Application number: 1-1302-98299 for LʹOréal

LʹOréal

41, rue Martre
Clichy 92117
FR

+33147567991

+33147567032

http:⁄⁄www.loreal.com

Mr. Georges-Edouard Dias

SVP, Digital Business

+33147568585

+33147787117

Georges-Edouard.DIAS@loreal.com

Mr. Joshua Bourne

Managing Partner, FairWinds Partners

+1 202 223 9252

Bourne.LC@fairwindspartners.com

Corporation

France

Not Available

Euronext

Annette Beneteau Roux
Director
Bernard Kasriel
Director
Charles-Henri Filippi
Director
Francisco Castaner Basco
Director
Francoise Bettencourt Meyers
Director
Jean-Paul Agon
Chairman of the Board and Managing Director
Jean-Pierre Meyers
Vice-Chairman and Director
Liliane Schueller Bettencourt
Director
Lindsay Owen-Jones
Director
Louis Schweitzer
Director
Marc Ladreit De Lacharriere
Director
Peter Brabeck-Letmathe
Director
Werner Bauer
Director
Xavier Joseph Louis Marie Fontanet
Director

Alexandre Popoff
Managing Director Latin America Zone and Africa, Middle East Zone
An Verhulst-Santos
Managing Director Professional Products Division
Brigittte Liberman
Managing Director Active Cosmetics Division
Christian Mulliez
Executive Vice-President Administration and Finance
Frédéric Rozé
Managing Director North America Zone
Geoff Skingsley
Executive Vice-President Human Resources
Jean-Jacques Lebel
President Consumer Products Division
Jean-Philippe Blanpan
Managing Director Operations
Jerome Tixier
Managing Director of Human Resources
Jochen Zaumseil
Managing Director Asia, Pacific Zone
Laurent Attal
Executive Vice-President Research and Innovation
Marc Menesguen
President Luxury Products Division
Nicolas Hieronimus
Managing Director Professional Products Division
Sara Ravella
Managing Director Corporate Communications, Sustainable Development and Public Affairs

Nestlé
N⁄A
TETHYS Incorporated
N⁄A

HAIR

Not Available

L’Oréal has consulted various experts in the field of domain names, including its selected back-end registry operator, VeriSign, Inc. which has successfully launched a number of new gTLDs over the last decade and is currently managing various TLDs, including .COM. Furthermore, the applied-for .HAIR string is a string that entirely consists of standard US ASCII characters, as is the case with most extensions currently available in the DNS. Therefore, to L’Oréal’s best knowledge and belief, no specific issues are to be expected as regards the operation and rendering of the .HAIR gTLD. In reaching this determination, the following data points were analyzed:
-ICANN’s Security Stability Advisory Committee (SSAC) entitled Alternative TLD Name Systems and Roots: Conflict, Control and Consequences (SAC009);
-IAB - RFC3696 “Application Techniques for Checking and Transformation of Names”
-Known software issues which Verisign has encountered during the last decade launching new gTLDs;
-Character type and length;
-ICANN supplemental notes to Question 16; and
-ICANN’s presentation during its Costa Rica regional meeting on TLD Universal Acceptance.

18.1 Mission and Purpose of .HAIR

L’Oréal is a leading global consumer products company serving the needs of consumers around the world with 23 brands in five different segments. L’Oréal has 68,900 employees and its products are available for purchase online and in stores and outlets in over 130 countries. 

L’Oréal’s Mission: Beauty For Everyone

For more than a century L’Oréal has been pushing back the boundaries of science to invent beauty products and meet the aspirations of millions of women and men. Its vocation is universal: to offer everyone, all over the world, the best of cosmetics in terms of quality, efficacy and safety, to give everyone access to beauty by offering products in harmony with their needs, culture and expectations. 

With the opening up of the emerging markets, L’Oréal’s mission is broadening in response to the vast diversity of populations. L’Oréal is committed to carrying out its mission to make beauty universal in a sustainable and responsible way. Ranked amongst the 100 most sustainable and ethical companies in the world, L’Oréal’s ambition is to be an exemplary corporate citizen.

L’Oréal has an extensive global family of brands and business units, whose content is available across a range of TLDs, including but not limited to: .COM, .CA, .CZ, .CO.UK, .FI, .FR, .DE, .IT, .NL, .NO, .PL, .RU, .ES, .TR, .HU, .EU, .AR, .BR, .MX, .HK, .CO.IN, .CO.JP, .COM.SG, .COM.TW, and .COM.AU.

.HAIR Purpose

L’Oréal has filed this application for a .HAIR gTLD with the intention of bringing to market a trusted, hierarchical, and intuitive namespace for a self-defined community of individuals and organizations whose primary focus is on providing and exchanging information regarding hair care products, other beauty products, and general information related to personal beauty and hair care. This .HAIR gTLD may also serve as a secure repository of goods and services related to hair care and beauty products. L’Oreal does not intend to apply for a community designation under ICANN’s Applicant Guidebook criteria. However, L’Oreal is committed to operating the .HAIR gTLD with a narrow focus and charter that L’Oreal will take the lead in establishing. It is intended that this restrictive charter ⁄ membership criteria will be developed in accordance with the standards set forth in L’Oréal’s Code of Business ethics and will serve multiple purposes, including, but not limited to: establishing a trusted online source of information; minimizing the need for defensive registrations and domain name speculation; enhancing rights protection mechanisms; and prohibiting of proxy registration.

18.1.2 Potential Business Models

L’Oréal is still analyzing potential use case options for the type of domain names that will be permitted for registration, as well as the potential universe of .HAIR registrants. However, these decisions will be embodied in the proposed gTLD charter ⁄ membership criteria. In undertaking this research, L’Oréal is leveraging its corporate experience in networking with existing businesses, affiliates, partners, and customers, and marketing its products and brands through these third party partnerships. L’Oréal currently envisions a three-stage rollout for the .HAIR gTLD:

Stage One

The initial stage of implementation of the gTLD will involve L’Oréal registering a limited number of .HAIR second-level domain names. 

The current best thinking involves a business model in which generic (ʺnatural,” “organic,” “color,” “highlights,” “styling,” etc.) and geographic (city⁄state) domain names would initially be reserved⁄allocated to L’Oréal. These domain names would provide a framework for a hierarchical and intuitive naming system for consumers to more easily navigate the .HAIR namespace. This initial use will provide L’Oréal’s IT and security personnel the time to run a number of tests to ensure seamless and secure access using the .HAIR domain names and interoperability with various software and Web-based applications. The registration and use of these domain names are intended to be within the scope of Section 1B of Specification 9 of the template Registry Agreement, regarding the maintenance, operation and purpose of the gTLD.

Stage Two

Once successful testing has been completed, L’Oréal’s existing business units and select licensees and partners would be allowed to register domain names in the .HAIR gTLD. At this time L’Oréal has not determined the identity of these select partners; however, any third party would be required to have a prior commercial or membership agreement with L’Oréal. This initial rollout guarantees that the identity and contact information for each .HAIR domain name registrant will be verifiable based upon a preexisting relationship. This allocation mechanism also minimizes startup and operational costs of the .HAIR gTLD. 

This initial allocation of domain names within the gTLD will allow L’Oréal to properly and sustainably develop the .HAIR gTLD in such a manner as to ensure that the gTLD is viewed by Internet users as a trusted namespace for access to information regarding hair care products, beauty products, general information related to hair care and personal beauty, as well as potentially being a secure repository of goods and services related to hair care and beauty products. 

Given the fact that L’Oréal will have full control over the number of registrations in the .HAIR gTLD namespace, L’Oréal expects that the number of domain name registrations will be less than 10,000 in the first three years of operation. 

It is in Stage Two that L’Oréal will evaluate expanding the operations of the .HAIR gTLD to permit registration by other registrants outside of licensees and strategic partners. Should an assessment of its expansion strategy lead to a decision to extend registration rights to these other parties, this expansion is currently planned to take place during Stage Three. 

Stage Three

Based on its experience with any expansion implemented in Stage Two, L’Oréal will assess whether its business plan and expansion strategy should be augmented by extending registration rights to a broader class of licensees, to potential customers of L’Oréal, and to other third parties. However, it is the current intention that L’Oréal would require any class of future potential registrants to be in compliance with and legally bound by the restrictive membership ⁄ charter criteria mentioned above. It is anticipated by L’Oréal that changes to the domain name industry, and particularly the impact of new generic-term gTLDs, may take approximately five years to be realized and assessed. Any decision to expand the gTLDs beyond corporate, licensee, and partner use would likely be predicated by a L’Oréal market analysis of both the market at the time for new gTLD registrations and consumer adoption of these new Internet addresses.

If L’Oréal’s market analysis justifies this expansion before the sixth year of operation, L’Oréal would, if necessary, work with ICANN to secure an amended Continued Operations Instrument corresponding to a potential increase in registration volume above the current executed level. However, this scenario is unlikely because L’Oréal, in calculating its COI, has already exceeded the baseline guidance set forth by ICANN.

Notwithstanding this potential future expanded use of the .HAIR name space, L’Oréal currently anticipates implementing a throttle mechanism to ensure that any proposed expansion is controlled and responsible. This proposed “time-out” mechanism is described in greater detail in the responses to the financial questions (Questions 45-50 of this application).

The potential use of the .HAIR gTLD will also be driven by L’Oréal’s future business strategies as identified in its annual report and investor filings, see http:⁄⁄www.loreal-finance.com⁄eng. 

18.2 How do you expect that your proposed gTLD will benefit registrants, Internet users, and others?

L’Oréal believes that the proposed .HAIR gTLD has the potential to offer the following benefits to Internet users and consumers: 

- Establish a trusted online hub and marketplace for consumers around the world seeking information, goods, and services related to hair care products, beauty products, advice, communities, technology, sustainability, etc.;
- Provide short and memorable domain names that will facilitate the ease with which consumers can locate this information, goods, and services online;
-Develop a potential platform for the secure access to, and purchase and distribution of hair care and beauty products and information to consumers, in order to minimize the potential for counterfeit or infringing goods and services;
- Ensure fewer incidents of phishing and malware, which are often associated with the mistyping of domain names in the .COM or other spaces; and
- Incorporate enhanced intellectual property rights (IPR) protection mechanisms. 

18.2.1 What is the goal of your proposed gTLD in terms of areas of specialty, service levels, or reputation?

The primary mission and purpose of the .HAIR gTLD is to provide a trusted, hierarchical, and intuitive online hub for L’Oréal, its business units, and partners, to register domain names in a secure online environment. The .HAIR namespace will also serve as a repository to aggregate information, goods and services related to hair care products beauty products, advice, communities, etc., for use by consumers and those within the community. As technologies for delivering content and services evolve, L’Oréal will continue to pursue and explore opportunities for its partners to distribute goods and services to consumers. L’Oréal believes that the .HAIR gTLD has the potential to provide a virtual platform to offer secure, interactive features to deepen and broaden its relationship with existing and new partners, as well as to deepend and broaden these partners’ relationships with their customers and Internet users.

With regard to service level and reputation, L’Oréal will operate the .HAIR gTLD in accordance with its Code of Business Ethics, or “The Way We Work,” found at http:⁄⁄www.loreal.com⁄_en⁄_ww⁄html⁄our-company⁄the-code-of-business-ethics.aspx. 

- RESPECT FOR INDIVIDUALS. We expect all employees and entities to work together in a respectful and open manner. In this way, we will maintain a culture of loyalty, trust and solidarity throughout our business. We should all aim to give credit to other peopleʹs ideas, and recognize the contributions of others. Teamwork is to be encouraged and successes, as well as failures, should be shared. We should listen with generosity and share information as needed, subject to the Group’s rules on confidentiality. 

- RESPECT FOR THE LAW. L’Oréal operates in many countries – home to a wide variety of cultures, laws, and political systems. As a basic rule, we as a business and as individuals in the performance of our duties, must always respect the laws of the countries in which L’Oréal operates. L’Oréal is particularly attached to the spirit and the letter of laws governing:

-Human rights; prohibition of child labor and forced labor; discrimination; working time and remuneration; employees’ collective representation;
-Quality, health, and safety standards;
-The environment;
-Corruption and bribery;
-Taxation and the accurate communication of financial information; and
-Fair competition;

- RESPECT FOR LOCAL CUSTOMS. “The Way We Work” has been drafted with the help of L’Oréal employees across the world. We believe that its core messages will be applicable throughout our operations. We should ensure that, wherever possible, we conduct our activities in a manner sensitive to the cultural and social traditions of communities with which we come into contact. There may be instances when the guidance in the L’Oréal code is at variance with the local law or customs of a particular country. If that is the case, then where local law requires a higher standard than that set out in the code, local law should always apply. If, by contrast, the code provides for a higher standard, then it should supersede local law, unless this results in illegal activity. 

18.2.2 What do you anticipate your proposed gTLD will add to the current space, in terms of competition, differentiation, or innovation?

Unlike most generic-term gTLDs that ICANN has approved over the last decade, which have largely been operated by Internet startups and have been primarily dependent upon ICANN-accredited registrars to market and promote their gTLD, L’Oréal is an established international company with the ability to leverage its existing brands and its commercial network of stores, partnered businesses, including department stores, retailers, and salons across the globe, and their customers to increase the profile of the .HAIR gTLD. 

While some of ICANN’s new gTLDs have previously been the subject of claims regarding increased spam and phishing activities, .HAIR from its launch will be a trusted online source of information about salons and other hair-related goods and services. L’Oréal will follow its established good business practices in working with law enforcement to create an environment and potential marketplace with safeguards designed to minimize fraud and other illegal activity. 

L’Oréal believes that the long-term success of the gTLD will not be measured by the number of domain names registered. Instead, it will be measured by the level of consumer recognition and trust that is placed in the .HAIR gTLD. Using this benchmark, L’Oréal strives to build consumer recognition and trust that rise to the level of that found in the .EDU and .GOV gTLDs.
L’Oréal is also committed to operate the .HAIR gTLD in accordance with its policies on fair competition, as outlined in the L’Oréal Code of Business Ethics cited above. 

18.2.3 What goals does your proposed gTLD have in terms of user experience?

L’Oréal believes that the .HAIR gTLD will provide a single trusted ecosystem experience for the hundreds of millions, if not billions of L’Oréal’s and its commercial partners’ existing and future consumers, who access content through existing online, print, mobile, and social platforms. By providing the foundation of this trusted ecosystem, all domain name registrants in the .HAIR gTLD will be able to share in the benefits of this collective resource. As the leader of the cosmetic and beauty products industry, L’Oréal believes that it can be a pioneer in bringing innovation in consumer choice to this new Internet medium, the .HAIR gTLD. 

18.2.4 Provide a complete description of the applicant’s intended registration policies in support of the goals listed above.

L’Oréal is fully committed to implementing all of ICANN’s consensus policies and other Rights Protection Mechanisms (RPMs) identified in the Applicant Guidebook. Moreover, based upon L’Oréal’s commitment and established track record in providing a safe ecosystem for consumers and vendors, L’Oréal intends to provide best-in-class safeguards that will evolve over time. 

At the time of completing this application, L’Oréal has identified a Rights Protection Mechanism (RPM) that will allow trademark owners to challenge domain names initially reserved by the registry (e.g., generic and geographic names identified in Section 18.1.2). This process will be modeled after the dotAsia Pioneer Policies adopted by dotAsia in connection with its launch, see http:⁄⁄www.wipo.int⁄amc⁄en⁄domains⁄gtld⁄asia⁄.

18.2.5 Will your proposed gTLD impose any measures for protecting the privacy or confidential information of registrants or users? If so, please describe any such measures.

L’Oréal recognizes this is an evolving area of law in which there is no international standard. L’Oréal has a vested interest to make sure that accurate and current information is readily available in connection with each domain name. If unaffiliated third parties are eventually permitted to register personalized domain names in the .HAIR gTLD, L’Oréal will reevaluate its policies at that time to ensure that they are in compliance with the current best-in-class policies.

L’Oréal as a global leader in the hair care and beauty industry, with operations in many legal jurisdictions and on the Internet, L’Oréal respects the privacy of its partners, customers and other consumers. The company employs a variety of physical, electronic, contractual, and managerial safeguards to protect personal and confidential information in its stores and on its websites. L’Oréal strives to ensure that all information not known to the general public is kept strictly confidential. L’Oréal will take similar precautions to protect registrant and user data associated with the .HAIR gTLD. For more information, see http:⁄⁄www.loreal.com⁄_en⁄_ww⁄HTML⁄our-company⁄ethics.asp.

In addition, L’Oréal intends to incorporate contractual language in its Registry-Registrar Agreement (RRA) modeled after language that has been included in the template Registry Agreement that has been successfully utilized by existing ICANN gTLD Registry Operators. The template Registry Agreement states, “Registry Operator shall (i) notify each ICANN-accredited registrar that is a party to the registry-registrar agreement for the TLD of the purposes for which data about any identified or identifiable natural person (“Personal Data”) submitted to Registry Operator by such registrar is collected and used under this Agreement or otherwise and the intended recipients (or categories of recipients) of such Personal Data, and (ii) require such registrar to obtain the consent of each registrant in the TLD for such collection and use of Personal Data. Registry Operator shall take reasonable steps to protect Personal Data collected from such registrar from loss, misuse, unauthorized disclosure, alteration or destruction. Registry Operator shall not use or authorize the use of Personal Data in a way that is incompatible with the notice provided to registrars.ʺ

18.2.6 Describe whether and in what ways outreach and communications will help to achieve your projected benefits.

As noted in 18.2.2, most of the generic-term gTLDs that ICANN has approved have primarily been operated by Internet startups created solely for the provision of domain name registration services, e.g., .INFO (Afilias), .BIZ (NeuStar), and .TRAVEL (Tralliance). L’Oréal is an established international company with the ability to leverage its extensive network of partners, consumers, and related websites to increase the profile of the .HAIR gTLD. While most registries have primarily been dependent upon ICANN-accredited registrars to market and promote their gTLD, L’Oréal has the ability to leverage its existing network of more than 13 million monthly unique worldwide visitors to its more than 350 market-leading websites. 

18.3.1 What operating rules will you adopt to eliminate or minimize social costs (e.g., time or financial resource costs, as well as various types of consumer vulnerabilities)?

Over the past decade, ICANN has approved fifteen new gTLDs which have historically been classified as either generic (.INFO, .BIZ, .NAME) or sponsored (.ASIA, .COOP, .TRAVEL, .JOBS, etc.) gTLDs. It is anticipated that in this current new gTLD application round, many large international corporations will take the opportunity to register generic strings as top-level domains. This is a new approach to the operation of a gTLD in which the business plan relies on three important distinctions between it and the gTLDs that were approved in the 2001 and 2004 rounds of expansion.

First, there are now approximately ten small gTLDs that have fewer than 300,000 registrations and that offer clear models of successful operation; second, at least three experienced technical back-end suppliers (i.e., SRS⁄DNS services) are in place; and third, with many new generic-term gTLDs, well-understood registry operations will be fully supported by an established and financially sound business operating a generic-term gTLD in addition to and in conjunction with its primary business.

The .HAIR gTLD presented here minimizes the risk and uncertainty of prior gTLDs by drawing upon more than a decade of gTLD industry development and by relying upon the established online track record of L’Oréal.

