difference is within Category 1 itself: restricted Level 8 gTLDs show lower occurrence, lower scale, and lower overall volume than the more open, self-certified Level 3 group.
These findings raise a broader question for the RIPE community. As verification and other upstream safeguards become more common, what evidence should demonstrate that they work? Our results suggest that aggregate abuse rates are not enough. Evaluating upstream interventions requires distinguishing prevention, containment, and response, and connecting those outcomes to operational data on verification, rejected registrations, campaigns, and remediation.