ICANN Opens RDRS Policy Alignment to Public Comment — What It Means for WHOIS Access in 2026
If you’ve ever tried to shut down a phishing site, fight a brand impersonator, or track a fraudster, you know the frustration. You look up the “owner” of the malicious domain (a WHOIS request) and hit a wall of redacted or proxied data.
Getting that non public data is a slow, manual, and unreliable process. But that might be about to change.
ICANN, the organization that governs the internet’s domain system, has just opened a crucial public comment period. It’s focused on the RDRS (Registration Data Request Service), and it could completely reshape how businesses, law enforcement, and security teams get the data they need.
What’s Happening with ICANN and RDRS?
Right now, the RDRS is a voluntary pilot program. It’s a system for registrars (like GoDaddy or Namecheap) to receive and process requests for non public domain registration data. Because it’s voluntary, responses are inconsistent. Some registrars participate; many don’t.
This new “Policy Alignment Analysis,” open for public comment until December 9, 2025, explores ways to fix this. The big question on the table: should participation in the RDRS become mandatory for all registrars?
The analysis also dives into other critical issues, like:
- Creating a standardized authentication system for law enforcement (LE) to speed up their requests.
- Aligning all the overlapping policies, from privacy/proxy services to urgent request timelines.
Why This Is More Than Just ‘Domain Talk’
This isn’t just a technical update for your IT department. For any business concerned with risk, the outcome of this decision is massive.
Your teams responsible for KYC, brand protection, anti fraud, and cyber abuse response all depend on reliable, lawful access to WHOIS data. When a criminal uses a domain to attack your customers, your first step is finding out who they are.
A standardized, mandatory RDRS means more certainty. It means your request to a registrar won’t just disappear into a black hole. It promises a predictable, trackable, and auditable process for domain data access, which is essential for legal discovery and enforcement.
The Balancing Act: Privacy vs. Access
Of course, this is a delicate balance. The whole reason WHOIS data went dark was to protect DNS privacy, a critical goal in its own right.
The challenge for ICANN is to thread the needle. How do you build a system that:
- Gives legitimate investigators (IP owners, security researchers, police) the access they need to stop abuse?
- Protects the privacy of legitimate domain owners from misuse?
- Avoids creating an impossible burden of registrar compliance that stifles competition?
Getting this wrong could either create a system full of privacy loopholes or one so restrictive that it fails to help stop online crime.
Your 3 Steps Action Plan Before 2026
With a final roadmap expected after this comment period, the rules for WHOIS access are being rewritten. Smart businesses should prepare now.
- Audit Your Current Process: How do you request domain data today? Who handles it? How is the evidence gathered and stored securely? Map out these internal workflows now so you’re ready to adapt to any new system.
- Brief Your Teams: Get your legal, brand protection, and cybersecurity leaders in a room (or on a call). They need to understand what’s at stake and how their evidence gathering needs might be affected.
- Consider Submitting Comments: If your organization relies heavily on this data, this is your chance to be heard. Review the ICANN paper and consider submitting your organization’s perspective before the December 9 deadline.
The RDRS is set to become the central gateway for domain data access. What it looks like in 2026 will depend on the feedback ICANN gets right now. It’s time to pay attention.