L’Oréal believes that the safeguards set forth in the Applicant Guidebook and additional RPMs identified in Section 18.2.4 are primary drivers that will minimize potential negative social costs. L’Oréal also believes that the initial launch of the .HAIR gTLD through known business entities with existing contractual or membership relationships with L’Oréal will also be an important impediment to any potential negative social costs. 

18.3.2 What other steps will you take to minimize negative consequences⁄costs imposed upon consumers?

L’Oréal believes that the proposed operation of the .HAIR gTLD as set forth in this application has minimum known negative consequences or cost implications to consumers. To the contrary, the proposed operation of this registry will likely lead to direct and quantifiable benefits to consumers. L’Oréal believes that by following the core business ethics it has established over the past century of operations (see Section 18.2.1), it will be able provide real value to consumers, and minimize any potential negative consequences⁄costs. 

18.3.3 How will multiple applications for a particular domain name be resolved, for example, by auction or on a first-come⁄first-serve basis?

L’Oréal does not envision multiple applicants for the same domain name within the .HAIR namespace, given the phased approach to its implementation and its limited initial registrant universe. However, if such an instance should arise, L’Oréal believes that a phased equitable allocation approach, modeled after those that ICANN has previously approved in connection with numerous ICANN Registry Service Evaluation Process (RSEP) requests, would be the most prudent path forward, e.g., RFP, auction, and then first-come-first-serve. 

18.3.4 Explain any cost benefits for registrants you intend to implement (e.g., advantageous pricing, introductory discounts, bulk registration discounts).

L’Oréal currently offers its existing professional commercial partners a range of service offerings that are often bundled together. During the initial rollout of the .HAIR gTLD, it is possible that these domain names will be allocated to existing commercial partners as a value-added service. However, there will likely be no determination made regarding long-term domain name pricing⁄discount policies until such a time that policies regarding expanded registration and use of domain names third parties outside the immediate network of L’Oréal partners are implemented.

18.3.5 Note that the Registry Agreement requires that registrars be offered the option to obtain initial domain name registrations for periods of one to ten years at the discretion of the registrar, but no greater than ten years. Additionally, the Registry Agreement requires advance written notice of price increases. Do you intend to make contractual commitments to registrants regarding the magnitude of price escalation? If so, please describe your plans.

L’Oréal is committed to providing domain name registration services in accordance with the periods set forth in the template Registry Agreement and providing domain name registrants with pricing predictability. However, as noted in the proposed business model (18.1.2), L’Oréal’s current best thinking envisions offering domain name registration services only to existing L’Oréal business units, select licensees and partners at first. Therefore, having an existing contractual relationship with L’Oréal would initially be a condition precedent for the ability to register a .HAIR domain name. 

L’Oréal acknowledges that the current template Registry Agreement requires that the Registry Operator “shall offer registrars the option to obtain registration periods for one to ten years at the discretion of the registrar.” However, L’Oréal will only offer domain name registrations on an annual basis. 

If L’Oréal moves forward with a process whereby parties outside the proposed initial registrant network, without such a stringent commercial agreement, are permitted to register and use .HAIR domain names, L’Oréal is fully committed to providing these domain name registrants with annual registrations that include pricing predictability and notice in connection with the registration of domain names. However, in connection with potential premium generic or geographic domain names there may be additional requirements that would legally bind these registrants in connection with the registration and use of these domain names. These terms will be known by this class of domain name registrants prior to the creation of any legal obligation between the parties.

No

Not Available

No

22 L’Oréal Has Properly Researched This Topic 

L’Oréal (“L’Oréal”) is keenly aware of the sensitivity of national governments in connection with protecting country and territory identifiers in the Domain Name System (DNS). In preparation for answering this question, L’Oréal reviewed the following relevant background material regarding the protection of geographic names in the DNS:

-ICANN Board Resolution 01-92 regarding the methodology developed for the reservation and release of country names in the .INFO top-level domain, see http:⁄⁄www.icann.org⁄en⁄minutes⁄minutes-10sep01.htm;
-ICANN’s Proposed Action Plan on .INFO Country Names, see http:⁄⁄www.icann.org⁄en⁄meetings⁄montevideo⁄action-plan-country-names-09oct01.htm;
-Report of the Second WIPO Internet Domain Name Process: The Recognition and Rights and the Use of Names in the Internet Domain Name System, Chapter 6, Geographic Identifiers, see http:⁄⁄www.wipo.int⁄amc⁄en⁄processes⁄process2⁄report⁄html⁄report.html;
-ICANN’s Governmental Advisory Committee (GAC) Principles Regarding New gTLDs, see https:⁄⁄gacweb.icann.org⁄download⁄attachments⁄1540128⁄gTLD_principles_0.pdf?version=1&modificationDate=1312358178000; and
-ICANN’s Generic Names Supporting Organization Reserved Names Working Group – Final Report, see http:⁄⁄gnso.icann.org⁄issues⁄new-gtlds⁄final-report-rn-wg-23may07.htm.

22.1 Initial Reservation of Country and Territory Names

L’Oréal is committed to initially reserving the country and territory names contained in the internationally recognized lists described in Article 5 of Specification 5 attached to the New gTLD Applicant Guidebook at the second level and at all other levels within the .HAIR generic top-level domain (gTLD), within which L’Oréal will provide for registrations. Specifically, L’Oréal will reserve:

-The short form (in English) of all country and territory names contained on the ISO 3166-1 list, as updated from time to time, including the European Union, which is exceptionally reserved on the ISO 3166-1 list, and its scope extended in August 1999 to any application needing to represent the name European Union, see http:⁄⁄www.iso.org⁄iso⁄support⁄country_codes⁄iso_3166_code_lists⁄iso-3166- 1_decoding_table.htm - EU;

-The United Nations Group of Experts on Geographic Names, Technical Reference Manual for the Standardization of Geographic Names, Part III Names of Countries of the World; and

-The list of United Nations member states in six official United Nations languages prepared by the Working Group on Country Names of the United Nations Conference on the Standardization of Geographic Names.

22.2 Fair & Non-Misleading Use of Geographic Identifiers

L’Oréal is a leading global consumer and professional products company serving the needs of consumers around the world through its 23 brands in five different business segments including consumer products, professional products, luxury products, active cosmetics, and The Body Shop. L’Oréal has 68,900 employees, and its products are available for purchase online, in stores, and in outlets in over 130 countries.

L’Oréal content is available across a range of TLDs, accessible in the .COM, .CA, .CZ, .CO.UK, .FI, .FR, .DE, .IT, .NL, .NO, .PL, .RU, .ES, .TR, .HU, .EU, .AR, .BR, .MX, .HK, and .COM.AU TLDs.

L’Oréal intends to explore the option of providing a hierarchical and intuitive framework for the .HAIR namespace by using geographic identifiers as second-level domain names. L’Oréal believes that the use of geographic identifiers to the left of the TLD and as part of the domain name itself has a direct and material impact on search engine algorithms and their corresponding query results. In addition, such naming conventions are intuitive and practiced by direct navigation Internet users (those who type their intended destination into address bars as opposed to search engines). L’Oréal would like to evaluate if this type of hierarchical and intuitive use of second-level domain names within a gTLD provides increased consumer functionality and innovation, as premised by ICANN.

L’Oréal believes that the .HAIR gTLD can provide an online, single-source identifying function for Internet users around the world navigating to the .HAIR namespace.

22.3 The Legal Protection of Geographic Identifiers

The World Intellectual Property Organization (WIPO) authored an authoritative resource on the current state of the law in connection with the protection of geographic identifiers: ʺ2001 Report of the Second WIPO Internet Domain Name Process: The Recognition of Rights and the Use of Names in the Internet Domain Name Systemʺ (“WIPO Report”). Chapter six of the WIPO Report was devoted exclusively to the protection of geographic identifiers.

From its analysis of the well-established framework against the misuse of geographic identifiers at the international, regional, and national levels, WIPO identified the following two elements for the protection of geographic identifiers: (i) a prohibition of false descriptions of the geographic source of goods; and (ii) a more extensive set of rules prohibiting the misuse of one class of geographic source indicators, known as geographic indications. See WIPO Report (Paragraphs 206 and 210). Neither false descriptions of the geographical source of goods, nor misuse of geographical indications, is present in LʹOrealʹs current or proposed use of geographical identifiers.

Notwithstanding WIPO’s observation that the protection of geographic identifiers is “a difficult area on which views are not only divided, but also ardently held” (Paragraph 237), national governments within the GAC and other international fora have continued to advocate for increased safeguards to protect against the misuse of geographic identifiers within the DNS.

L’Oréal, acting as a responsible global business, seeks to avoid business practices that could potentially mislead consumers. L’Oréal believes, however, that it is important to be able to use geographic identifiers in a fair and non-misleading manner, if such use can benefit Internet users and consumers as proposed in L’Oréal’s business model.

22.4 Fair & Non-Misleading Use of Geographic Identifiers

In undertaking thorough research of this subject matter prior to filing this application, L’Oréal uncovered the following examples of fair and non-misleading use of geographic identifiers used in the existing gTLD domain name space:

Fair Use of National Geographic Identifiers

AUSTRALIA.COOP – Is operated by Co-operatives Australia, the national body for State Co-operative Federations, and provides a valuable resource about cooperatives within Australia.

UK.COOP – Is operated by Co-operatives UK, the national trade body that campaigns for cooperation and works to promote, develop, and unite cooperative enterprises within the United Kingdom. 

NZ.COOP – Is operated by the New Zealand Cooperatives Association, which brings together the country’s cooperative mutual businesses in a not-for-profit incorporated society.

USA.JOBS – Is operated by DirectEmployers Association (ʺDEʺ). While Employ Media, the Registry Operator of the .JOBS gTLD, is currently in a dispute with ICANN regarding the allocation of this and other domain names, DE has a series of partnerships and programs with the United States Department of Labor, the National Association of State Workforce Agencies, and Facebook to help unemployed workers find jobs. 

MALDIVIAN.AERO – Is the dominant domestic air carrier in Maldives, and provides a range of commercial and leisure air transport services.

Fair Use of Regional⁄Local Geographic Identifiers

TEXAS.JOBS – Is operated through a joint effort between DE, Texas Workforce Commission, and the National Labor Exchange to connect job seekers with approximately 96,000 job openings. An additional domain name operated by this joint effort was WORKINTEXAS-VETERANS.JOBS, a resource devoted to helping Texas veterans translate their military skills to jobs in the civil marketplace.

BOISE.COOP – Is operated by Boise Co-op, a member-owned cooperative founded in 1973 by a few dozen individuals who shared a mutual interest in buying healthful and organic food at reasonable prices.

BROOKLYN.COOP – Is operated by Brooklyn Cooperative Federal Credit Union, which began as a modest storefront business in 2001, but is now New York City’s fastest growing credit union and a model for community development credit unions nationwide. 

HYDERABAD.AERO – Is operated by the Hyderabad International Airport and provides a range of interactive services and information for both business and leisure travelers. 

SACRAMENTO.AERO – Is a portal website operated by Sacramento County to provide links to each of the airports serving the Sacramento area: Sacramento International Airport (SMF), Mather Airport (MHR), Executive Airport (SAC), and Franklin Field (F72).

22.5 Protection of Regional and Local Geographic Names for Non-Misleading Use

L’Oréal has stated its intention to consider using non-reserved geographic identifiers as part of a hierarchical and intuitive framework in a fair and non-misleading manner to help consumers navigate the .HAIR namespace. L’Oréal is committed to operating the .HAIR namespace in a manner that minimizes potential consumer confusion, and will actively work with others in the ICANN community regarding any future policy development in this area.

22.6 Potential Future Release of Initially Reserved Names

As a global company, L’Oréal looks forward to collaborating with other new gTLD Registry Operators in potentially working with the GAC to explore processes that could permit the release of initially reserved country names (including ISO-3166 two characters). Specifically, L’Oréal is interested in exploring other Registry Service Evaluation Processes (RSEPs) that have been filed by existing gTLD Registry Operators to release previously reserved domain names. 

22.7 Dispute Resolution

L’Oréal does not envision any potential disputes from governments or public authorities in connection with the registration and use of geographic names within the .HAIR gTLD based upon its proposed use set forth in Answer 18 above. 

However, L’Oréal is committed to working with governments, public authorities, or IGOs that may have a concern regarding the registration of names with national or geographic significance at the second level within .HAIR. Therefore, should there arise any potential disputes, L’Oréal will take immediate steps to undertake a policy development process as described below.

22.8 Creation and Updating the Policies

Should the need arise in the future for the creation or updating of the policies regarding this class of domain names, L’Oréal will act in an open and transparent manner to develop such a policy and⁄or recommendation.

L’Oréal is also committed to the ongoing review and updating of these lists to prevent misleading use of geographic identifiers. Consistent with this commitment, L’Oréal intends to participate in any ongoing ICANN policy discussion regarding the protection of geographic names within the DNS.

VeriSign, Inc. Response to Q23 Registry Services

23.1 Customary Registry Services

As L’Oréal’s selected provider of backend registry services, Verisign provides a comprehensive system and physical security solution that is designed to ensure a TLD is protected from unauthorized disclosure, alteration, insertion, or destruction of registry data. Verisign’s system addresses all areas of security, including information and policies, security procedures, the systems development lifecycle, physical security, system hacks, break-ins, data tampering, and other disruptions to operations. Verisign’s operational environments not only meet the security criteria specified in its customer contractual agreements, thereby preventing unauthorized access to or disclosure of information or resources on the Internet by systems operating in accordance with applicable standards, but also are subject to multiple independent assessments as detailed in the response to Question 30, Security Policy. Verisign’s physical and system security methodology follows a mature, ongoing lifecycle that was developed and implemented many years before the development of the industry standards with which Verisign currently complies. Please see the response to Question 30, Security Policy, for details of the security features of Verisign’s registry services. 

Verisign’s registry services fully comply with relevant standards and best current practice RFCs published by the Internet Engineering Task Force (IETF), including all successor standards, modifications, or additions relating to the DNS and name server operations including without limitation RFCs 1034, 1035, 1982, 2181, 2182, 2671, 3226, 3596, 3597, 3901, 4343, and 4472. Moreover, Verisign’s Shared Registration System (SRS) supports the following IETF Extensible Provisioning Protocol (EPP) specifications, where the Extensible Markup Language (XML) templates and XML schemas are defined in RFC 3915, 5730, 5731, 5732, 5733, and 5734. By strictly adhering to these RFCs, Verisign helps to ensure its registry services do not create a condition that adversely affects the throughput, response time, consistency, or coherence of responses to Internet servers or end systems. Besides its leadership in authoring RFCs for EPP, Domain Name System Security Extensions (DNSSEC), and other DNS services, Verisign has created and contributed to several now well-established IETF standards and is a regular and long-standing participant in key Internet standards forums.

Figure 23 1 summarizes the technical and business components of those registry services, customarily offered by a registry operator (i.e., Verisign), that support this application. These services are currently operational and support both large and small Verisign-managed registries. Customary registry services are provided in the same manner as Verisign provides these services for its existing gTLDs.

Through these established registry services, Verisign has proven its ability to operate a reliable and low-risk registry that supports millions of transactions per day. Verisign is unaware of any potential security or stability concern related to any of these services. 

Registry services defined by this application are not intended to be offered in a manner unique to the new generic top-level domain (gTLD) nor are any proposed services unique to this application’s registry. 

See Figure 0 1: Registry Services. Each proposed service has been previously approved by ICANN to ensure registry security and stability.

In addition the registry services found in Table 23-1, L’Oréal is evaluating offering the following registry services:

1. Imposition of an annual cost recovery based fee to validate registrars that will be providing domain name registration services in the .HAIR gTLD.

2. The use of RFPs (Request for Proposals) and Auctions to determine string allocation in appropriate circumstances.

As further evidence of Verisign’s compliance with ICANN mandated security and stability requirements, Verisign allocates the applicable RFCs to each of the five customary registry services (items A – E above). For each registry service, Verisign also provides evidence in Figure 23 2 of Verisign’s RFC compliance and includes relevant ICANN prior-service approval actions. 

See: Figure 23 2: ICANN RFC Compliance. Verisign currently operates TLDs in full compliance with each registry service’s applicable RFC(s). Each listed Verisign service has been previously approved by ICANN and is now operational on registries under Verisign management.

23.1.1 Critical Operations of the Registry
 
i. Receipt of Data from Registrars Concerning Registration of Domain Names and Name Servers 
See Item A in Figure 23 1 and Figure 23 2. 

ii. Provision to Registrars Status Information Relating to the Zone Servers
Verisign is L’Oréal’s selected provider of backend registry services. Verisign registry services provisions to registrars status information relating to zone servers for the TLD. The services also allow a domain name to be updated with clientHold, serverHold status, which removes the domain name server details from zone files. This ensures that DNS queries of the domain name are not resolved temporarily. When these hold statuses are removed, the name server details are written back to zone files and DNS queries are again resolved. Figure 23 3 describes the domain name status information and zone insertion indicator provided to registrars. The zone insertion indicator determines whether the name server details of the domain name exist in the zone file for a given domain name status. Verisign also has the capability to withdraw domain names from the zone file in near-real time by changing the domain name statuses upon request by customers, courts, or legal authorities as required. 
See: Figure 23 3: Zone Server Status Information. Verisign provisions to registrars status information related to the TLD. 

iii. Dissemination of TLD Zone Files
See Item B in Figure 23 1 and Figure 23 2. 

iv. Operation of the Registry Zone Servers
Verisign is L’Oréal’s selected provider of backend registry services. Verisign, as a company, operates zone servers and serves DNS resolution from 76 geographically distributed resolution sites located in North America, South America, Africa, Europe, Asia, and Australia. Currently, 17 DNS locations are designated primary sites, offering greater capacity than smaller sites comprising the remainder of the Verisign constellation. Verisign also uses Anycast techniques and regional Internet resolution sites to expand coverage, accommodate emergency or surge capacity, and support system availability during maintenance procedures. Verisign operates L’Oréal’s gTLD from a minimum of eight of its primary sites (two on the East Coast of the United States, two on the West Coast of the United States, two in Europe, and two in Asia) and expands resolution sites based on traffic volume and patterns. Further details of the geographic diversity of Verisign’s zone servers are provided in the response to Question 34, Geographic Diversity. Moreover, additional details of Verisign’s zone servers are provided in the response to Question 32, Architecture and the response to Question 35, DNS Service. 
v. Dissemination of Contact and Other Information Concerning Domain Name Server Registrations
See Item C in Figure 23 1 and Figure 23 2. 

23.2 Other Products or Services the Registry Operator Is Required to Provide Because of the Establishment of a Consensus Policy

Verisign, L’Oréal’s selected provider of backend registry services, is a proven supporter of ICANN’s consensus-driven, bottom-up policy development process whereby community members identify a problem, initiate policy discussions, and generate a solution that produces effective and sustained results. Verisign currently provides all of the products or services (collectively referred to as services) that the registry operator is required to provide because of the establishment of a Consensus Policy. For the .HAIR gTLD, Verisign implements these services using the same proven processes and procedures currently in-place for all registries under Verisign’s management. Furthermore, Verisign executes these services on computing platforms comparable to those of other registries under Verisign’s management. Verisign’s extensive experience with consensus policy required services and its proven processes to implement these services greatly minimize any potential risk to Internet security or stability. Details of these services are provided in the following subsections. It shall be noted that consensus policy services required of registrars (e.g., WHOIS Reminder, Expired Domain) are not included in this response. This exclusion is in accordance with the direction provided in the question’s Notes column to address registry operator services. 

