2024–2025 Annual Report

I'm pleased to share with you the Domain Name Commission (DNC) Annual Report for 2024–2025. This report reflects our commitment and efforts to achieve our vision of being a fair, independent, and accessible self-regulator who provides trusted oversight of the .nz domain name space.

This year, we continued to improve the resourcing, processes, and systems capability to ensure we continue to deliver a high-quality compliance function as the regulatory arm of InternetNZ Group. The Board's focus over this year has been to enable renewed policies, processes, and the development of team skills so we can better respond to a rapidly changing domain name space. DNC exists to uphold .nz Rules, and we do this to ensure domain name holders get a fair deal in the context of a highly trusted .nz domain name registry.

Looking ahead to next year, we recognise the evolving challenges and opportunities in our environment, and our focus will be to develop a transparent and strategic regulatory framework that DNC works within, and on the development of the InternetNZ Group strategy for 2026–2031. This piece of work is an exciting change as we move towards a shared strategy across the InternetNZ Group that creates a clear pathway for purpose, values, and vision over the next five years.

I want to thank the Domain Name Commissioner and DNC team, whose expertise and dedication have ensured that we remain a trusted, capable, and responsive regulator. They are a small specialist team carrying a significant and changing workload related, in part, to the changing world of domain name abuse. This annual report is a testament to their hard work and commitment. 

I would also like to thank my fellow Board members for their insight and governance throughout the year, and all our stakeholders for their ongoing trust and support.

Nāku noa nei, nā

Vivien Maidaborn, Domain Name Commission Chair

It has been a busy and exciting year for DNC. One of our key highlights is the appointment of Tū Ātea Limited to the role of .iwi.nz moderator. Our goal for this appointment was to ensure the kaitiaki of .iwi.nz sat with an organisation with experience representing iwi. We believe Tū Ātea Limited is well placed to fulfil this role, given their experience as a trustee for Tū Ātea, which holds and manages spectrum for Māori (among other things).

As an organisation, we recognise the importance and relevance of Te Tiriti o Waitangi and the principles of participation, protection, and partnership. We will continue to consult with Māori to gain a deeper understanding of how our regulatory activities can honour and give practice to Te Tiriti. 

This year, we also appointed the New Zealand Dispute Resolution Centre (NZDRC) to administer the .nz Dispute Resolution Scheme (DRS), and updated the DRS rules, which now give claimants the option to choose either funded mediation or self-funded expert determination. When reviewing the DRS rules, we took the opportunity to consider how we could weave in the ability for disputes to be resolved in a culturally responsive and respectful way. We now offer tikanga-based Māori cultural support for any party, if requested. 

Looking ahead to the upcoming year, a key priority is to develop a strategic view of .nz and a new InternetNZ Group long-term strategy for 2026–31. 

I would like to thank the Board and the DNC team, who are passionate about the work we do. As well as all our stakeholders for their support and commitment. Together, we are maturing our regulatory and compliance approach to meet today’s challenges and ensure we can maintain the integrity of the .nz Register and the security, stability, and resilience of the .nz domain namespace in a fast-changing environment. 

Tēnā koutou katoa

Barbara Pearse, Domain Name Commissioner

InternetNZ has appointed the Domain Name Commission (DNC) to oversee and regulate the .nz domain namespace under an Operating Agreement. Our role, responsibilities, and functions are outlined in the Operating Agreement and .nz Rules.

Domain names are essential for any individual or organisation seeking to maintain an effective digital presence. It is vital to Aotearoa New Zealand that there is a trusted and secure system for the registration and renewal of .nz domain names, that registrars have and maintain the requisite skills, resourcing and capability to ensure the ongoing availability of services, and that abuse that exploits the domain name system for malicious purposes is disrupted.

Good outcomes are best achieved when everyone understands their rights and responsibilities and is motivated to act on them.

Our vision:

A .nz that is fair for everyone. 

To be a fair, independent and accessible modern regulator who provides trusted and effective management, oversight and regulation of the .nz domain namespace.

Our strategic priorities:

In 2024–2025, our 2022-2025 Strategy was replaced with three new strategic priorities to facilitate the outcomes required under our new goals: 

• Centering Te Tiriti o Waitangi throughout all we do.
• Strengthening the home of .nz to reflect the importance of the .nz critical infrastructure for Aotearoa New Zealand.
• Effectively regulating the .nz domain namespace.

We have structured this report to correspond with our core functions. Our strategic priorities are represented across each of these sections.  

Our core functions:

• Oversee the .nz market to ensure compliance of registrars, resellers, and domain name holders with the .nz Rules.  
• Enforce the .nz Rules.  
• Authorise and remove registrar authorisations.  
• Provide a dispute resolution service for .nz domain names.  
• Provide a customer service function to attempt to resolve queries from the public regarding the .nz domain namespace and its operation.  
• Investigate and resolve complaints regarding registrars.  
• Publish information and reports related to our functions.  
• Maintain an understanding of the competitiveness of the .nz market.  
• Participate as part of the InternetNZ Group in relevant international forums and events to share knowledge and skills and keep up-to-date with emerging issues.