23.2.1 Inter-Registrar Transfer Policy (IRTP)
Technical Component: In compliance with the IRTP consensus policy, Verisign, L’Oréal’s selected provider of backend registry services, has designed its registration systems to systematically restrict the transfer of domain names within 60 days of the initial create date. In addition, Verisign has implemented EPP and “AuthInfo” code functionality, which is used to further authenticate transfer requests. The registration system has been designed to enable compliance with the five-day Transfer grace period and includes the following functionality:
- Allows the losing registrar to proactively ‘ACK’ or acknowledge a transfer prior to the expiration of the five-day Transfer grace period
- Allows the losing registrar to proactively ‘NACK’ or not acknowledge a transfer prior to the expiration of the five-day Transfer grace period 
- Allows the system to automatically ACK the transfer request once the five-day Transfer grace period has passed if the losing registrar has not proactively ACK’d or NACK’d the transfer request.

Business Component: All requests to transfer a domain name to a new registrar are handled according to the procedures detailed in the IRTP. Dispute proceedings arising from a registrarʹs alleged failure to abide by this policy may be initiated by any ICANN-accredited registrar under the Transfer Dispute Resolution Policy. L’Oréal’s compliance office serves as the first-level dispute resolution provider pursuant to the associated Transfer Dispute Resolution Policy. As needed, Verisign is available to offer policy guidance as issues arise. 
Security and Stability Concerns: Verisign is unaware of any impact, caused by the service, on throughput, response time, consistency, or coherence of the responses to Internet servers or end-user systems. By implementing the IRTP in accordance with ICANN policy, security is enhanced as all transfer commands are authenticated using the AuthInfo code prior to processing. 

ICANN Prior Approval: Verisign has been in compliance with the IRTP since November 2004 and is available to support L’Oréal in a consulting capacity as needed. 
Unique to the TLD: This service is not provided in a manner unique to the .HAIR gTLD.

23.2.2 Add Grace Period (AGP) Limits Policy
Technical Component: Verisign’s registry system monitors registrars’ Add grace period deletion activity and provides reporting that permits L’Oréal to assess registration fees upon registrars that have exceeded the AGP thresholds stipulated in the AGP Limits Policy. Further, L’Oréal accepts and evaluates all exemption requests received from registrars and determines whether the exemption request meets the exemption criteria. L’Oréal maintains all AGP Limits Policy exemption request activity so that this material may be included within L’Oréal’s Monthly Registry Operator Report to ICANN.

Registrars that exceed the limits established by the policy may submit exemption requests to L’Oréal for consideration. L’Oréal’s compliance office reviews these exemption requests in accordance with the AGP Limits Policy and renders a decision. Upon request, L’Oréal submits associated reporting on exemption request activity to support reporting in accordance with established ICANN requirements.

Business Component: The Add grace period (AGP) is restricted for any gTLD operator that has implemented an AGP. Specifically, for each operator: 
- During any given month, an operator may not offer any refund to an ICANN-accredited registrar for any domain names deleted during the AGP that exceed (i) 10 percent of that registrarʹs net new registrations (calculated as the total number of net adds of one-year through ten-year registrations as defined in the monthly reporting requirement of Operator Agreements) in that month, or (ii) fifty (50) domain names, whichever is greater, unless an exemption has been granted by an operator. 
- Upon the documented demonstration of extraordinary circumstances, a registrar may seek from an operator an exemption from such restrictions in a specific month. The registrar must confirm in writing to the operator how, at the time the names were deleted, these extraordinary circumstances were not known, reasonably could not have been known, and were outside the registrarʹs control. Acceptance of any exemption will be at the sole and reasonable discretion of the operator; however ʺextraordinary circumstancesʺ that reoccur regularly for the same registrar will not be deemed extraordinary. 

In addition to all other reporting requirements to ICANN, L’Oréal identifies each registrar that has sought an exemption, along with a brief description of the type of extraordinary circumstance and the action, approval, or denial that the operator took. 

Security and Stability Concerns: Verisign is unaware of any impact, caused by the policy, on throughput, response time, consistency, or coherence of the responses to Internet servers or end-user systems.
ICANN Prior Approval: Verisign, L’Oréal’s backend registry services provider, has had experience with this policy since its implementation in April 2009 and is available to support L’Oréal in a consulting capacity as needed. 
Unique to the TLD: This service is not provided in a manner unique to the .HAIR gTLD.

23.2.3 Registry Services Evaluation Policy (RSEP)
Technical Component: Verisign, L’Oréal’s selected provider of backend registry services, adheres to all RSEP submission requirements. Verisign has followed the process many times and is fully aware of the submission procedures, the type of documentation required, and the evaluation process that ICANN adheres to. 
Business Component: In accordance with ICANN procedures detailed on the ICANN RSEP website (http:⁄⁄www.icann.org⁄en⁄registries⁄rsep⁄), all gTLD registry operators are required to follow this policy when submitting a request for new registry services.
Security and Stability Concerns: As part of the RSEP submission process, Verisign, L’Oréal’s backend registry services provider, identifies any potential security and stability concerns in accordance with RSEP stability and security requirements. Verisign never launches services without satisfactory completion of the RSEP process and resulting approval.
ICANN Prior Approval: Not applicable.
Unique to the TLD: gTLD RSEP procedures are not implemented in a manner unique to the .HAIR gTLD.

23.3 Products or Services Only a Registry Operator Is Capable of Providing by Reason of Its Designation As the Registry Operator

Verisign, L’Oréal’s selected backend registry services provider, has developed a Registry-Registrar Two-Factor Authentication Service that complements traditional registration and resolution registry services. In accordance with direction provided in Question 23, Verisign details below the technical and business components of the service, identifies any potential threat to registry security or stability, and lists previous interactions with ICANN to approve the operation of the service. The Two-Factor Authentication Service is currently operational, supporting multiple registries under ICANN’s purview. 

L’Oréal is unaware of any competition issue that may require the registry service(s) listed in this response to be referred to the appropriate governmental competition authority or authorities with applicable jurisdiction. ICANN previously approved the service(s), at which time it was determined that either the service(s) raised no competitive concerns or any applicable concerns related to competition were satisfactorily addressed.

23.3.1 Two-Factor Authentication Service
Technical Component: The Registry-Registrar Two-Factor Authentication Service is designed to improve domain name security and assist registrars in protecting the accounts they manage. As part of the service, dynamic one-time passwords augment the user names and passwords currently used to process update, transfer, and⁄or deletion requests. These one-time passwords enable transaction processing to be based on requests that are validated both by “what users know” (i.e., their user name and password) and “what users have” (i.e., a two-factor authentication credential with a one-time-password).

Registrars can use the one-time-password when communicating directly with Verisign’s Customer Service department as well as when using the registrar portal to make manual updates, transfers, and⁄or deletion transactions. The Two-Factor Authentication Service is an optional service offered to registrars that execute the Registry-Registrar Two-Factor Authentication Service Agreement.

Business Component: There is no charge for the Registry-Registrar Two-Factor Authentication Service. It is enabled only for registrars that wish to take advantage of the added security provided by the service.
Security and Stability Concerns: Verisign is unaware of any impact, caused by the service, on throughput, response time, consistency, or coherence of the responses to Internet servers or end-user systems. The service is intended to enhance domain name security, resulting in increased confidence and trust by registrants.
ICANN Prior Approval: ICANN approved the same Two-Factor Authentication Service for Verisign’s use on .COM and .NET on 10 July 2009 (RSEP Proposal 2009004) and for .NAME on 16 February 2011 (RSEP Proposal 2011001). 

Unique to the TLD: This service is not provided in a manner unique to the .HAIR gTLD.

VeriSign, Inc. Response to Question 24 Shared Registration System (SRS) Performance

24.1 Robust Plan for Operating a Reliable SRS

24.1.1 High-Level Shared Registration System (SRS) System Description

VeriSign, Inc. (ʺVerisignʺ), L’Oréal’s selected provider of back-end registry services, provides and operates a robust and reliable SRS that enables multiple registrars to provide domain name registration services in the top-level domain (TLD). Verisign’s proven reliable SRS serves approximately 915 registrars, and Verisign, as a company, has averaged more than 140 million registration transactions per day. The SRS provides a scalable, fault-tolerant platform for the delivery of gTLDs through the use of a central customer database, a Web interface, a standard provisioning protocol (i.e., Extensible Provisioning Protocol, ʺEPPʺ), and a transport protocol (i.e., Secure Sockets Layer, ʺSSLʺ).

The SRS components include:

-Web Interface: Allows customers to access the authoritative database for accounts, contacts, users, authorization groups, product catalog, product subscriptions, and customer notification messages.

-EPP Interface: Provides an interface to the SRS that enables registrars to use EPP to register and manage domains, hosts, and contacts.

-Authentication Provider: A Verisign-developed application, specific to the SRS, that authenticates a user based on a login name, password, and the SSL certificate common name and client IP address.

The SRS is designed to be scalable and fault tolerant by incorporating clustering in multiple tiers of the platform. New nodes can be added to a cluster within a single tier to scale a specific tier, and if one node fails within a single tier, the services will still be available. The SRS allows registrars to manage the .HAIR gTLD domain names in a single architecture.

To flexibly accommodate the scale of its transaction volumes, as well as new technologies, Verisign employs the following design practices:

-Scale for Growth: Scale to handle current volumes and projected growth.

-Scale for Peaks: Scale to twice base capacity to withstand “registration add attacks” from a compromised registrar system.

-Limit Database CPU Utilization: Limit utilization to no more than 50 percent during peak loads.

-Limit Database Memory Utilization: Each user’s login process that connects to the database allocates a small segment of memory to perform connection overhead, sorting, and data caching. Verisign’s standards mandate that no more than 40 percent of the total available physical memory on the database server will be allocated for these functions.

Verisign’s SRS is built upon a three-tier architecture as illustrated in Figure 24-1 and detailed here. 

(See Figure 24-1, SRS Architecture: Verisign’s SRS is hierarchically designed to meet the forecasted registration volume of the .HAIR gTLD, and it can be scaled to meet future registration volume increases.)

-Gateway Layer: The first tier, the gateway servers, uses EPP to communicate with registrars. These gateway servers then interact with application servers, which comprise the second tier.

-Application Layer: The application servers contain business logic for managing and maintaining the registry business. The business logic is particular to each TLD’s business rules and requirements. The flexible internal design of the application servers allows Verisign to easily leverage existing business rules to apply to the .HAIR gTLD. The application servers store L’Oréal’s data in the registry database, which comprises the third and final tier. This simple, industry-standard design has been highly effective with other customers for whom Verisign provides backend registry services.

-Database Layer: The database is the heart of this architecture. It stores all the essential information provisioned from registrars through the gateway servers. Separate servers query the database, extract updated zone and WHOIS information, validate that information, and distribute it around the clock to Verisign’s worldwide domain name resolution sites.
 
-Scalability and Performance: Verisign, L’Oréal’s selected back-end registry services provider, implements its scalable SRS on a supportable infrastructure that achieves the availability requirements in Specification 10. Verisign employs the design patterns of simplicity and parallelism in both its software and systems, based on its experience that these factors contribute most significantly to scalability and reliable performance. Going counter to feature-rich development patterns, Verisign intentionally minimizes the number of lines of code between the end-user and the data delivered. The result is a network of restorable components that provide rapid, accurate updates. Figure 24-2 depicts EPP traffic flows and local redundancy in Verisign’s SRS provisioning architecture. As detailed in the figure, local redundancy is maintained for each layer as well as each piece of equipment. This built-in redundancy enhances operational performance while enabling the future system scaling necessary to meet additional demand created by this or future registry applications.

(See Figure 24-2, Built-in SRS Redundancy: Verisign’s SRS system is built upon multiple layers of redundancy to ensure the system remains highly available.)

Besides improving scalability and reliability, local SRS redundancy enables Verisign to take down individual system components for maintenance and upgrades, with little to no performance impact. With Verisign’s redundant design, Verisign can perform routine maintenance while the remainder of the system remains online and unaffected. For the .HAIR gTLD registry, this flexibility minimizes unplanned downtime and provides a more consistent end-user experience.

24.1.2 Representative Network Diagrams

Figure 24-3 provides a summary network diagram of L’Oréal’s selected back-end registry services provider’s (Verisign’s) SRS. This configuration at both the primary and alternate-primary Verisign data centers provides a highly reliable backup capability. Data is continuously replicated between both sites to ensure failover to the alternate-primary site can be implemented expeditiously to support both planned and unplanned outages.

(See Figure 24-3, SRS Network Diagram: Verisign’s fully redundant SRS design and geographically separated data centers help ensure service level availability requirements are met.)

24.1.3 Number of Servers

As L’Oréal’s selected provider of back-end registry services, Verisign continually reviews its server deployments for all aspects of its registry service. Verisign evaluates usage based on peak performance objectives as well as current transaction volumes, which drive the quantity of servers in its implementations. Verisign’s scaling is based on the following factors:
Server configuration is based on CPU, memory, disk IO, total disk, and network throughput projections.

Server quantity is determined through statistical modeling to fulfill overall performance objectives as defined by both the service availability and the server configuration. 

To ensure continuity of operations for the .HAIR gTLD, Verisign uses a minimum of 100 dedicated servers per SRS site. These servers are virtualized to meet demand.

24.1.4 Description of Interconnectivity with Other Registry Systems

Figure 24-4 provides a technical overview of the L’Oréal’s selected back-end registry services provider’s (Verisign’s) SRS, showing how the SRS component fits into this larger system and interconnects with other system components.

(See Figure 24-4, Technical Overview: Verisign’s SRS provides the registrar-facing component of the system establishing the zone file needed to enable DNS and WHOIS services.)

24.1.5 Frequency of Synchronization Between Servers

As L’Oréal’s selected provider of back-end registry services, Verisign uses synchronous replication to keep the Verisign SRS continuously in sync between the two data centers. This synchronization is performed in near-real time, thereby supporting rapid failover should a failure occur or a planned maintenance outage be required.

24.1.6 Synchronization Scheme

Verisign uses synchronous replication to keep the Verisign SRS continuously in sync between the two data centers. Because the alternate-primary site is continuously up, and built using an identical design to the primary data center, it is classified as a “hot standby.”

24.2 Scalability and Performance Are Consistent with the overall business approach and planned size of the registry

Verisign is an experienced back-end registry provider that has developed and uses proprietary system scaling models to guide the growth of its TLD supporting infrastructure. These models direct Verisign’s infrastructure scaling to include, but not be limited to, server capacity, data storage volume, and network throughput that are aligned to projected demand and usage patterns. Verisign periodically updates these models to account for the adoption of more capable and cost-effective technologies.

Verisign’s scaling models are proven predictors of needed capacity and related cost. As such, they provide the means to link the projected infrastructure needs of the .HAIR gTLD with necessary implementation and sustainment cost. Using the projected usage volume for the ʺMost Likelyʺ scenario (defined in Question 46, Template 1 – Financial Projections: Most Likely) as an input to its scaling models, Verisign derived the necessary infrastructure required to implement and sustain this gTLD. Verisign’s pricing for the back-end registry services it provides to L’Oréal fully accounts for cost related to this infrastructure, which is provided as “Total Critical Registry Function Cash Outflows” (Template 1, Line IIb.G) within the Question 46 financial projections response of this application.

24.3 Technical plan that is adequately resourced in the planned costs detailed in the financial section

Verisign, the L’Oréal’s selected provider of back-end registry services, is an experienced back-end registry provider that has developed a set of proprietary resourcing models to project the number and type of personnel resources necessary to operate a TLD. Verisign routinely adjusts these staffing models to account for new tools and process innovations. These models enable Verisign to continually right-size its staff to accommodate projected demand and meet service level agreements as well as Internet security and stability requirements. Using the projected usage volume for the ʺMost Likelyʺ scenario (defined in Question 46, Template 1 – Financial Projections: Most Likely) as an input to its staffing models, Verisign derived the necessary personnel levels required for this gTLD’s initial implementation and ongoing maintenance. Verisign’s pricing for the back-end registry services provided to L’Oréal fully accounts for this personnel-related cost, which is provided as “Total Critical Registry Function Cash Outflows” (Template 1, Line IIb.G) within the Question 46 financial projections response of this application.

Verisign employs more than 1,040 individuals of which more than 775 comprise its technical work force. (Current statistics are publicly available in Verisign’s quarterly filings.) Drawing from this pool of on-hand and fully committed technical resources, Verisign has maintained DNS operational accuracy and stability 100 percent of the time for more than 13 years for .COM, proving Verisign’s ability to align personnel resource growth to the scale increases of Verisign’s TLD service offerings.

Verisign projects it will use the following personnel roles, which are described in Section 5 of the response to Question 31 of this application, Technical Overview of Proposed Registry, to support SRS performance:

-Application Engineers: 19
-Database Administrators: 8 
-Database Engineers: 3
-Network Administrators: 11 
-Network Architects: 4 
-Project Managers: 25
-Quality Assurance Engineers: 11 
-SRS System Administrators: 13 
-Storage Administrators: 4
-Systems Architects: 9

To implement and manage the .HAIR gTLD as described in this application, Verisign, L’Oréal’s selected back-end registry services provider, scales, as needed, the size of each technical area now supporting its portfolio of TLDs. Consistent with its resource modeling, Verisign periodically reviews the level of work to be performed and adjusts staff levels for each technical area. 

When usage projections indicate a need for additional staff, Verisign’s internal staffing group uses an in-place staffing process to identify qualified candidates. These candidates are then interviewed by the lead of the relevant technical area. By scaling one common team across all its TLDs instead of creating a new entity to manage only this proposed gTLD, Verisign realizes significant economies of scale and ensures its TLD best practices are followed consistently. This consistent application of best practices helps ensure the security and stability of both the Internet and this proposed gTLD, as Verisign holds all contributing staff members accountable to the same procedures that guide its execution of the Internet’s largest TLDs (i.e., .COM and .NET). Moreover, by augmenting existing teams, Verisign affords new employees the opportunity to be mentored by existing senior staff. This mentoring minimizes startup learning curves and helps ensure that new staff members properly execute their duties.

24.4 Evidence of Compliance with Specification 6 and 10 to the Registry Agreement

24.4.1 Section 1.2 (EPP) of Specification 6, Registry Interoperability and Continuity Specifications

Verisign, L’Oréal’s selected back-end registry services provider, provides these services using its SRS, which complies fully with Specification 6, Section 1.2 of the Registry Agreement. In using its SRS to provide back-end registry services, Verisign implements and complies with relevant existing RFCs (i.e., 5730, 5731, 5732, 5733, 5734, and 5910) and intends to comply with RFCs that may be published in the future by the Internet Engineering Task Force (IETF), including successor standards, modifications, or additions thereto relating to the provisioning and management of domain names that use EPP. In addition, Verisign’s SRS includes a Registry Grace Period (RGP) and thus complies with RFC 3915 and its successors. Details of the Verisign SRS’ compliance with RFC SRS⁄EPP are provided in the response to Question 25, Extensible Provisioning Protocol, of this application. Verisign does not use functionality outside the base EPP RFCs, although proprietary EPP extensions are documented in Internet-Draft format following the guidelines described in RFC 3735 within the response to Question 25 of this application. Moreover, prior to deployment, L’Oréal will provide to ICANN updated documentation of all the EPP objects and extensions supported in accordance with Specification 6, Section 1.2.

24.4.2 Specification 10, EPP Registry Performance Specifications

Verisign’s SRS meets all EPP Registry Performance Specifications detailed in Specification 10, Section 2. Evidence of this performance can be verified by a review of the .COM and .NET Registry Operator’s Monthly Reports, which Verisign files with ICANN. These reports detail Verisign’s operational status of the .COM and .NET registries, which use an SRS design and approach comparable to the one proposed for the .HAIR gTLD. These reports provide evidence of Verisign’s ability to meet registry operation service level agreements (SLAs) comparable to those detailed in Specification 10. The reports are accessible at the following URL: http:⁄⁄www.icann.org⁄en⁄tlds⁄monthly-reports⁄.

In accordance with EPP Registry Performance Specifications detailed in Specification 10, Verisignʹs SRS meets the following performance attributes:

-EPP service availability: ≤ 864 minutes of downtime (≈98%)
-EPP session-command round trip time (RTT): ≤4000 milliseconds (ms), for at least 90 percent of the commands
-EPP query-command RTT: ≤2000 ms, for at least 90 percent of the commands
-EPP transform-command RTT: ≤4000 ms, for at least 90 percent of the commands

VeriSign, Inc. Response to Question 25 Extensible Provisioning Protocol (EPP)

25.1 Complete knowledge and understanding of this aspect of registry technical requirements
VeriSign, Inc. (“Verisign’), L’Oréal’s selected back-end registry services provider, has used Extensible Provisioning Protocol (EPP) since its inception and possesses complete knowledge and understanding of EPP registry systems. Its first EPP implementation – for a thick registry for the .NAME generic top-level domain (gTLD) – was in 2002. Since then Verisign has continued its RFC-compliant use of EPP in multiple TLDs. as detailed in Figure 25-1. 

(See: Figure 25 1: EPP Implementations. Verisign has repeatedly proven its ability to successfully implement EPP for both small and large registries.)

Verisign’s understanding of EPP and its ability to implement code that complies with the applicable RFCs is unparalleled. Mr. Scott Hollenbeck, Verisign’s director of software development, authored the Extensible Provisioning Protocol and continues to be fully engaged in its refinement and enhancement (U.S. Patent Number 7299299 – Shared registration system for registering domain names). Verisign has also developed numerous new object mappings and object extensions following the guidelines in RFC 3735 (Guidelines for Extending the Extensible Provisioning Protocol). Mr. James Gould, a principal engineer at Verisign, led and co-authored the most recent EPP Domain Name System Security Extensions (DNSSEC) RFC effort (RFC 5910).

All registry systems for which Verisign is the registry operator or provides back-end registry services use EPP. Upon approval of this application, Verisign will use EPP to provide the back-end registry services for this gTLD. The .COM, .NET, and .NAME registries for which Verisign is the registry operator use an SRS design and approach comparable to the one proposed for this gTLD. Approximately 915 registrars use the Verisign EPP service, and the registry system performs more than 140 million EPP transactions daily without performance issues or restrictive maintenance windows. The processing time service level agreement (SLA) requirements for the Verisign-operated .NET gTLD are the strictest of the current Verisign managed gTLDs. All processing times for Verisign-operated gTLDs can be found in ICANN’s Registry Operator’s Monthly Reports at http:⁄⁄www.icann.org⁄en⁄tlds⁄monthly-reports⁄.

Verisign has also been active on the Internet Engineering Task Force (IETF) Provisioning Registry Protocol (provreg) working group and mailing list since work started on the EPP protocol in 2000. This working group provided a forum for members of the Internet community to comment on Mr. Scott Hollenbeck’s initial EPP drafts, which Mr. Hollenbeck refined based on input and discussions with representatives from registries, registrars, and other interested parties. The working group has since concluded, but the mailing list is still active to enable discussion of different aspects of EPP.

25.1.1 EPP Interface with Registrars

Verisign, L’Oréal’s selected back-end registry services provider, fully supports the features defined in the EPP specifications and provides a set of software development kits (SDK) and tools to help registrars build secure and stable interfaces. Verisign’s SDKs give registrars the option of either fully writing their own EPP client software to integrate with the Shared Registration System (SRS), or using the Verisign-provided SDKs to aid them in the integration effort. Registrars can download the Verisign EPP SDKs and tools from the registrar website (http:⁄⁄www.Verisign.com⁄domain-name-services⁄current-registrars⁄epp-sdk⁄index.html).
The EPP SDKs provide a host of features including connection pooling, Secure Sockets Layer (SSL), and a test server (stub server) to run EPP tests against. One tool—the EPP tool—provides a web interface for creating EPP Extensible Markup Language (XML) commands and sending them to a configurable set of target servers. This helps registrars in creating the template XML and testing a variety of test cases against the EPP servers. An Operational Test and Evaluation (OT&E) environment, which runs the same software as the production system so approved registrars can integrate and test their software before moving into a live production environment, is also available.

25.2 Technical plan scope⁄scale consistent with the overall business approach and planned size of the registry

Verisign, L’Oréal’s selected back-end registry services provider, is an experienced back-end registry provider that has developed and uses proprietary system scaling models to guide the growth of its TLD supporting infrastructure. These models direct Verisign’s infrastructure scaling to include, but not be limited to, server capacity, data storage volume, and network throughput that are aligned to projected demand and usage patterns. Verisign periodically updates these models to account for the adoption of more capable and cost-effective technologies.

Verisign’s scaling models are proven predictors of needed capacity and related cost. As such, they provide the means to link the projected infrastructure needs of the .HAIR gTLD with necessary implementation and sustainment cost. Using the projected usage volume for the most likely scenario (defined in Question 46, Template 1 – Financial Projections: Most Likely) as an input to its scaling models, Verisign derived the necessary infrastructure required to implement and sustain this gTLD. Verisign’s pricing for the back-end registry services it provides to L’Oréal fully accounts for cost related to this infrastructure, which is provided as “Total Critical Registry Function Cash Outflows” (Template 1, Line IIb.G) within the Question 46 financial projections response.

25.3 Technical plan that is adequately resourced in the planned costs detailed in the financial section

Verisign, L’Oréal’s selected back-end registry services provider, is an experienced back-end registry provider that has developed a set of proprietary resourcing models to project the number and type of personnel resources necessary to operate a TLD. Verisign routinely adjusts these staffing models to account for new tools and process innovations. These models enable Verisign to continually right-size its staff to accommodate projected demand and meet service level agreements as well as Internet security and stability requirements. Using the projected usage volume for the most likely scenario (defined in Question 46, Template 1 – Financial Projections: Most Likely) as an input to its staffing models, Verisign derived the necessary personnel levels required for this gTLD’s initial implementation and ongoing maintenance.

Verisign’s pricing for the back-end registry services it provides to L’Oréal fully accounts for cost related to this infrastructure, which is provided as “Total Critical Registry Function Cash Outflows” (Template 1, Line IIb.G) within the Question 46 financial projections response. 
Verisign employs more than 1,040 individuals of which more than 775 comprise its technical work force. (Current statistics are publicly available in Verisign’s quarterly filings.) Drawing from this pool of on-hand and fully committed technical resources, Verisign has maintained DNS operational accuracy and stability 100 percent of the time for more than 13 years for .com, proving Verisign’s ability to align personnel resource growth to the scale increases of Verisign’s TLD service offerings.

Verisign projects it will use the following personnel roles, which are described in Section 5 of the response to Question 31, Technical Overview of Proposed Registry, to support the provisioning of EPP services:
- Application Engineers: 19 
- Database Engineers: 3 
- Quality Assurance Engineers: 11 

To implement and manage the .HAIR gTLD as described in this application, Verisign, L’Oréal’s selected back-end registry services provider, scales, as needed, the size of each technical area now supporting its portfolio of TLDs. Consistent with its resource modeling, Verisign periodically reviews the level of work to be performed and adjusts staff levels for each technical area.

When usage projections indicate a need for additional staff, Verisign’s internal staffing group uses an in-place staffing process to identify qualified candidates. These candidates are then interviewed by the lead of the relevant technical area. By scaling one common team across all its TLDs instead of creating a new entity to manage only this proposed gTLD, Verisign realizes significant economies of scale and ensures its TLD best practices are followed consistently. This consistent application of best practices helps ensure the security and stability of both the Internet and this proposed gTLD, as Verisign holds all contributing staff members accountable to the same procedures that guide its execution of the Internet’s largest TLDs (i.e., .COM and .NET). Moreover, by augmenting existing teams, Verisign affords new employees the opportunity to be mentored by existing senior staff. This mentoring minimizes start-up learning curves and helps ensure that new staff members properly execute their duties.

25.4 Ability to comply with Relevant RFCs

Verisign, L’Oréal’s selected back-end registry services provider, incorporates design reviews, code reviews, and peer reviews into its software development lifecycle (SDLC) to ensure compliance with the relevant RFCs. Verisign’s dedicated QA team creates extensive test plans and issues internal certifications when it has confirmed the accuracy of the code in relation to the RFC requirements. Verisign’s QA organization is independent from the development team within engineering. This separation helps Verisign ensure adopted processes and procedures are followed, further ensuring that all software releases fully consider the security and stability of the TLD.

For the .HAIR gTLD, the Shared Registration System (SRS) complies with the following IETF EPP specifications, where the XML templates and XML schemas are defined in the following specifications:
- EPP RGP 3915 (http:⁄⁄www.apps.ietf.org⁄rfc⁄rfc3915.html): EPP Redemption Grace Period (RGP) Mapping specification for support of RGP statuses and support of Restore Request and Restore Report (authored by Verisign’s Scott Hollenbeck)
- EPP 5730 (http:⁄⁄tools.ietf.org⁄html⁄rfc5730): Base EPP specification (authored by Verisign’s Scott Hollenbeck)
- EPP Domain 5731 (http:⁄⁄tools.ietf.org⁄html⁄rfc5731): EPP Domain Name Mapping specification (authored by Verisign’s Scott Hollenbeck)
- EPP Host 5732 (http:⁄⁄tools.ietf.org⁄html⁄rfc5732): EPP Host Mapping specification (authored by Verisign’s Scott Hollenbeck)
- EPP Contact 5733 (http:⁄⁄tools.ietf.org⁄html⁄rfc5733): EPP Contact Mapping specification (authored by Verisign’s Scott Hollenbeck)
- EPP TCP 5734 (http:⁄⁄tools.ietf.org⁄html⁄rfc5734): EPP Transport over Transmission Control Protocol (TCP) specification (authored by Verisign’s Scott Hollenbeck)
- EPP DNSSEC 5910 (http:⁄⁄tools.ietf.org⁄html⁄rfc5910): EPP Domain Name System Security Extensions (DNSSEC) Mapping specification (authored by Verisign’s James Gould and Scott Hollenbeck)

25.5 Proprietary EPP Extensions

Verisign, L’Oréal’s selected back-end registry services provider, uses its SRS to provide registry services. The SRS supports the following EPP specifications, which Verisign developed following the guidelines in RFC 3735, where the XML templates and XML schemas are defined in the specifications:
- IDN Language Tag (http:⁄⁄www.verisigninc.com⁄assets⁄idn-language-tag.pdf): EPP internationalized domain names (IDN) language tag extension used for IDN domain name registrations
- RGP Poll Mapping (http:⁄⁄www.verisigninc.com⁄assets⁄whois-info-extension.pdf): EPP mapping for an EPP poll message in support of Restore Request and Restore Report
- WHOIS Info Extension (http:⁄⁄www.verisigninc.com⁄assets⁄whois-info-extension.pdf): EPP extension for returning additional information needed for transfers
- EPP ConsoliDate Mapping (http:⁄⁄www.verisigninc.com⁄assets⁄consolidate-mapping.txt): EPP mapping to support a Domain Sync operation for synchronizing domain name expiration dates
- NameStore Extension (http:⁄⁄www.verisigninc.com⁄assets⁄namestore-extension.pdf): EPP extension for routing with an EPP intelligent gateway to a pluggable set of back-end products and services
- Low Balance Mapping (http:⁄⁄www.verisigninc.com⁄assets⁄low-balance-mapping.pdf): EPP mapping to support low balance poll messages that proactively notify registrars of a low balance (available credit) condition

As part of the 2006 implementation report to bring the EPP RFC documents from Proposed Standard status to Draft Standard status, an implementation test matrix was completed. Two independently developed EPP client implementations based on the RFCs were tested against the Verisign EPP server for the domain, host, and contact transactions. No compliance-related issues were identified during this test, providing evidence that these extensions comply with RFC 3735 guidelines and further demonstrating Verisign’s ability to design, test, and deploy an RFC-compliant EPP implementation.

25.5.1 EPP Templates and Schemas

The EPP XML schemas are formal descriptions of the EPP XML templates. They are used to express the set of rules to which the EPP templates must conform in order to be considered valid by the schema. The EPP schemas define the building blocks of the EPP templates, describing the format of the data and the different EPP commands’ request and response formats. The current EPP implementations managed by Verisign, L’Oréal’s selected back-end registry services provider, use these EPP templates and schemas, as will the proposed TLD. For each proprietary XML template⁄schema Verisign provides a reference to the applicable template and includes the schema.

25.5.1.1 XML templates⁄schema for idnLang-1.0
Template: The templates for idnLang-1.0 can be found in Chapter 3, EPP Command Mapping of the relevant EPP documentation, http:⁄⁄www.verisigninc.com⁄assets⁄idn-language-tag.pdf.
Schema: This schema describes the extension mapping for the IDN language tag. The mapping extends the EPP domain name mapping to provide additional features required for the provisioning of IDN domain name registrations.

〈?xml version=ʺ1.0ʺ encoding=ʺUTF-8ʺ?〉

〈schema targetNamespace=ʺhttp:⁄⁄www.Verisign.com⁄epp⁄idnLang-1.0ʺ
 xmlns:idnLang=ʺhttp:⁄⁄www.Verisign.com⁄epp⁄idnLang-1.0ʺ
 xmlns=ʺhttp:⁄⁄www.w3.org⁄2001⁄XMLSchemaʺ
 elementFormDefault=ʺqualifiedʺ〉

〈annotation〉
 〈documentation〉
 Extensible Provisioning Protocol v1.0 domain name
 extension schema for IDN Lang Tag.
 〈⁄documentation〉
〈⁄annotation〉

〈!--
Child elements found in EPP commands.
--〉
 〈element name=ʺtagʺ type=ʺlanguageʺ⁄〉

 〈!--
 End of schema.
 --〉
〈⁄schema〉

25.5.1.2 XML templates⁄schema for rgp-poll-1.0
Template: The templates for rgp-poll-1.0 can be found in Chapter 3, EPP Command Mapping of the relevant EPP documentation, http:⁄⁄www.verisigninc.com⁄assets⁄rgp-poll-mapping.pdf.
Schema: This schema describes the extension mapping for poll notifications. The mapping extends the EPP base mapping to provide additional features for registry grace period (RGP) poll notifications.

〈?xml version=ʺ1.0ʺ encoding=ʺUTF-8ʺ?〉

〈schema targetNamespace=ʺhttp:⁄⁄www.Verisign.com⁄epp⁄rgp-poll-1.0ʺ
 xmlns:rgp-poll=ʺhttp:⁄⁄www.Verisign.com⁄epp⁄rgp-poll-1.0ʺ
 xmlns:eppcom=ʺurn:ietf:params:xml:ns:eppcom-1.0ʺ
 xmlns:rgp=ʺurn:ietf:params:xml:ns:rgp-1.0ʺ
 xmlns=ʺhttp:⁄⁄www.w3.org⁄2001⁄XMLSchemaʺ
 elementFormDefault=ʺqualifiedʺ〉

〈!--
Import common element types.
--〉
〈import namespace=ʺurn:ietf:params:xml:ns:eppcom-1.0ʺ
 schemaLocation=ʺeppcom-1.0.xsdʺ⁄〉
〈import namespace=ʺurn:ietf:params:xml:ns:rgp-1.0ʺ
 schemaLocation=ʺrgp-1.0.xsdʺ⁄〉

〈annotation〉
 〈documentation〉
 Extensible Provisioning Protocol v1.0
 Verisign poll notification specification for registry grace period
 poll notifications.
 〈⁄documentation〉
〈⁄annotation〉

〈!--
Child elements found in EPP commands.
--〉
〈element name=ʺpollDataʺ type=ʺrgp-poll:pollDataTypeʺ⁄〉

〈!--
Child elements of the 〈notifyData〉 element for the
redemption grace period.
--〉
〈complexType name=ʺpollDataTypeʺ〉
 〈sequence〉
 〈element name=ʺnameʺ type=ʺeppcom:labelTypeʺ⁄〉
 〈element name=ʺrgpStatusʺ type=ʺrgp:statusTypeʺ⁄〉
 〈element name=ʺreqDateʺ type=ʺdateTimeʺ⁄〉
 〈element name=ʺreportDueDateʺ type=ʺdateTimeʺ⁄〉
 〈⁄sequence〉
〈⁄complexType〉
〈
!--
End of schema.
--〉
〈⁄schema〉

25.5.1.3 XML templates⁄schema for whoisInf-1.0
Template: The templates for whoisInf-1.0 can be found in Chapter 3, EPP Command Mapping of the relevant EPP documentation, http:⁄⁄www.verisigninc.com⁄assets⁄whois-info-extension.pdf.
Schema: This schema describes the extension mapping for the Whois Info extension. The mapping extends the EPP domain name mapping to provide additional features for returning additional information needed for transfers.