Central to our mission of promoting and protecting the rights of domain name holders is our commitment to delivering great customer service and efficient enquiry resolution. We strive to address each enquiry fairly and promptly, prioritising those that may impact the ability to use a .nz domain name.

Enquiry numbers

In 2024–2025, we received 4,734 enquiries across our email, inbound calls, and chatbot channels.  

The chatbot resolved 1,453 enquiries without requiring human assistance, compared to 920 the previous year. Available around the clock, we created the chatbot to improve response times and help users with commonly asked questions. We continue to develop the chatbot's knowledge in response to themes or questions being asked. 

Types of enquiries received 

We receive a wide range of enquiries throughout the year. These include reports about suspected malicious domain names, which rose significantly, from 12% to 23%, making it the most common enquiry category this year.  

The top five enquiry categories: 

Following our outreach work with registrars in 2023–2024, it’s encouraging to see a significant decline in authorisation code enquiries. This year, they no longer ranked among the top five enquiry categories, indicating positive progress and increased responsiveness by registrars to domain name holder requests. 

Customer feedback 

To support continuous service improvement, all customers are invited to provide feedback once their enquiry is resolved. This feedback is collected via an automated email generated by our ticketing system. We review all responses carefully to identify opportunities to enhance the experience people have when engaging with us.

This year, 95 customer surveys were completed. We received an average rating of 3.9 out of 5 stars (1 star = very poor, 5 stars = very good), a slight improvement on 3.8 in the previous year.

Disagreements can sometimes arise over who has the right to hold a specific .nz domain name. Our DRS is a low-cost and quicker alternative to litigation, incorporating free mediation, expert determination, and the option for appeal.

New .nz DRS Rules 

In 2024, we undertook a major project to modernise our DRS rules, which had remained largely unchanged since the scheme was established some 20 years ago. Updates were needed to reflect current best practices and better meet the needs of domain name holders in the current environment. 

Our new DRS rules came into effect on 1 October 2024 after a public consultation process from 20 August to 19 September 2024. In response to user feedback, changes were made to give claimants the option of either a free mediation service or to self-fund an expert determination process. We also took the opportunity to incorporate into the DRS a funded tikanga-based process for the resolution of disputes in a culturally responsive and respectful way. 

While it is early days, we are seeing a preference for expert determination by claimants. This was not unexpected, as there has been an increasing trend of respondents not engaging in either process, and an expert determination does not rely on respondents engaging for a determination to be issued. 

Outsourcing of DRS administration

In 2023–2024, we concluded our online dispute resolution pilot and explored the viability of outsourcing the DRS administration. We were thrilled to appoint the NZDRC to take over the administration of the DRS, given their extensive experience and established presence in the alternative dispute resolution market. Their proven track record in implementing a tikanga-based approach within other administered schemes was of particular significance to us as a regulatory body in Aotearoa New Zealand. 

As of 1 October, the NZDRC administers the .nz DRS on our behalf. 

We will continue to publicly report on the scheme's operation and the DRS outcomes.

Mediation 

In mediation, the parties speak for themselves and work together to negotiate a resolution to the domain name dispute. We offer this mediation service free of charge as part of our commitment to accessible and fair dispute resolution. 

Under the DRS rules (version 4.2) in place for the period 1 April 2024 to 30 September 2024:

• Three mediations commenced 
• One mediation was settled 
• Two mediations were not settled 

Under the new DRS rules (version 5) in place for the period 1 October 2024 to 31 March 2025: 

• Six mediation claims filed
• 0 mediators were appointed as the respondent did not engage in the process.
• 0 mediations were settled 

Expert determination

Expert determination is the determination of a dispute by an expert under the DRS rules.  

A party in a dispute over a .nz domain name can request to appoint an independent person — an expert — to decide whether the domain name should remain with the domain name holder (dismissed) or be transferred to the party who submitted the claim (transferred). 

Under the previous DRS rules (version 4.2) for the period 1 April 2024 to 30 September 2024: 

• Seven expert determinations were issued.

Under the new DRS rules (version 5) for the period 1 October 2024 to 31 March 2025: 

• A total of thirteen expert claims were filed.
• Seven expert determinations were issued.
• Six were withdrawn as no fees for determination were received.

We publish a summary and full decisions on our website.

Appeal determination

Following an expert determination, a party can appeal, which is a formal challenge to a determination made under the DRS rules. No appeals were filed during the reporting period.