〈?xml version=ʺ1.0ʺ encoding=ʺUTF-8ʺ?〉

〈schema targetNamespace=ʺhttp:⁄⁄www.Verisign.com⁄epp⁄whoisInf-1.0ʺ
 xmlns:whoisInf=ʺhttp:⁄⁄www.Verisign.com⁄epp⁄whoisInf-1.0ʺ
 xmlns:eppcom=ʺurn:ietf:params:xml:ns:eppcom-1.0ʺ
 xmlns=ʺhttp:⁄⁄www.w3.org⁄2001⁄XMLSchemaʺ
 elementFormDefault=ʺqualifiedʺ〉

〈import namespace=ʺurn:ietf:params:xml:ns:eppcom-1.0ʺ
 schemaLocation=ʺeppcom-1.0.xsdʺ⁄〉

〈annotation〉
 〈documentation〉
 Extensible Provisioning Protocol v1.0
 extension schema for Whois Info
 〈⁄documentation〉
〈⁄annotation〉

〈!--
Possible Whois Info extension root elements.
--〉
〈element name=ʺwhoisInfʺ type=ʺwhoisInf:whoisInfTypeʺ⁄〉
〈element name=ʺwhoisInfDataʺ type=ʺwhoisInf:whoisInfDataTypeʺ⁄〉

〈!--
Child elements for the 〈whoisInf〉 extension which
is used as an extension to an info command.
--〉
〈complexType name=ʺwhoisInfTypeʺ〉
 〈sequence〉
 〈element name=ʺflagʺ type=ʺbooleanʺ⁄〉
 〈⁄sequence〉
〈⁄complexType〉

〈!--
Child elements for the 〈whoisInfData〉 extension which
is used as an extension to the info response.
--〉
〈complexType name=ʺwhoisInfDataTypeʺ〉
 〈sequence〉
 〈element name=ʺregistrarʺ type=ʺstringʺ⁄〉
 〈element name=ʺwhoisServerʺ type=ʺeppcom:labelTypeʺ
 minOccurs=ʺ0ʺ⁄〉
 〈element name=ʺurlʺ type=ʺtokenʺ minOccurs=ʺ0ʺ⁄〉
 〈element name=ʺirisServerʺ type=ʺeppcom:labelTypeʺ
 minOccurs=ʺ0ʺ⁄〉
 〈⁄sequence〉
 〈⁄complexType〉

〈⁄schema〉

25.5.1.4 XML templates⁄schema for sync-1.0 (consoliDate)
Template: The templates for sync-1.0 can be found in Chapter 3, EPP Command Mapping of the relevant EPP documentation, http:⁄⁄www.verisigninc.com⁄assets⁄consolidate-mapping.txt.
Schema: This schema describes the extension mapping for the synchronization of domain name registration period expiration dates. This service is known as ʺConsoliDate.ʺ The mapping extends the EPP domain name mapping to provide features that allow a protocol client to end a domain name registration period on a specific month and day.

 〈?xml version=ʺ1.0ʺ encoding=ʺUTF-8ʺ?〉

 〈schema targetNamespace=ʺhttp:⁄⁄www.Verisign.com⁄epp⁄sync-1.0ʺ
 xmlns:sync=ʺhttp:⁄⁄www.Verisign.com⁄epp⁄sync-1.0ʺ
 xmlns=ʺhttp:⁄⁄www.w3.org⁄2001⁄XMLSchemaʺ
 elementFormDefault=ʺqualifiedʺ〉

 〈annotation〉
 〈documentation〉
 Extensible Provisioning Protocol v1.0 domain name
 extension schema for expiration date synchronization.
 〈⁄documentation〉
 〈⁄annotation〉

 〈!--
 Child elements found in EPP commands.
 --〉
 〈element name=ʺupdateʺ type=ʺsync:updateTypeʺ⁄〉

 〈!--
 Child elements of the 〈update〉 command.
 --〉
 〈complexType name=ʺupdateTypeʺ〉
 〈sequence〉
 〈element name=ʺexpMonthDayʺ type=ʺgMonthDayʺ⁄〉
 〈⁄sequence〉
 〈⁄complexType〉

 〈!--
 End of schema.
 --〉
 〈⁄schema〉

25.5.1.5 XML templates⁄schema for namestoreExt-1.1
Template: The templates for namestoreExt-1.1 can be found in Chapter 3, EPP Command Mapping of the relevant EPP documentation, http:⁄⁄www.verisigninc.com⁄assets⁄namestore-extension.pdf.
Schema: This schema describes the extension mapping for the routing with an EPP intelligent gateway to a pluggable set of back-end products and services. The mapping extends the EPP domain name and host mapping to provide a sub-product identifier to identify the target sub-product that the EPP operation is intended for.

〈?xml version=ʺ1.0ʺ encoding=ʺUTF-8ʺ?〉

〈schema targetNamespace=ʺhttp:⁄⁄www.Verisign-grs.com⁄epp⁄namestoreExt-1.1ʺ
 xmlns=ʺhttp:⁄⁄www.w3.org⁄2001⁄XMLSchemaʺ
 xmlns:namestoreExt=ʺhttp:⁄⁄www.Verisign-grs.com⁄epp⁄namestoreExt-1.1ʺ
 elementFormDefault=ʺqualifiedʺ〉

〈annotation〉
 〈documentation〉
 Extensible Provisioning Protocol v1.0 Namestore extension schema
 for destination registry routing.
 〈⁄documentation〉
〈⁄annotation〉

〈!-- General Data types. --〉
〈simpleType name=ʺsubProductTypeʺ〉
 〈restriction base=ʺtokenʺ〉
 〈minLength value=ʺ1ʺ⁄〉
 〈maxLength value=ʺ64ʺ⁄〉
 〈⁄restriction〉
〈⁄simpleType〉

〈complexType name=ʺextAnyTypeʺ〉
 〈sequence〉
 〈any namespace=ʺ##otherʺ maxOccurs=ʺunboundedʺ⁄〉
 〈⁄sequence〉
〈⁄complexType〉

〈!-- Child elements found in EPP commands and responses. --〉
〈element name=ʺnamestoreExtʺ type=ʺnamestoreExt:namestoreExtTypeʺ⁄〉

〈!-- Child elements of the 〈product〉 command. --〉
〈complexType name=ʺnamestoreExtTypeʺ〉
 〈sequence〉
 〈element name=ʺsubProductʺ
 type=ʺnamestoreExt:subProductTypeʺ⁄〉
 〈⁄sequence〉
〈⁄complexType〉

〈!-- Child response elements. --〉
〈element name=ʺnsExtErrDataʺ type=ʺnamestoreExt:nsExtErrDataTypeʺ⁄〉

〈!-- 〈prdErrData〉 error response elements. --〉
〈complexType name=ʺnsExtErrDataTypeʺ〉
 〈sequence〉
 〈element name=ʺmsgʺ type=ʺnamestoreExt:msgTypeʺ⁄〉
 〈⁄sequence〉
 〈⁄complexType〉

〈!-- 〈prdErrData〉 〈msg〉 element. --〉
〈complexType name=ʺmsgTypeʺ〉
 〈simpleContent〉
 〈extension base=ʺnormalizedStringʺ〉
 〈attribute name=ʺcodeʺ
 type=ʺnamestoreExt:prdErrCodeTypeʺ use=ʺrequiredʺ⁄〉
 〈attribute name=ʺlangʺ type=ʺlanguageʺ default=ʺenʺ⁄〉
 〈⁄extension〉
 〈⁄simpleContent〉
〈⁄complexType〉

〈!-- 〈prdErrData〉 error response codes. --〉
〈simpleType name=ʺprdErrCodeTypeʺ〉
 〈restriction base=ʺunsignedShortʺ〉
 〈enumeration value=ʺ1ʺ⁄〉
 〈⁄restriction〉
〈⁄simpleType〉

〈!-- End of schema. --〉
〈⁄schema〉

25.5.1.6 XML templates⁄schema for lowbalance-poll-1.0
Template: The templates for lowbalance-poll-1.0 can be found in Chapter 3, EPP Command Mapping of the relevant EPP documentation, http:⁄⁄www.verisigninc.com⁄assets⁄low-balance-mapping.pdf.
Schema: This schema describes the extension mapping for the account low balance notification. The mapping extends the EPP base mapping so an account holder can be notified via EPP poll messages whenever the available credit for an account reaches or goes below the credit threshold.

〈?xml version=ʺ1.0ʺ encoding=ʺUTF-8ʺ?〉

〈schema targetNamespace=ʺhttp:⁄⁄www.Verisign.com⁄epp⁄lowbalance-poll-1.0ʺ
 xmlns:lowbalance-poll=ʺhttp:⁄⁄www.Verisign.com⁄epp⁄lowbalance-poll-1.0ʺ
 xmlns:eppcom=ʺurn:ietf:params:xml:ns:eppcom-1.0ʺ
 xmlns=ʺhttp:⁄⁄www.w3.org⁄2001⁄XMLSchemaʺ
 elementFormDefault=ʺqualifiedʺ〉

〈!-- Import common element types.--〉
〈import namespace=ʺurn:ietf:params:xml:ns:eppcom-1.0ʺ
 schemaLocation=ʺeppcom-1.0.xsdʺ⁄〉

〈annotation〉
 〈documentation〉
 Extensible Provisioning Protocol v1.0
 Verisign poll notification specification for low balance notifications.
 〈⁄documentation〉
〈⁄annotation〉

〈!--Child elements found in EPP commands.--〉
〈element name=ʺpollDataʺ type=ʺlowbalance-poll:pollDataTypeʺ⁄〉

〈!--Child elements of the 〈notifyData〉 element for the low balance.--〉
〈complexType name=ʺpollDataTypeʺ〉
 〈sequence〉
 〈element name=ʺregistrarNameʺ type=ʺeppcom:labelTypeʺ⁄〉
 〈element name=ʺcreditLimitʺ type=ʺnormalizedStringʺ⁄〉
 〈element name=ʺcreditThresholdʺ
 type=ʺlowbalance-poll:thresholdTypeʺ⁄〉
 〈element name=ʺavailableCreditʺ type=ʺnormalizedStringʺ⁄〉
 〈⁄sequence〉
〈⁄complexType〉

〈complexType name=ʺthresholdTypeʺ〉
 〈simpleContent〉
 〈extension base=ʺnormalizedStringʺ〉
 〈attribute name=ʺtypeʺ
 type=ʺlowbalance-poll:thresholdValueTypeʺ
 use=ʺrequiredʺ⁄〉
 〈⁄extension〉
 〈⁄simpleContent〉
〈⁄complexType〉

〈simpleType name=ʺthresholdValueTypeʺ〉
 〈restriction base=ʺtokenʺ〉
 〈enumeration value=ʺFIXEDʺ⁄〉
 〈enumeration value=ʺPERCENTʺ⁄〉
 〈⁄restriction〉
〈⁄simpleType〉

〈!-- End of schema.--〉
〈⁄schema〉


25.6 Proprietary EPP Extension Consistency with Registration Lifecycle

L’Oréal’s selected back-end registry services provider’s (Verisign’s) proprietary EPP extensions, defined in Section 5 above, are consistent with the registration lifecycle documented in the response to Question 27, Registration Lifecycle. Details of the registration lifecycle are presented in that response. As new registry features are required, Verisign develops proprietary EPP extensions to address new operational requirements. Consistent with ICANN procedures Verisign adheres to all applicable Registry Services Evaluation Process (RSEP) procedures.

VeriSign, Inc. Response to Question 26, WHOIS

26.1 Complete knowledge and understanding of this aspect of registry technical requirements
VeriSign, Inc. (ʺVerisignʺ) L’Oréal’s selected back-end registry services provider, has operated the WHOIS lookup service for the gTLDs and ccTLDs it manages since 1991, and will provide these proven services for the .HAIR gTLD registry. In addition, it continues to work with the Internet community to improve the utility of WHOIS data, while thwarting its application for abusive uses.

26.1.1 High-Level WHOIS System Description
Like all other components of L’Oréal’s selected back-end registry services provider’s (Verisign’s) registry service, Verisign’s WHOIS system is designed and built for both reliability and performance in full compliance with applicable RFCs. Verisign’s current WHOIS implementation has answered more than five billion WHOIS queries per month for the TLDs it manages, and has experienced more than 250,000 queries per minute in peak conditions. The proposed gTLD uses a WHOIS system design and approach that is comparable to the current implementation. Independent quality control testing ensures Verisign’s WHOIS service is RFC-compliant through all phases of its lifecycle. 
Verisignʹs redundant WHOIS databases further contribute to overall system availability and reliability. The hardware and software for its WHOIS service is architected to scale both horizontally (by adding more servers) and vertically (by adding more CPUs and memory to existing servers) to meet future need.
Verisign can fine-tune access to its WHOIS database on an individual Internet Protocol (IP) address basis, and it works with registrars to help ensure their services are not limited by any restriction placed on WHOIS. Verisign provides near real-time updates for WHOIS services for the TLDs under its management. As information is updated in the registration database, it is propagated to the WHOIS servers for quick publication. These updates align with the near real-time publication of Domain Name System (DNS) information as it is updated in the registration database. This capability is important for the .HAIR gTLD registry as it is Verisign’s experience that when DNS data is updated in near real time, so should WHOIS data be updated to reflect the registration specifics of those domain names.
Verisign’s WHOIS response time has been less than 500 milliseconds for 95 percent of all WHOIS queries in .COM, .NET, .TV, and .CC. The response time in these TLDs, combined with Verisign’s capacity, enables the WHOIS system to respond to up to 30,000 searches (or queries) per second for a total capacity of 2.6 billion queries per day.

The WHOIS software written by Verisign complies with RFC 3912. Verisign uses an advanced in-memory database technology to provide exceptional overall system performance and security. In accordance with RFC 3912, Verisign provides a website at whois.nic.HAIR that provides free public query-based access to the registration data.
Verisign currently operates both thin and thick WHOIS systems.

Verisign commits to implementing a RESTful WHOIS service upon finalization of agreements with the IETF (Internet Engineering Task Force).
26.1.1a Provided Functionalities for User Interface

To use the WHOIS service via port 43, the user enters the applicable parameter on the command line as illustrated here:

-For domain name: whois EXAMPLE.TLD
-For registrar: whois ʺregistrar Example Registrar, Inc.ʺ
-For name server: whois ʺNS1.EXAMPLE.TLDʺ or whois ʺname server (IP address)ʺ

To use the WHOIS service via the Web-based directory service search interface:
-Go to http:⁄⁄whois.nic.HAIR
-Click on the appropriate button (Domain, Registrar, or Name Server)
-Enter the applicable parameter:
--Domain name, including the TLD (e.g., EXAMPLE.TLD)
--Full name of the registrar, including punctuation (e.g., Example Registrar, Inc.)
--Full host name or the IP address (e.g., NS1.EXAMPLE.TLD or 198.41.3.39)
-Click on the Submit button.

26.1.1b Provisions to Ensure That Access Is Limited to Legitimate Authorized Users and Is in Compliance with Applicable Privacy Laws or Policies
To further promote reliable and secure WHOIS operations, Verisign, L’Oréal’s selected back-end registry services provider, has implemented rate-limiting characteristics within the WHOIS service software. For example, to prevent data mining or other abusive behavior, the service can throttle a specific requestor if the query rate exceeds a configurable threshold. In addition, QoS technology enables rate limiting of queries before they reach the servers, which helps protect against denial of service (DoS) and distributed denial of service (DDoS) attacks. 
Verisign’s software also permits restrictions on search capabilities. For example, wild card searches can be disabled. If needed, it is possible to temporarily restrict and⁄or block requests coming from specific IP addresses for a configurable amount of time. Additional features that are configurable in the WHOIS software include help files, headers and footers for WHOIS query responses, statistics, and methods to memory map the database. Furthermore, Verisign is European Union (EU) Safe Harbor certified and has worked with European data protection authorities to address applicable privacy laws by developing a tiered WHOIS access structure that requires users who require access to more extensive data to (i) identify themselves, (ii) confirm that their use is for a specified purpose and (iii) enter into an agreement governing their use of the more extensive WHOIS data.
26.1.2 Relevant Network Diagrams
Figure 26-1 provides a summary network diagram of the WHOIS service provided by Verisign, L’Oréal’s selected back-end registry services provider. The figure details the configuration with one resolution⁄WHOIS site. For the .HAIR gTLD, Verisign provides WHOIS service from six of its 17 primary sites based on the proposed gTLD’s traffic volume and patterns. A functionally equivalent resolution architecture configuration exists at each WHOIS site.
26.1.3 IT and Infrastructure Resources
Figure 26-2 summarizes the IT and infrastructure resources that Verisign, L’Oréal’s selected back-end registry services provider, uses to provision WHOIS services from Verisign primary resolution sites. As needed, virtual machines are created based on actual and projected demand.
See Figure 26-2
26.1.4 Description of Interconnectivity with Other Registry Systems
Figure 26-3 provides a technical overview of the registry system provided by Verisign, L’Oréal’s selected back-end registry services provider, and shows how the WHOIS service component fits into this larger system and interconnects with other system components. 

26.1.5 Frequency of Synchronization Between Servers
Synchronization between the SRS and the geographically distributed WHOIS resolution sites occurs approximately every three minutes. Verisign, L’Oréal’s selected back-end registry services provider, uses a two-part WHOIS update process to ensure WHOIS data is accurate and available. Every 12 hours an initial file is distributed to each resolution site. This file is a complete copy of all WHOIS data fields associated with each domain name under management. As interactions with the SRS cause the WHOIS data to be changed, these incremental changes are distributed to the resolution sites as an incremental file update. This incremental update occurs approximately every three minutes. When the new 12-hour full update is distributed, this file includes all past incremental updates. Verisign’s approach to frequency of synchronization between servers meets the Performance Specifications defined in Specification 10 of the Registry Agreement for new gTLDs.

26.2 Technical plan scope⁄scale consistent with the overall business approach and planned size of the registry
Verisign, L’Oréal’s selected back-end registry services provider, is an experienced back-end registry provider that has developed and uses proprietary system scaling models to guide the growth of its TLD supporting infrastructure. These models direct Verisign’s infrastructure scaling to include, but not be limited to, server capacity, data storage volume, and network throughput that are aligned to projected demand and usage patterns. Verisign periodically updates these models to account for the adoption of more capable and cost-effective technologies.
Verisign’s scaling models are proven predictors of needed capacity and related cost. As such, they provide the means to link the projected infrastructure needs of the .HAIR gTLD with necessary implementation and sustainment cost. Using the projected usage volume for the ʺMost Likelyʺ scenario (defined in Question 46, Template 1 – Financial Projections: Most Likely) as an input to its scaling models, Verisign derived the necessary infrastructure required to implement and sustain this gTLD. Verisign’s pricing for the back-end registry services it provides to L’Oréal fully accounts for cost related to this infrastructure, which is provided as “Total Critical Registry Function Cash Outflows” (Template 1, Line IIb.G) within the Question 46 financial projections response of this application.

26.3 Technical plan that is adequately resourced in the planned costs detailed in the financial section
Verisign, L’Oréal’s selected back-end registry services provider, is an experienced back-end registry provider that has developed a set of proprietary resourcing models to project the number and type of personnel resources necessary to operate a TLD. Verisign routinely adjusts these staffing models to account for new tools and process innovations. These models enable Verisign to continually right-size its staff to accommodate projected demand and meet service level agreements as well as Internet security and stability requirements. Using the projected usage volume for the ʺMost Likelyʺ scenario (defined in Question 46, Template 1 – Financial Projections: Most Likely) as an input to its staffing models, Verisign derived the necessary personnel levels required for this gTLD’s initial implementation and ongoing maintenance. Verisign’s pricing for the back-end registry services it provides to L’Oréal fully accounts for cost related to this infrastructure, which is provided as “Total Critical Registry Function Cash Outflows” (Template 1, Line IIb.G) within the Question 46 financial projections response of this application.
Verisign employs more than 1,040 individuals of which more than 775 comprise its technical work force. (Current statistics are publicly available in Verisign’s quarterly filings.) Drawing from this pool of on-hand and fully committed technical resources, Verisign has maintained DNS operational accuracy and stability 100 percent of the time for more than 13 years for .COM, proving Verisign’s ability to align personnel resource growth to the scale increases of Verisign’s TLD service offerings. 
Verisign projects it will use the following personnel roles, which are described in Section 5 of the response to Question 31, Technical Overview of Proposed Registry, of this application to support WHOIS services:
-Application Engineers: 19
-Database Engineers: 3
-Quality Assurance Engineers: 11
To implement and manage the .HAIR gTLD as described in this application, Verisign, L’Oréal’s selected back-end registry services provider, scales, as needed, the size of each technical area now supporting its portfolio of TLDs. Consistent with its resource modeling, Verisign periodically reviews the level of work to be performed and adjusts staff levels for each technical area. 
When usage projections indicate a need for additional staff, Verisign’s internal staffing group uses an in-place staffing process to identify qualified candidates. These candidates are then interviewed by the lead of the relevant technical area. By scaling one common team across all its TLDs instead of creating a new entity to manage only this proposed gTLD, Verisign realizes significant economies of scale and ensures its TLD best practices are followed consistently. This consistent application of best practices helps ensure the security and stability of both the Internet and this proposed gTLD, as Verisign holds all contributing staff members accountable to the same procedures that guide its execution of the Internet’s largest TLDs (i.e., .COM and .NET). Moreover, by augmenting existing teams, Verisign affords new employees the opportunity to be mentored by existing senior staff. This mentoring minimizes startup learning curves and helps ensure that new staff members properly execute their duties.
26.4 Compliance with Relevant RFC
L’Oréal’s selected back-end registry services provider’s (Verisign’s) WHOIS service complies with the data formats defined in Specification 4 of the Registry Agreement. Verisign will provision WHOIS services for registered domain names and associated data in the top-level domain (TLD). Verisign’s WHOIS services are accessible over Internet Protocol version 4 (IPv4) and Internet Protocol version 6 (IPv6), via both Transmission Control Protocol (TCP) port 43 and a Web-based directory service at whois.nic..HAIR, which, in accordance with RFC 3912, provides free public query-based access to domain name, registrar, and name server lookups. Verisign’s proposed WHOIS system meets all requirements as defined by ICANN for each registry under Verisign management. Evidence of this successful implementation, and thus compliance with the applicable RFCs, can be verified by a review of the .COM and .NET Registry Operator’s Monthly Reports that Verisign files with ICANN. These reports provide evidence of Verisign’s ability to meet registry operation service level agreements (SLAs) comparable to those detailed in Specification 10. The reports are accessible at the following URL: http:⁄⁄www.icann.org⁄en⁄tlds⁄monthly-reports⁄.
26.5 Compliance with Specifications 4 and 10 of Registry Agreement
In accordance with Specification 4, Verisign, L’Oréal’s selected back-end registry services provider, provides a WHOIS service that is available via both port 43 in accordance with RFC 3912, and a Web-based directory service at whois.nic..HAIR also in accordance with RFC 3912, thereby providing free public query-based access. Verisign acknowledges that ICANN reserves the right to specify alternative formats and protocols, and upon such specification, Verisign will implement such alternative specification as soon as reasonably practicable.
The format of the following data fields conforms to the mappings specified in Extensible Provisioning Protocol (EPP) RFCs 5730 – 5734 so the display of this information (or values returned in WHOIS responses) can be uniformly processed and understood: domain name status, individual and organizational names, address, street, city, state⁄province, postal code, country, telephone and fax numbers, email addresses, date, and times.
Specifications for data objects, bulk access, and lookups comply with Specification 4 and are detailed in the following subsections, provided in both bulk access and lookup modes. 
Bulk Access Mode: This data is provided on a daily schedule to a party designated from time to time in writing by ICANN. The specification of the content and format of this data, and the procedures for providing access, shall be as stated below, until revised in the ICANN Registry Agreement.
The data is provided in three files:
-Domain Name File: For each domain name, the file provides the domain name, server name for each name server, registrar ID, and updated date.
-Name Server File: For each registered name server, the file provides the server name, each IP address, registrar ID, and updated date.
-Registrar File: For each registrar, the following data elements are provided: registrar ID, registrar address, registrar telephone number, registrar email address, WHOIS server, referral URL, updated date, and the name, telephone number, and email address of all the registrarʹs administrative, billing, and technical contacts.
Lookup Mode: Figures 26-4 through 26-6 provide the query and response format for domain name, registrar, and name server data objects. 
See Figure 26-4
See Figure 26-5
See Figure 26-6
26.5.1 Specification 10, RDDS Registry Performance Specifications
The WHOIS service meets all registration data directory services (RDDS) registry performance specifications detailed in Specification 10, Section 2. Evidence of this performance can be verified by a review of the .COM and .NET Registry Operator’s Monthly Reports that Verisign files monthly with ICANN. These reports are accessible from the ICANN website at the following URL: http:⁄⁄www.icann.org⁄en⁄tlds⁄monthly-reports⁄.
In accordance with RDDS registry performance specifications detailed in Specification 10, Verisignʹs WHOIS service meets the following proven performance attributes:
-RDDS availability: GBP 864 min of downtime (greater than 98%)
-RDDS query RTT: GBP 2000 ms, for at least 95% of the queries
-RDDS update time: GBP 60 min, for at least 95% of the probes
26.6 Searchable WHOIS
Verisign, L’Oréal’s selected back-end registry services provider, provides a searchable WHOIS service for the .HAIR gTLD. Verisign has experience in providing tiered access to WHOIS for the .NAME registry, and uses these methods and control structures to help reduce potential malicious use of the function. The searchable WHOIS system currently uses Apache’s Lucene full text search engine to index relevant WHOIS content with near-real time incremental updates from the provisioning system.
Features of the Verisign searchable WHOIS function include:
-Provision of a Web-based searchable directory service
-Ability to perform partial match, at least, for the following data fields: domain name, contacts and registrant’s name, and contact and registrant’s postal address, including all the sub-fields described in EPP (e.g., street, city, state, or province)
-Ability to perform exact match, at least, on the following fields: registrar ID, name server name, and name server’s IP address (only applies to IP addresses stored by the registry, i.e., glue records)
-Ability to perform Boolean search supporting, at least, the following logical operators to join a set of search criteria: AND, OR, NOT 
-Search results that include domain names that match the selected search criteria

Verisign’s implementation of searchable WHOIS is EU Safe Harbor certified and includes appropriate access control measures that help ensure that only legitimate authorized users can use the service. Furthermore, Verisign’s compliance office monitors current ICANN policy and applicable privacy laws or policies to help ensure the solution is maintained within compliance of applicable regulations. Features of these access control measures include: 
-All unauthenticated searches are returned as thin results
-Registry system authentication is used to grant access to appropriate users for thick WHOIS data search results.
-Account access is granted by the L’Oréalʹs defined .HAIR gTLD admin user.
Potential Forms of Abuse and Related Risk Mitigation: Leveraging its experience providing tiered access to WHOIS for the .NAME registry and interacting with ICANN, data protection authorities, and applicable industry groups, Verisign, L’Oréal’s selected back-end registry services provider, is knowledgeable of the likely data mining forms of abuse associated with a searchable WHOIS service. Figure 26-7 summarizes these potential forms of abuse and Verisign’s approach to mitigate the identified risk.
See Figure 26-7.

VeriSign, Inc. Response to Q27 Registration Lifecycle

27.1 Complete Knowledge and Understanding of Registration Lifecycles and States

Starting with domain name registration and continuing through domain name delete operations, L’Oréal’s selected backend registry services provider’s (Verisign’s) registry implements the full registration lifecycle for domain names supporting the operations in the Extensible Provisioning Protocol (EPP) specification. The registration lifecycle of the domain name starts with registration and traverses various states as specified in the following sections. The registry system provides options to update domain names with different server and client status codes that block operations based on the EPP specification. The system also provides different grace periods for different billable operations, where the price of the billable operation is credited back to the registrar if the billable operation is removed within the grace period. Together Figure 27 1 and Figure 27 2 define the registration states comprising the registration lifecycle and explain the trigger points that cause state-to-state transitions. States are represented as green rectangles within Figure 27 1.

See: Figure 27 1: Registration Lifecycle State Diagram

See: Figure 27 2: Registration States
27.1.1 Registration Lifecycle of Create⁄Update⁄Delete

The following section details the create⁄update⁄delete processes and the related renewal process that Verisign, L’Oréal’s selected backend registry services provider, follows. For each process, this response defines the process function and its characterization, and as appropriate provides a process flow chart.

Create Process: The domain name lifecycle begins with a registration or what is referred to as a Domain Name Create operation in EPP. The system fully supports the EPP Domain Name Mapping as defined by RFC 5731, where the associated objects (e.g., hosts and contacts) are created independent of the domain name.

Process Characterization: The Domain Name Create command is received, validated, run through a set of business rules, persisted to the database, and committed in the database if all business rules pass. The domain name is included with the data flow to the DNS and WHOIS resolution services. If no name servers are supplied, the domain name is not included with the data flow to the DNS. A successfully created domain name has the created date and expiration date set in the database. Creates are subject to grace periods as described in Section 1.3 of this response, Add Grace Period, Redemption Grace Period, and Notice Periods for Renewals or Transfers. 

The Domain Name Create operation is detailed in Figure 27 3 and requires the following attributes:
- A domain name that meets the string restrictions.
- A domain name that does not already exist.
- The registrar is authorized to create a domain name in .HAIR.
- The registrar has available credit.
- A valid Authorization Information (Auth-Info) value.
- Required contacts (e.g., registrant, administrative contact, technical contact, and billing contact) are specified and exist.
- The specified name servers (hosts) exist, and there is a maximum of 13 name servers.
- A period in units of years with a maximum value of 10 (default period is one year).

See: Figure 27 3: Create Process Flow Chart

Renewal Process: The domain name can be renewed unless it has any form of Pending Delete, Pending Transfer, or Renew Prohibited.

A request for renewal that sets the expiry date to more than ten years in the future is denied. The registrar must pass the current expiration date (without the timestamp) to support the idempotent features of EPP, where sending the same command a second time does not cause unexpected side effects.

Automatic renewal occurs when a domain name expires. On the expiration date, the registry extends the registration period one year and debits the registrar account balance. In the case of an auto-renewal of the domain name, a separate Auto-Renew grace period applies. Renewals are subject to grace periods as described in Section 1.3 of this response, Add Grace Period, Redemption Grace Period, and Notice Periods for Renewals or Transfers.

Process Characterization: The Domain Name Renew command is received, validated, authorized, and run through a set of business rules. The data is updated and committed in the database if it passes all business rules. The updated domain name’s expiration date is included in the flow to the WHOIS resolution service. 

The Domain Name Renew operation is detailed in Figure 27 4 and requires the following attributes:
- A domain name that exists and is sponsored by the requesting registrar.
- The registrar is authorized to renew a domain name in .HAIR.
- The registrar has available credit.
- The passed current expiration date matches the domain name’s expiration date.
- A period in units of years with a maximum value of 10 (default period is one year). A domain name expiry past ten years is not allowed.

See: Figure 27 4: Renewal Process Flow Chart

Registrar Transfer Procedures. A registrant may transfer his⁄her domain name from his⁄her current registrar to another registrar. The database system allows a transfer as long as the transfer is not within the initial 60 days, per industry standard, of the original registration date. 
The registrar transfer process goes through many process states, which are described in detail below, unless it has any form of Pending Delete, Pending Transfer, or Transfer Prohibited.

A transfer can only be initiated when the appropriate Auth-Info is supplied. The Auth-Info for transfer is only available to the current registrar. Any other registrar requesting to initiate a transfer on behalf of a registrant must obtain the Auth-Info from the registrant.

The Auth-Info is made available to the registrant upon request. The registrant is the only party other than the current registrar that has access to the Auth-Info. Registrar transfer entails a specified extension of the expiry date for the object. The registrar transfer is a billable operation and is charged identically to a renewal for the same extension of the period. This period can be from one to ten years, in one-year increments.

Because registrar transfer involves an extension of the registration period, the rules and policies applying to how the resulting expiry date is set after transfer are based on the renewal policies on extension.

Per industry standard, a domain name cannot be transferred to another registrar within the first 60 days after registration. This restriction continues to apply if the domain name is renewed during the first 60 days. Transfer of the domain name changes the sponsoring registrar of the domain name, and also changes the child hosts (ns1.sample.xyz) of the domain name (sample .xyz). 

The domain name transfer consists of five separate operations:
- Transfer Request (Figure 27 5): Executed by a non-sponsoring registrar with the valid Auth-Info provided by the registrant. The Transfer Request holds funds of the requesting registrar but does not bill the registrar until the transfer is completed. The sponsoring registrar receives a Transfer Request poll message.
- Transfer Cancel (Figure 27 6): Executed by the requesting registrar to cancel the pending transfer. The held funds of the requesting registrar are reversed. The sponsoring registrar receives a Transfer Cancel poll message.
- Transfer Approve (Figure 27 7): Executed by the sponsoring registrar to approve the Transfer Request. The requesting registrar is billed for the Transfer Request and the sponsoring registrar is credited for an applicable Auto-Renew grace period. The requesting registrar receives a Transfer Approve poll message.
- Transfer Reject (Figure 27 8): Executed by the sponsoring registrar to reject the pending transfer. The held funds of the requesting registrar are reversed. The requesting registrar receives a Transfer Reject poll message.
- Transfer Query (Figure 27 9): Executed by either the requesting registrar or the sponsoring registrar of the last transfer.

The registry auto-approves a transfer if the sponsoring registrar takes no action. The requesting registrar is billed for the Transfer Request and the sponsoring registrar is credited for an applicable Auto-Renew grace period. The requesting registrar and the sponsoring registrar receive a Transfer Auto-Approve poll message. 

See: Figure 27 5: Transfer Request Process
See: Figure 27 6: Transfer Cancel Process
See: Figure 27 7: Transfer Approve Process
See: Figure 27 8: Transfer Reject Process
See: Figure 27 9: Transfer Query Process

Delete Process: A registrar may choose to delete the domain name at any time. 

Process Characterization: The domain name can be deleted, unless it has any form of Pending Delete, Pending Transfer, or Delete Prohibited.

A domain name is also prohibited from deletion if it has any in-zone child hosts that are name servers for domain names. For example, the domain name “sample.xyz” cannot be deleted if an in-zone host “ns.sample.xyz” exists and is a name server for “sample2.xyz.”
If the Domain Name Delete occurs within the Add grace period, the domain name is immediately deleted and the sponsoring registrar is credited for the Domain Name Create. If the Domain Name Delete occurs outside the Add grace period, it follows the Redemption grace period (RGP) lifecycle.

Update Process: The sponsoring registrar can update the following attributes of a domain name:
- Auth-Info
- Name servers
- Contacts (i.e., registrant, administrative contact, technical contact, and billing contact)
- Statuses (e.g., Client Delete Prohibited, Client Hold, Client Renew Prohibited, Client Transfer Prohibited, Client Update Prohibited)

Process Characterization: Updates are allowed provided that the update includes the removal of any Update Prohibited status. The Domain Name Update operation is detailed in Figure 27 10. 
A domain name can be updated unless it has any form of Pending Delete, Pending Transfer, or Update Prohibited.

See: Figure 27 10: Update Process Flow Chart

27.1.2 Pending, Locked, Expired, and Transferred 
Verisign, L’Oréal’s selected backend registry services provider, handles pending, locked, expired, and transferred domain names as described here. When the domain name is deleted after the five-day Add grace period, it enters into the Pending Delete state. The registrant can return its domain name to active any time within the five-day Pending Delete grace period. After the five-day Pending Delete grace period expires, the domain name enters the Redemption Pending state and then is deleted by the system. The registrant can restore the domain name at any time during the Redemption Pending state.

When a non-sponsoring registrar initiates the domain name transfer request, the domain name enters Pending Transfer state and a notification is mailed to the sponsoring registrar for approvals. If the sponsoring registrar doesn’t respond within five days, the Pending Transfer expires and the transfer request is automatically approved.

EPP specifies both client (registrar) and server (registry) status codes that can be used to prevent registry changes that are not intended by the registrant. Currently, many registrars use the client status codes to protect against inadvertent modifications that would affect their customers’ high-profile or valuable domain names. 

Verisign’s registry service supports the following client (registrar) and server (registry) status codes:
- clientHold
- clientRenewProhibited
- clientTransferProhibited
- clientUpdateProhibited
- clientDeleteProhibited
- serverHold
- serverRenewProhibited
- serverTransferProhibited
- serverUpdateProhibited
- serverDeleteProhibited 

27.1.3 Add Grace Period, Redemption Grace Period, and Notice Periods for Renewals or Transfers
Verisign, L’Oréal’s selected backend registry services provider, handles Add grace periods, Redemption grace periods, and notice periods for renewals or transfers as described here.
- Add Grace Period: The Add grace period is a specified number of days following the initial registration of the domain name. The current value of the Add grace period for all registrars is five days. 
- Redemption Grace Period: If the domain name is deleted after the five-day grace period expires, it enters the Redemption grace period and then is deleted by the system. The registrant has an option to use the Restore Request command to restore the domain name within the Redemption grace period. In this scenario, the domain name goes to Pending Restore state if there is a Restore Request command within 30 days of the Redemption grace period. From the Pending Restore state, it goes either to the OK state, if there is a Restore Report Submission command within seven days of the Restore Request grace period, or a Redemption Period state if there is no Restore Report Submission command within seven days of the Restore Request grace period. 
- Renew Grace Period: The Renew⁄Extend grace period is a specified number of days following the renewal⁄extension of the domain name’s registration period. The current value of the Renew⁄Extend grace period is five days. 
- Auto-Renew Grace Period: All auto-renewed domain names have a grace period of 45 days. 
- Transfer Grace Period: Domain names have a five-day Transfer grace period. 

27.1.4 Aspects of the Registration Lifecycle Not Covered by Standard EPP RFCs
L’Oréal’s selected backend registry services provider’s (Verisign’s) registration lifecycle processes and code implementations adhere to the standard EPP RFCs related to the registration lifecycle. By adhering to the RFCs, Verisign’s registration lifecycle is complete and addresses each registration-related task comprising the lifecycle. No aspect of Verisign’s registration lifecycle is not covered by one of the standard EPP RFCs and thus no additional definitions are provided in this response.

27.2 Consistency with any specific commitments made to registrants as adapted to the overall business approach for the proposed gTLD

The registration lifecycle described above applies to the .HAIR gTLD as well as other TLDs managed by Verisign, L’Oréal’s selected backend registry services provider; thus Verisign remains consistent with commitments made to its registrants. No unique or specific registration lifecycle modifications or adaptations are required to support the overall business approach for the .HAIR gTLD. 
To accommodate a range of registries, Verisign’s registry implementation is capable of offering both a thin and thick WHOIS implementation, which is also built upon Verisign’s award-winning ATLAS infrastructure.
27.3 Compliance with relevant RFCS

L’Oréal’s selected backend registry services provider’s (Verisign’s) registration lifecycle complies with applicable RFCs, specifically RFCs 5730 – 5734 and 3915. The system fully supports the EPP Domain Name Mapping as defined by RFC 5731, where the associated objects (e.g., hosts and contacts) are created independent of the domain name.