Our role includes monitoring compliance with and enforcing the .nz Rules and contractual framework regarding the .nz domain namespace. We undertake both proactive (planned) and reactive (by referrals) monitoring activities on a risk-based approach. Currently, the general audits we undertake are data validation and identity verification to ensure compliance with the .nz Rules.

Under the .nz Rules, domain name holders are required to ensure they are contactable and their registration details are accurate, complete, and kept up to date. In addition, they must meet the eligibility criteria (an identifiable individual over the age of 18 or a lawfully constituted entity). The latter can be demonstrated if they verify their identity or by providing evidence of incorporation, if a lawfully constituted entity.

Proactive monitoring tool launched

This year, with the assistance of InternetNZ, we developed and launched a new tool designed to analyse new .nz domain name registrations against multiple factors in order to select a sample for registration data and eligibility checks. We take a risk-based approach and obtain a sample with indicators that the domain name has been potentially registered for malicious purposes. The tool can identify key factors relevant to Aotearoa New Zealand, which include brand or government impersonation, phishing or scam-related terms, and deceptive domain structures, such as registering domain names with deliberately misspelt names of well-known sites.

The team will continue to review and refine the tool to ensure its effectiveness in disrupting suspected abuse. The upside of validating registration details is that the domain name holders can be contacted should they experience issues with their domain name at any time.

Proactive data validation and identity verification audits 

This year, we completed 414 data validation audits with the sample selected from our domain name registration check tool. In addition, 40 Identity verification audits were completed for the domain names that passed the data validation audit. This resulted in 85% and 50%, respectively, of the domain names being suspended for failing either audit.

Reactive data validation and identity verification audits

This year, we completed 261 data validation audits on domain names that were referred to us for allegedly being used maliciously (among other things). In addition, 91 identity verification audits were completed for the domain names that passed the data validation audit. This resulted in 228 (87%) and 17 (19%), respectively, of the domain names being suspended for failing either audit.

Strong stakeholder relationships

An important part of our effectiveness as a regulator lies in maintaining strong relationships with other organisations in our ecosystem. We work closely with a range of stakeholders, including, but not limited to, New Zealand's Computer Emergency Response Team (CERT NZ), New Zealand Police Cybercrime Unit, registrars, and the general public. This year, we responded to a Production Order from the New Zealand Police, as well as a Requisition Order from the New Zealand Customs Service to support their investigations, and have undertaken a number of bulk transfers of domain names from one registrar to another where in the interest of domain name holders.

We are also a member of the Internet Watch Foundation (IWF), which works to combat child sexual abuse material (CSAM). Under our partnership arrangement, we refer reported URLs to the Department of Internal Affairs (DIA) for investigation and any necessary regulatory action, such as takedown orders.

This year, 454 IWF URL reports relating to CSAM (associated with 3 .nz domain names) were actioned and taken down by the domain name holders at DIA’s request. Last year, there were 607 URLs (associated with 5 .nz domain names). We are pleased to see a 25% decrease in reports from last year.

During the year, we developed our investigations and enforcement capability. An investigation will generally only be initiated where our enquiries indicate possible serious or deliberate non-compliance with the .nz Rules or Authorisation Agreement, and/or possible serious wrongdoing on the part of the regulated party. 

We opened 12 investigations and closed three. One was closed because no breaches were identified, and two were closed with sanctions imposed for non-compliance.  

In the first case, we issued a formal (private) warning to a registrar for breaching Clause 7.21 of the Authorisation Agreement and Clause 8.1.3b of the .nz Rules. While the registrar had attempted to provide server redundancy, to minimise the risk of a single point of failure, there was a misconfiguration in the glue record.  When one server went down, the second server did not deploy. This resulted in an outage and the registrar services becoming unavailable, impacting its domain name holders who had hosting services provided by the registrar. In addition, the registrar did not have an effective business continuity plan in place to facilitate a faster resolution of the outage. The registrar fully cooperated with us and quickly remediated the issues to minimise the risk of the issue reoccurring.  

In the second case, the entity named as the domain name holder had been deregistered from the Companies Office Register at the time of registering the domain name. It was not a ‘lawfully constituted entity’, so it did not meet the eligibility criteria to register a domain name in the .nz Rules. We canceled the domain name.

Our reports on market health indicators, pricing, number and diversity of authorised registrars, and other key areas support the ongoing maintenance of a competitive .nz domain name market.

Market Data Portal

We developed and maintain a market data portal on our website, which provides insights on domain name average retail pricing, renewal rates, creates, deletes, and transfers to other registrars (among other things). The data is uploaded each month to ensure accurate and up-to-date information about the .nz domain namespace. 

Key market statistics 

In 2024–2025, in the .nz domain name space:

• 750,909 .nz domain names as of 31 March 2025, an increase from 747,256 at the same time last year.
• 30,201 .nz domain names changed registrars during the year, which is consistent with 32,017 last year.