In addition, in accordance with RFCs 5732 and 5733, the Verisign registration system enforces the following domain name registration constraints:
- Uniqueness⁄Multiplicity: A second-level domain name is unique in the .HAIR database. Two identical second-level domain names cannot simultaneously exist in .HAIR. Further, a second-level domain name cannot be created if it conflicts with a reserved domain name.
- Point of Contact Associations: The domain name is associated with the following points of contact. Contacts are created and managed independently according to RFC 5733. 
-- Registrant
-- Administrative contact
-- Technical contact
-- Billing contact
- Domain Name Associations: Each domain name is associated with:
-- A maximum of 13 hosts, which are created and managed independently according to RFC 5732
-- An Auth-Info, which is used to authorize certain operations on the object
-- Status(es), which are used to describe the domain name’s status in the registry
-- A created date, updated date, and expiry date

27.4 Demonstrates that technical resources required to carry through the plans for this element are already on hand or readily available

Verisign, L’Oréal’s selected backend registry services provider, is an experienced backend registry provider that has developed a set of proprietary resourcing models to project the number and type of personnel resources necessary to operate a TLD. Verisign routinely adjusts these staffing models to account for new tools and process innovations. These models enable Verisign to continually right-size its staff to accommodate projected demand and meet service level agreements as well as Internet security and stability requirements. Using the projected usage volume for the most likely scenario (defined in Question 46, Template 1 – Financial Projections: Most Likely) as an input to its staffing models, Verisign derived the necessary personnel levels required for this gTLD’s initial implementation and ongoing maintenance. Verisign’s pricing for the backend registry services it provides to L’Oréal fully accounts for cost related to this infrastructure, which is provided as “Total Critical Registry Function Cash Outflows” (Template 1, Line IIb.G) within the Question 46 financial projections response. 
Verisign employs more than 1,040 individuals of which more than 775 comprise its technical work force. (Current statistics are publicly available in Verisign’s quarterly filings.) Drawing from this pool of on-hand and fully committed technical resources, Verisign has maintained DNS operational accuracy and stability 100 percent of the time for more than 13 years for .COM, proving Verisign’s ability to align personnel resource growth to the scale increases of Verisign’s TLD service offerings.

Verisign projects it will use the following personnel roles, which are described in Section 5 of the response to Question 31, Technical Overview of Proposed Registry, to support the registration lifecycle:
- Application Engineers: 19 
- Customer Support Personnel: 36 
- Database Administrators: 8 
- Database Engineers: 3 
- Quality Assurance Engineers: 11 
- SRS System Administrators: 13 

To implement and manage the .HAIR gTLD as described in this application, Verisign, L’Oréal’s selected backend registry services provider, scales, as needed, the size of each technical area now supporting its portfolio of TLDs. Consistent with its resource modeling, Verisign periodically reviews the level of work to be performed and adjusts staff levels for each technical area. 
When usage projections indicate a need for additional staff, Verisign’s internal staffing group uses an in-place staffing process to identify qualified candidates. These candidates are then interviewed by the lead of the relevant technical area. By scaling one common team across all its TLDs instead of creating a new entity to manage only this proposed gTLD, Verisign realizes significant economies of scale and ensures its TLD best practices are followed consistently. This consistent application of best practices helps ensure the security and stability of both the Internet and this proposed gTLD, as Verisign holds all contributing staff members accountable to the same procedures that guide its execution of the Internet’s largest TLDs (i.e., .COM and .NET). Moreover, by augmenting existing teams, Verisign affords new employees the opportunity to be mentored by existing senior staff. This mentoring minimizes start-up learning curves and helps ensure that new staff members properly execute their duties.

VeriSign, Inc. Response to Question 28 Abuse Prevention and Mitigation 

28.1 Abuse Prevention and Mitigation Implementation Plan

L’Oréal’s primary safeguard against mitigating abusive and⁄or non-compliant registrations within the .HAIR name space is the limited universe of registrants that will be permitted to register with the .HAIR gTLD. It is currently intended that registration will initially be limited to L’Oréal and business units, affiliates, licensees and partners. This built-in validation mechanism, whereby all initial registrants are required to have an existing affiliate⁄commercial relationship with L’Oréal, promotes uniform compliance and increase accuracy of WHOIS data. L’Oréal is committed to providing best in class safeguards and will be closely monitoring other similarly situated gTLD applicants for suitable safeguards.

28.1.2 Policies for Handling Complaints Regarding Abuse

As required by the ICANN template Registry Agreement, L’Oréal will establish, publish, and maintain on its website a single point of contact for handling abuse complaints. This contact will be a role account, e.g., abuse@registry..HAIR. All email inquiries submitted to this email account will be responded to in a reasonably timely manner. L’Oréal will employ an escalated complaint procedure. This procedure will place priority on complaints received from a trusted⁄verified source (e.g. law enforcement). If the complaint falls within the scope of L’Oréal’s Abuse Policy Listed below, L’Oréal reserves the right to suspend or cancel the non-compliant domain. 

The role email account identified above will have multiple L’Oréal staff recipients to allow for monitoring on a 24X7 basis. In addition the phone number provided for on the Registry website will be answered by L’Oréal staff during normal working hours.

28.1.3 Proposed Measures for Removal of Orphan Glue Records

Although orphan glue records often support correct and ordinary operation of the Domain Name System (DNS), registry operators will be required to remove orphan glue records (as defined at http:⁄⁄www.icann.org⁄en⁄committees⁄security⁄sac048.pdf) when provided with evidence in written form that such records are present in connection with malicious conduct. L’Oréal’s selected back-end registry services provider’s (Verisign’s) registration system is specifically designed to not allow orphan glue records. Registrars are required to delete⁄move all dependent DNS records before they are allowed to delete the parent domain.

To prevent orphan glue records, Verisign performs the following checks before removing a domain or name server:

Checks during domain delete:
- Parent domain delete is not allowed if any other domain in the zone refers to the child name server.
- If the parent domain is the only domain using the child name server, then both the domain and the glue record are removed from the zone.

Check during explicit name server delete:
Verisign confirms that the current name server is not referenced by any domain name (in-zone) before deleting the name server.

Zone-file impact:
If the parent domain references the child name server AND if other domains in the zone also reference it AND if the parent domain name is assigned a serverHold status, then the parent domain goes out of the zone but the name server glue record does not.
If no domains reference a name server, then the zone file removes the glue record.

28.1.4 Resourcing Plans

Details related to resourcing plans for the initial implementation and ongoing maintenance of L’Oréal’s abuse plan are provided in Section 2 of this response. 

28.1.5 Measures to Promote WHOIS Accuracy

Ensuring the accuracy of WHOIS information is of paramount importance to 〈APPLCIANT〉 in the operation of the ..HAIR gTLD. L’Oréal will employ the following mechanism to promote WHOIS accuracy.

-Only L’Oréal and entities with existing affiliate, commercial or membership relationships with L’Oréal will be initially permitted to register in the .HAIR namespace.
-There will be a strict prohibition against the use of proxy registration services;
-L’Oréal will maintain a web-based form for third parties to submit claims regarding false and or inaccurate WHOIS data. 

28.1.5.1 Authentication of Registrant Information

Because all registrants in the .HAIR gTLD namespace are expected to have a pre-existing contractual or membership relationship with L’Oréal, this will be pre-authenticated thus promoting accurate and complete WHOIS data. 

28.1.5.2 Regular Monitoring of Registration Data for Accuracy and Completeness

Verisign, L’Oréal’s selected back-end registry services provider, has established policies and procedures to encourage registrar compliance with ICANN’s WHOIS accuracy requirements. Verisign provides the following service to L’Oréal for incorporation into its full-service registry operations.

WHOIS data reminder process. Verisign regularly reminds registrars of their obligation to comply with ICANN’s WHOIS Data Reminder Policy, which was adopted by ICANN as a consensus policy on 27 March 2003 (http:⁄⁄www.icann.org⁄en⁄registrars⁄wdrp.htm). Verisign sends a notice to all registrars once a year reminding them of their obligation to be diligent in validating the WHOIS information provided during the registration process, to investigate claims of fraudulent WHOIS information, and to cancel domain name registrations for which WHOIS information is determined to be invalid. 

28.1.5.3 Use of Registrars

L’Oréal has not yet made any determinations regarding which registrar will be selected to provide domain name registration services in the gTLD. L’Oréal currently uses one corporate domain name registrar. The likely registrar plan will be to use a limited number of corporate registrars, thus facilitating L’Oréal’s efforts to effectively maintain and manage its entire domain name portfolio. However, any final determination will depend upon L’Oréal and the registrar(s) of choice reaching an agreed-upon price for the specified services.

28.1.6 Malicious or Abusive Behavior Definitions, Metrics, and Service Level Requirements for Resolution

L’Oréal will have an Authorized Usage Policy that will govern how a registrant may use its registered domain name(s). A draft framework of this policy is as follows:
 
By registering a name in this gTLD, the registrant agrees to be bound by the terms of this Acceptable Use Policy (AUP). Registrant may not:
1. Use domain names for any purposes that are prohibited by the laws of the jurisdiction(s) in which registrant does business, or any other applicable law.
 2. Use domain names for any purposes or in any manner that violates a statute, rule, or law governing use of the Internet and⁄or electronic commerce (specifically including “phishing,” ʺpharming,ʺ distributing Internet viruses and other destructive activities).
 3. Use domain names for the following types of activity:
 i. Violation of the privacy or publicity rights of any third party, 
ii. Promotion of or engagement in hate speech; hate crime; terrorism; violence against people, animals, or property; or intolerance of or against any protected class;
iii. Promotion of or engagement in defamatory, harassing, abusive or otherwise objectionable behavior;
iv. Promotion of or engagement in child pornography or the exploitation of children;
v. Promotion of or engagement in any spam or other unsolicited bulk email, or computer or network hacking or cracking;
vi. Infringement on the intellectual property rights of another member of the .HAIR gTLD community, or any other person or entity;
vii. Engagement in activities designed to impersonate any third party or create a likelihood of confusion in sponsorship;
viii.Interference with the operation of the .HAIR gTLD or services offered by L’Oréal;
ix. Installation of any viruses, worms, bugs, Trojan horses, or other code, files, or programs designed to, or capable of, disrupting, damaging, or limiting the functionality of any software or hardware; or distributing false or deceptive language, or unsubstantiated or comparative claims, regarding L’Oréal;
x. Registration of .HAIR domain names for the purpose of reselling or transferring those domain names.

28.1.7 Controls to Ensure Proper Access to Domain Functions

L’Oréal will primarily be relying upon the safeguards incorporated at the registrar level to ensure proper access to domain names. Because L’Oréal envisions working with a limited number of corporate registrars, this will provide important gate keeping functions. 
 
28.1.7.2 Requiring Multiple, Unique Points of Contact and Means of Notification

L’Oréal will likely assign multiple unique points of contact. In connection with compliance, abuse, or malicious activity, an individual within L’Oréal’s legal department will be identified. In connection with technical, security, and⁄or stability issues, an individual in L’Oréal’s IT department will be identified. These unique POCs will have a corresponding unique email address that will auto-forward emails to these addresses to multiple individuals in each of the appropriate departments to ensure that there is no single point of failure in the communication chain. 

28.2 Technical plan that is adequately resourced in the planned costs detailed in the financial section

28.2.1 Resource Planning

L’Oréal is committed to operating the .HAIR gTLD in a manner that protects the core intellectual property assets of L’Oréal. L’Oréal has projected that a staff level 0.5 FTE for legal compliance and oversight for the gTLD. In addition, L’Oréal can rely upon existing in-house legal and other support staff should the need arise. L’Oréal has strategically chosen Verisign as its registry services provider because of their excellent track record in operating some of the worldʹs most complex and critical top level domains. Verisignʹs support for the .HAIR gTLD will help ensure its success.

28.2.2 Resource Planning Specific to Back-end Registry Activities

Verisign, L’Oréal’s selected back-end registry services provider, is an experienced back-end registry provider that has developed a set of proprietary resourcing models to project the number and type of personnel resources necessary to operate a gTLD. Verisign routinely adjusts these staffing models to account for new tools and process innovations. These models enable Verisign to continually right-size its staff to accommodate projected demand and meet service level agreements as well as Internet security and stability requirements. Using the projected usage volume for the most likely scenario (defined in Question 46, Template 1 – Financial Projections: Most Likely) as an input to its staffing models, Verisign derived the necessary personnel levels required for this gTLD’s initial implementation and ongoing maintenance. Verisign’s pricing for the back-end registry services it provides to L’Oréal fully accounts for cost related to this infrastructure, which is provided as “Total Critical Registry Function Cash Outflows” (Template 1, Line IIb.G) within the Question 46 financial projections response.

Verisign employs more than 1,040 individuals of which more than 775 comprise its technical work force. (Current statistics are publicly available in Verisign’s quarterly filings.) Drawing from this pool of on-hand and fully committed technical resources, Verisign has maintained DNS operational accuracy and stability 100 percent of the time for more than 13 years for .COM, proving Verisign’s ability to align personnel resource growth to the scale increases of Verisign’s TLD service offerings.

Verisign projects it will use the following personnel roles, which are described in Section 5 of the response to Question 31, Technical Overview of Proposed Registry, to support abuse prevention and mitigation:
Application Engineers: 19
Business Continuity Personnel: 3
Customer Affairs Organization: 9
Customer Support Personnel: 36
Information Security Engineers: 11
Network Administrators: 11
Network Architects: 4
Network Operations Center (NOC) Engineers: 33
Project Managers: 25
Quality Assurance Engineers: 11
Systems Architects: 9

To implement and manage the .HAIR gTLD as described in this application, Verisign, L’Oréal’s selected back-end registry services provider, scales, as needed, the size of each technical area now supporting its portfolio of TLDs. Consistent with its resource modeling, Verisign periodically reviews the level of work to be performed and adjusts staff levels for each technical area.

When usage projections indicate a need for additional staff, Verisign’s internal staffing group uses an in-place staffing process to identify qualified candidates. These candidates are then interviewed by the lead of the relevant technical area. By scaling one common team across all its TLDs instead of creating a new entity to manage only this proposed gTLD, Verisign realizes significant economies of scale and ensures its TLD best practices are followed consistently. This consistent application of best practices helps ensure the security and stability of both the Internet and this proposed gTLD, as Verisign holds all contributing staff members accountable to the same procedures that guide its execution of the Internet’s largest TLDs (i.e., .COM and .NET). Moreover, by augmenting existing teams, Verisign affords new employees the opportunity to be mentored by existing senior staff. This mentoring minimizes start-up learning curves and helps ensure that new staff members properly execute their duties.

28.3.2 Ongoing Anti-Abuse Policies and Procedures

28.3.2.1 Policies and Procedures that Identify Malicious or Abusive Behavior

Verisign, L’Oréal’s selected back-end registry services provider, provides the following service to L’Oréal for incorporation into its full-service registry operations.

Malware scanning service. Registrants are often unknowing victims of malware exploits. Verisign has developed proprietary code to help identify malware in the zones it manages, which in turn helps registrars by identifying malicious code hidden in their domain names. 
Verisign’s malware scanning service helps prevent websites from infecting other websites by scanning web pages for embedded malicious content that will infect visitors’ websites. Verisign’s malware scanning technology uses a combination of in-depth malware behavioral analysis, anti-virus results, detailed malware patterns, and network analysis to discover known exploits for the particular scanned zone. If malware is detected, the service sends the registrar a report that contains the number of malicious domains found and details about malicious content within its TLD zones. Reports with remediation instructions are provided to help registrars and registrants eliminate the identified malware from the registrant’s website.

28.3.2.2 Policies and Procedures that Address the Abusive Use of Registered Names

Suspension processes: Any registrant which ceases to have a qualified ongoing legal or membership relationship with L’Oréal will immediately have their domain name suspended and⁄or cancelled. In addition, any registrant that fails to timely respond to a WHOIS accuracy complaint is subject to having their domain name suspended and⁄or cancelled. Prior to taking any affirmation action in connection with an WHOIS accuracy compliant, L’Oréal will attempt to contact registrant through various electronic means (email, telephone and fax).

Suspension processes conducted by back-end registry services provider: In the case of domain name abuse, L’Oréal will determine whether to take down the subject domain name. Verisign, L’Oréal’s selected back-end registry services provider, will follow the following auditable processes to comply with the suspension request.

Verisign Suspension Notification: L’Oréal submits the suspension request to Verisign for processing, documented by:
Threat domain name
Registry incident number 
Incident narrative, threat analytics, screen shots to depict abuse, and⁄or other evidence
Threat classification 
Threat urgency description
Recommended timeframe for suspension⁄takedown 
Technical details (e.g., WHOIS records, IP addresses, hash values, anti-virus detection results⁄nomenclature, name servers, domain name statuses that are relevant to the suspension) 
Incident response, including surge capacity 

Verisign Notification Verification: When Verisign receives a suspension request from L’Oréal, it performs the following verification procedures:
Validate that all the required data appears in the notification.
Validate that the request for suspension is for a registered domain name.
Return a case number for tracking purposes.

Suspension Rejection: If required data is missing from the suspension request, or the domain name is not registered, the request will be rejected and returned to L’Oréal with the following information:
Threat domain name
Registry incident number 
Verisign case number
Error reason

Upon L’Oréal request, Verisign can provide a process for registrants to protest the suspension.

Domain Suspension: Verisign places the domain to be suspended on the following statuses:
serverUpdateProhibited 
serverDeleteProhibited
serverTransferProhibited
serverHold 

Suspension Acknowledgement: Verisign notifies L’Oréal that the suspension has been completed. Acknowledgement of the suspension includes the following information:
Threat domain name
Registry incident number 
Verisign case number 
Case number
Domain name
L’Oréal abuse contact name and number, or registrar abuse contact name and number
Suspension status

28.4 When executed in accordance with the Registry Agreement, plans will result in compliance with contractual requirements

As noted in the Question 18 business plan, the purpose of this gTLD registry is to provide L’Oréal with a secure and trusted namespace for the benefit of its consumers and Internet users. Given the fact that L’Oréal authored the contractual requirements, which have been incorporated into the Registrant Agreement, L’Oréal intends to fully comply with these contractual requirements. Moreover, L’Oréal has a vested interest to ensure that all registrants adhere to these legal requirements. 

As noted, in the above referenced compliance section, failure for registrants to timely remedy any non-compliant activity will result in the suspension and⁄or deletion of the domain in question.

28.5 Technical plan scope⁄scale that is consistent with the overall business approach and planned size of the registry

28.5.1 Scope⁄Scale Consistency

As a restricted-registrant gTLD Registry, the allocated registry staff will ensure that all registrations are in compliance with the requirements set forth in the Registrant Agreement. As this staff member(s) is proposed to be sourced from L’Oréal’s legal department, this will facilitate compliance of registrants with whom L’Oréal has a pre-existing legal or membership relationship. Unlike other registries that must oversee numerous registrars and untold number of registrants, the .HAIR gTLD will be a limited-universe of known entities with a pre-existing legal or membership relationship with LʹOréal that will likely be registered through one registrar. 

28.5.2 Scope⁄Scale Consistency Specific to Back-End Registry Activities

Verisign, L’Oréal’s selected back-end registry services provider, is an experienced back-end registry provider that has developed and uses proprietary system scaling models to guide the growth of its TLD supporting infrastructure. These models direct Verisign’s infrastructure scaling to include, but not be limited to, server capacity, data storage volume, and network throughput that are aligned to projected demand and usage patterns. Verisign periodically updates these models to account for the adoption of more capable and cost-effective technologies.