Key indicators of market health

As of 31 March 2025, four registrars held 57.94% of the .nz domain name market — a slight decrease from 59.19% at the same time last year. These figures treat each registrar separately and do not aggregate where there is common ultimate ownership.

We use the Herfindahl-Hirschman Index (HHI), a widely used metric for assessing market concentration and competitiveness. An HHI score below 1,500 indicates a competitive marketplace.

Although the market is becoming increasingly concentrated, the current HHI score stands at 1,032—slightly up from 1,028 the previous year. As this remains below the 1,500 threshold, it continues to indicate a competitive marketplace. 

As of 31 March 2025, there were 74 .nz authorised registrars:

• Five applications for authorisation were received during the year, with two authorisations granted, two declined, and one withdrawn.
• Two registrars exited the .nz market during the year.

We participated in national and international conferences, representing DNC and engaging with registrars, vendors, and peer ccTLDs. The Commissioner is also a member of the ccNSO Domain Name Abuse Standing Committee and attends monthly committee online meetings and workshops, and planning sessions in person at the ICANN conferences. These engagements help us share knowledge, strengthen skills, and stay alert to current and emerging risks within the domain name ecosystem.

Key conferences attended in person 

September 2024 — Asia Pacific Top Level Domain Association (APTLD86) 

The Commissioner attended APLTD86 in Vietnam to strengthen relationships with peer TLDs and gain insights into emerging risks and challenges faced across the industry. Key observations included a rise in domain ‘use’ issues — such as gambling and other illegal activities — as well as participation in sessions such as DNS abuse, the role of AI (both as a tool for TLDs and a tactic used by bad actors), and how other registries are managing abusive registrations. 

November 2024, ICANN, Istanbul

The Commissioner and Head of Technical and Relationships attended ICANN81 in Istanbul, Türkiye, participating in workshops hosted by the ccNSO Domain Name Abuse Standing Committee (DASC) and a cyber incident scenario workshop. The Commissioner was on a subcommittee to organise a session for ICANN82 to examine whether registration data accuracy and validation are effective tools for disrupting DNS abuse. While data validation and compliance approaches vary globally, ccTLDs consistently demonstrate low levels of abuse. 

March 2025, ICANN82, Seattle  

The Commissioner also attended ICANN82 in Seattle, which attracted 1,917 attendees — 1,369 participating in person and 548 virtually. The conference provided a valuable opportunity to connect with overseas-based .nz registrars, prospective registrars, threat feed vendors and peer ccTLDs to exchange knowledge and insights and discuss emerging issues. Key topics of interest included systems, tools, and incentives for data validation and identity verification of registration information, as well as DNS Abuse and the use of threat feeds to detect broader harms such as fraud and financial crime.

August–September 2024, Asia Pacific Network Information Centre (APNIC)

Our leadership team attended the APNIC58 opening ceremony and keynote presentations, while our Head of Technical and Relationships participated in additional sessions. This conference brought together Internet and networking experts, government representatives, industry leaders, and other stakeholders from around the world to learn, exchange ideas and experiences, network with peers, and contribute to the development of policies related to internet operations.

August 2024, .nz Registrar Summit, Wellington  

We co-hosted the .nz Registrar Summit in Wellington — our first opportunity to bring .nz registrars together since 2019. The event provided a valuable platform to reconnect, share the work we’ve been doing, and discuss what’s on the horizon for the .nz domain namespace.

13 registrar companies attended the summit, in person and online, collectively representing 83% of the .nz domain namespace. Our team presented our core activities and participated in a panel discussion that explored the future of domain names and their ongoing relevance. It was a valuable opportunity to engage directly with registrars and hear what’s top of mind for them.

Submission on .nz Rules consultation

In May 2024, InternetNZ consulted on proposed amendments to the .nz Rules. The changes proposed were largely to provide clarity on definitions, tidy up incorrect clause references and wording, and to enable us to request information where it is determined there has been a likely breach, so an investigation can be undertaken. We provided a submission to InternetNZ supporting the proposed amendments, and the updated rules came into effect on 1 November 2024. 

Our team has six full-time staff members, including three operational staff and two technical staff.  

Our approach to work is called Together Working Better. This includes the ability to work flexibly and remotely. One way we support staff connections is by providing regular get-togethers with the InternetNZ Group —a staff wanānga in February, planning in mid-year, and an end-of-year celebration. 

The way we all work has changed greatly over the last few years. This year, we have introduced Agile methodology across the organisation. By making our work more visible, we can more easily prioritise our annual and quarterly goals and understand key dependencies that are successful in delivery.   

People are key to the effective delivery of our work. To support our people, we provide a range of benefits, such as paying for a home internet connection, health and wellbeing insurance, a volunteer day, and flexible working arrangements.