Verisign’s scaling models are proven predictors of needed capacity and related cost. As such, they provide the means to link the projected infrastructure needs of the .HAIR gTLD with necessary implementation and sustainment cost. Using the projected usage volume for the most likely scenario (defined in Question 46, Template 1 – Financial Projections: Most Likely) as an input to its scaling models, Verisign derived the necessary infrastructure required to implement and sustain this gTLD. Verisign’s pricing for the back-end registry services it provides to L’Oréal fully accounts for cost related to this infrastructure, which is provided as “Other Operating Cost” (Template 1, Line I.L) within the Question 46 financial projections response.

VeriSign, Inc. Response to Question 29 Rights Protection Mechanisms 

29.1 Mechanisms Designed to Prevent Abusive Registrations

Rights protection is a core objective of L’Oréal. L’Oréal will implement and adhere to any rights protection mechanisms (RPMs) that may be mandated from time to time by ICANN, including each mandatory RPM set forth in the Trademark Clearinghouse model contained in the Registry Agreement, specifically Specification 7. L’Oréal acknowledges that, at a minimum, ICANN requires a Sunrise period, a Trademark Claims period, and interaction with the Trademark Clearinghouse with respect to the registration of domain names for the .HAIR gTLD. It should be noted that because ICANN, as of the time of this application submission, has not issued final guidance with respect to the Trademark Clearinghouse, L’Oréal cannot fully detail the specific implementation of the Trademark Clearinghouse within this application. L’Oréal will adhere to the processes and procedures to comply with ICANN guidance as explained below.

As described in this response, L’Oréal will implement a Sunrise period and Trademark Claims service with respect to the registration of domain names within the .HAIR gTLD. Certain aspects of the Sunrise period and⁄or Trademark Claims service may be administered on behalf of L’Oréal by L’Oréal-approved registrars or by subcontractors of L’Oréal, such as its selected back-end registry services provider, Verisign.

At the time of filing, ICANN has not yet released final details on the Trademark Clearinghouse service. However, the protection of intellectual property is of paramount importance to L’Oréal. Given this and the fact that the initial proposed use of the registry is for the exclusive use of L’Oréal, all initial domain name registrations in the .HAIR namespace will be made by L’Oréal. Therefore, while L’Oréal will implement a Sunrise period and Trademark Claims process, depending upon the cost to access the Trademark Clearinghouse, L’Oréal may elect to forego the minimum one-month Sunrise period and register names in the gTLD following this mandatory period. 

Sunrise Period: As provided by the Trademark Clearinghouse model set forth in the ICANN Applicant Guidebook, the Sunrise service pre-registration procedure for domain names continues for at least 30 days prior to the launch of the general registration of domain names in the gTLD (unless L’Oréal decides to offer a longer Sunrise period).

During the Sunrise period, holders of marks that have been previously validated by the Trademark Clearinghouse receive notice of domain names that are an identical match (as defined in the ICANN Applicant Guidebook) to their mark(s). Such notice is in accordance with ICANN’s requirements and is provided by L’Oréal either directly or through L’Oréal-approved registrars.

L’Oréal requires all registrants, either directly or through L’Oréal-approved registrars, to i) affirm that said registrants meet the Sunrise Eligibility Requirements (SER), and ii) submit to the Sunrise Dispute Resolution Policy (SDRP) consistent with Section 6 of the Trademark Clearinghouse model. At a minimum L’Oréal recognizes and honors all word marks for which a proof of use was submitted and validated by the Trademark Clearinghouse as well as any additional eligibility requirements as specified in Question 18.

During the Sunrise period, L’Oréal and⁄or L’Oréal-approved registrars, as applicable, are responsible for determining whether each domain name is eligible to be registered (including in accordance with the SERs).

Trademark Claims Service: As provided by the Trademark Clearinghouse model set forth in the ICANN Applicant Guidebook, all new gTLDs will have to provide a Trademark Claims service for a minimum of 60 days after the launch of the general registration of domain names in the gTLD (Trademark Claims period).

During the Trademark Claims period, in accordance with ICANN’s requirements, L’Oréal or the L’Oréal-approved registrar will send a Trademark Claims Notice to any prospective registrant of a domain name that is an identical match (as defined in the ICANN Applicant Guidebook) to any mark that is validated in the Trademark Clearinghouse. The Trademark Claims Notice will include links to the Trademark Claims as listed in the Trademark Clearinghouse and will be provided at no cost.

Prior to registration of said domain name, L’Oréal or the L’Oréal-approved registrar will require each prospective registrant to provide the warranties dictated in the Trademark Clearinghouse model set forth in the ICANN Applicant Guidebook. Those warranties will include receipt and understanding of the Trademark Claims Notice and confirmation that registration and use of said domain name will not infringe on the trademark rights of the mark holders listed. Without receipt of said warranties, the L’Oréal or the L’Oréal-approved registrar will not process the domain name registration.

Following the registration of a domain name, the L’Oréal-approved registrar will provide a notice of domain name registration to the holders of marks that have been previously validated by the Trademark Clearinghouse and are an identical match. This notice will be as dictated by ICANN. At a minimum L’Oréal will recognize and honor all word marks validated by the Trademark Clearinghouse.

At the time of completing this application, L’Oréal has identified a Rights Protection Mechanism (RPM) that will allow trademark owners to challenge domain names initially reserved by the registry (e.g., generic and geographic names identified in Section 18.1.2). This process will be modeled after the dotAsia Pioneer Policies adopted by dotAsia in connection with its launch, see 〈http:⁄⁄www.wipo.int⁄amc⁄en⁄domains⁄gtld⁄asia⁄〉.

29.2 Mechanisms Designed to Identify and address the abusive use of registered names on an ongoing basis

In addition to the Sunrise and Trademark Claims services described in Section 1 of this response, L’Oréal implements and adheres to RPMs post-launch as mandated by ICANN, and confirms that registrars accredited for the .HAIR gTLD are in compliance with these mechanisms. Certain aspects of these post-launch RPMs may be administered on behalf of L’Oréal by L’Oréal-approved registrars or by subcontractors of L’Oréal, such as its selected back-end registry services provider, Verisign.

These post-launch RPMs include the established Uniform Domain-Name Dispute-Resolution Policy (UDRP), as well as the newer Uniform Rapid Suspension System (URS) and Trademark Post-Delegation Dispute Resolution Procedure (PDDRP). Where applicable, L’Oréal will implement all determinations and decisions issued under the corresponding RPM.

After a domain name is registered, trademark holders can object to the registration through the UDRP or URS. Objections to the operation of the gTLD can be made through the PDDRP.

The following descriptions provide implementation details of each post-launch RPM for the .HAIR gTLD:

- UDRP: The UDRP provides a mechanism for complainants to object to domain name registrations. The complainant files its objection with a UDRP provider and the domain name registrant has an opportunity to respond. The UDRP provider makes a decision based on the papers filed. If the complainant is successful, ownership of the domain name registration is transferred to the complainant. If the complainant is not successful, ownership of the domain name remains with the domain name registrant. L’Oréal and entities operating on its behalf adhere to all decisions rendered by UDRP providers.
- URS: As provided in the Applicant Guidebook, all registries are required to implement the URS. Similar to the UDRP, a complainant files its objection with a URS provider. The URS provider conducts an administrative review for compliance with filing requirements. If the complaint passes review, the URS provider notifies the registry operator and locks the domain. A lock means that the registry restricts all changes to the registration data, but the name will continue to resolve. After the domain is locked, the complaint is served to the domain name registrant, who has an opportunity to respond. If the complainant is successful, the registry operator is informed and the domain name is suspended for the balance of the registration period; the domain name will not resolve to the original website, but to an informational web page provided by the URS provider. If the complainant is not successful, the URS is terminated and full control of the domain name registration is returned to the domain name registrant. Similar to the existing UDRP, L’Oréal and entities operating on its behalf adhere to decisions rendered by the URS providers.
- PDDRP: As provided in the Applicant Guidebook, all registries are required to implement the PDDRP. The PDDRP provides a mechanism for a complainant to object to the registry operator’s manner of operation or use of the gTLD. The complainant files its objection with a PDDRP provider, who performs a threshold review. The registry operator has the opportunity to respond and the provider issues its determination based on the papers filed, although there may be opportunity for further discovery and a hearing. L’Oréal participates in the PDDRP process as specified in the Applicant Guidebook.

Additional Measures Specific to Rights Protection: L’Oréal provides additional measures against potentially abusive registrations. These measures help mitigate phishing, pharming, and other Internet security threats. The measures exceed the minimum requirements for RPMs defined by Specification 7 of the Registry Agreement and are available at the time of registration. These measures include:

- Rapid Takedown or Suspension Based on Court Orders: L’Oréal complies promptly with any order from a court of competent jurisdiction that directs it to take any action on a domain name that is within its technical capabilities as a gTLD registry. These orders may be issued when abusive content, such as child pornography, counterfeit goods, or illegal pharmaceuticals, is associated with the domain name.
- Anti-Abuse Process: L’Oréal implements an anti-abuse process that is executed based on the type of domain name takedown requested. The anti-abuse process is for malicious exploitation of the DNS infrastructure, such as phishing, botnets, and malware. 
- Authentication Procedures: Verisign, L’Oréal’s selected back-end registry services provider, uses two-factor authentication to augment security protocols for telephone, email, and chat communications.
-Eligibility Requirements: As discussed above, the initial proposed use of the registry is for the exclusive use of L’Oréal. Thus, all initial domain name registrations in the .HAIR namespace will be made by L’Oréal. This is expected to significantly reduce and⁄or eliminate the chance of any abusive registrations.


29.3 Resourcing Plans

29.3.1 Resource Planning

L’Oréal has included in its business plan staffing sufficient to implement and oversee the aforementioned Rights Protection Mechanism procedures. As previously noted in the application, this staffing resource will most likely be sourced from within L’Oréal’s legal department. Should additional subject matter expertise be required, L’Oréal may engage the services of outside specialists on an as-needed basis. 

29.3.2 Resource Planning Specific to Back-End Registry Activities

Verisign, L’Oréal’s selected back-end registry services provider, is an experienced back-end registry provider that has developed a set of proprietary resourcing models to project the number and type of personnel resources necessary to operate a gTLD. Verisign routinely adjusts these staffing models to account for new tools and process innovations. These models enable Verisign to continually right-size its staff to accommodate projected demand and meet service level agreements as well as Internet security and stability requirements. Using the projected usage volume for the most likely scenario (defined in Question 46, Template 1 – Financial Projections: Most Likely) as an input to its staffing models, Verisign derived the necessary personnel levels required for the .HAIR gTLD’s initial implementation and ongoing maintenance. Verisign’s pricing for the back-end registry services it provides to L’Oréal fully accounts for cost related to this infrastructure, which is provided as Line IIb.G, Total Critical Registry Function Cash Outflows, within the Question 46 financial projections response of this application.

Verisign employs more than 1,040 individuals of which more than 775 comprise its technical work force. (Current statistics are publicly available in Verisign’s quarterly filings.) Drawing from this pool of on-hand and fully committed technical resources, Verisign has maintained DNS operational accuracy and stability 100 percent of the time for more than 13 years for .COM, proving Verisign’s ability to align personnel resource growth to the scale increases of Verisign’s TLD service offerings.

Verisign projects it will use the following personnel roles, which are described in Section 5 of the response to Question 31, Technical Overview of Proposed Registry, to support the implementation of RPMs:
- Customer Affairs Organization: 9
- Customer Support Personnel: 36
- Information Security Engineers: 11 

To implement and manage the .HAIR gTLD as described in this application, Verisign, L’Oréal’s selected back-end registry services provider, scales, as needed, the size of each technical area now supporting its portfolio of TLDs. Consistent with its resource modeling, Verisign periodically reviews the level of work to be performed and adjusts staff levels for each technical area.

When usage projections indicate a need for additional staff, Verisign’s internal staffing group uses an in-place staffing process to identify qualified candidates. These candidates are then interviewed by the lead of the relevant technical area. By scaling one common team across all its TLDs instead of creating a new entity to manage only this proposed .HAIR gTLD, Verisign realizes significant economies of scale and ensures its TLD best practices are followed consistently. This consistent application of best practices helps ensure the security and stability of both the Internet and this proposed gTLD, as Verisign holds all contributing staff members accountable to the same procedures that guide its execution of the Internet’s largest TLDs (i.e., .COM and .NET). Moreover, by augmenting existing teams, Verisign affords new employees the opportunity to be mentored by existing senior staff. This mentoring minimizes start-up learning curves and helps ensure that new staff members properly execute their duties.

VeriSign, Inc. Response to Question 30A Security Policy – Part A

30A.1 Detailed description of processes and solutions deployed to manage logical security across infrastructure and systems, monitoring and detecting threats and security vulnerabilities and taking appropriate steps to resolve them

L’Oréal’s selected back-end registry services provider’s (Verisign’s) comprehensive security policy has evolved over the years as part of managing some of the world’s most critical TLDs. Verisign’s Information Security Policy is the primary guideline that sets the baseline for all other policies, procedures, and standards that Verisign follows. This security policy addresses all of the critical components for the management of back-end registry services, including architecture, engineering, and operations.

Verisign’s general security policies and standards with respect to these areas are provided as follows:

Architecture
- Information Security Architecture Standard: This standard establishes the Verisign standard for application and network architecture. The document explains the methods for segmenting application tiers, using authentication mechanisms, and implementing application functions.
- Information Security Secure Linux Standard: This standard establishes the information security requirements for all systems that run Linux throughout the Verisign organization.
- Information Security Secure Oracle Standard: This standard establishes the information security requirements for all systems that run Oracle throughout the Verisign organization.
- Information Security Remote Access Standard: This standard establishes the information security requirements for remote access to terminal services throughout the Verisign organization.
- Information Security SSH Standard: This standard establishes the information security requirements for the application of Secure Shell (SSH) on all systems throughout the Verisign organization.

Engineering
- Secure SSL⁄TLS Configuration Standard: This standard establishes the information security requirements for the configuration of Secure Sockets Layer⁄Transport Layer Security (SSL⁄TLS) for all systems throughout the Verisign organization.
- Information Security C++ Standards: These standards explain how to use and implement the functions and application programming interfaces (APIs) within C++. The document also describes how to perform logging, authentication, and database connectivity.
- Information Security Java Standards: These standards explain how to use and implement the functions and APIs within Java. The document also describes how to perform logging, authentication, and database connectivity.

Operations
- Information Security DNS Standard: This standard establishes the information security requirements for all systems that run DNS systems throughout the Verisign organization.
- Information Security Cryptographic Key Management Standard: This standard provides detailed information on both technology and processes for the use of encryption on Verisign information security systems.
- Secure Apache Standard: Verisign has a multitude of Apache web servers, which are used in both production and development environments on the Verisign intranet and on the Internet. They provide a centralized, dynamic, and extensible interface to various other systems that deliver information to the end user. Because of their exposure and the confidential nature of the data that these systems host, adequate security measures must be in place. The Secure Apache Standard establishes the information security requirements for all systems that run Apache web servers throughout the Verisign organization.
- Secure Sendmail Standard: Verisign uses sendmail servers in both the production and development environments on the Verisign intranet and on the Internet. Sendmail allows users to communicate with one another via email. The Secure Sendmail Standard establishes the information security requirements for all systems that run sendmail servers throughout the Verisign organization.
- Secure Logging Standard: This standard establishes the information security logging requirements for all systems and applications throughout the Verisign organization. Where specific standards documents have been created for operating systems or applications, the logging standards have been detailed. This document covers all technologies.
- Patch Management Standard: This standard establishes the information security patch and upgrade management requirements for all systems and applications throughout Verisign.

General
- Secure Password Standard: Because passwords are the most popular and, in many cases, the sole mechanism for authenticating a user to a system, great care must be taken to help ensure that passwords are “strong” and secure. The Secure Password Standard details requirements for the use and implementation of passwords.
- Secure Anti-Virus Standard: Verisign must be protected continuously from computer viruses and other forms of malicious code. These threats can cause significant damage to the overall operation and security of the Verisign network. The Secure Anti-Virus Standard describes the requirements for minimizing the occurrence and impact of these incidents.

Security processes and solutions for the .HAIR gTLD are based on the standards defined above, each of which is derived from Verisign’s experience and industry best practice. These standards comprise the framework for the overall security solution and applicable processes implemented across all products under Verisign’s management. The security solution and applicable processes include, but are not limited to:
- System and network access control (e.g., monitoring, logging, and backup) 
- Independent assessment and periodic independent assessment reports
- Denial of service (DoS) and distributed denial of service (DDoS) attack mitigation
- Computer and network incident response policies, plans, and processes
- Minimization of risk of unauthorized access to systems or tampering with registry data
- Intrusion detection mechanisms, threat analysis, defenses, and updates 
- Auditing of network access
- Physical security

Further details of these processes and solutions are provided in Part B of this response.

30A.1.1 Security Policy and Procedures for the Proposed Registry

Specific security policy related details, requested as the bulleted items of Question 30 – Part A, are provided here.

Independent Assessment and Periodic Independent Assessment Reports.
To help ensure effective security controls are in place, L’Oréal, through its selected back-end registry services provider, Verisign, conducts a yearly American Institute of Certified Public Accountants (AICPA) and Canadian Institute of Chartered Accountants (CICA) SAS 70 audit on all of its data centers, hosted systems, and applications. During these SAS 70 audits, security controls at the operational, technical, and human level are rigorously tested. These audits are conducted by a certified and accredited third party and help ensure that Verisign’s in-place environments meet the security criteria specified in Verisign’s customer contractual agreements and are in accordance with commercially accepted security controls and practices. Verisign also performs numerous audits throughout the year to verify its security processes and activities. These audits cover many different environments and technologies and validate Verisign’s capability to protect its registry and DNS resolution environments. Figure 30A-1 lists a subset of the audits that Verisign conducts. For each audit program or certification listed in Figure 30A-1, Verisign has included, as attachments to the Part B component of this response, copies of the assessment reports conducted by the listed third-party auditor. From Verisign’s experience operating registries, it has determined that together these audit programs and certifications provide a reliable means to ensure effective security controls are in place and that these controls are sufficient to meet ICANN security requirements and therefore are commensurate with the guidelines defined by ISO 27001.

(See: Figure 30A-1: Verisign Independent Assessment Activities)

Augmented Security Levels or Capabilities: See Section 5 of this response.

Commitments Made to Registrants Concerning Security Levels: See Section 4 of this response.


30A.2 Security capabilities are consistent with the overall business approach and planned size of the registry

L’Oréal does not foresee the need for any enhanced security mechanisms beyond those currently provided by Verisign based upon the following factors; existing L’Oréal IT security protocols; the restrictive nature of the .HAIR registrant universe; validation procedures that L’Oréal will be undertaking prior to allocating names in the gTLD; security features imposed at the registrar level; and, the limited number of registrars that will be connecting to the registry. 

Verisign, L’Oréal’s selected back-end registry services provider, is an experienced back-end registry provider that has developed and uses proprietary system scaling models to guide the growth of its TLD supporting infrastructure. These models direct Verisign’s infrastructure scaling to include, but not be limited to, server capacity, data storage volume, and network throughput that are aligned to projected demand and usage patterns. Verisign periodically updates these models to account for the adoption of more capable and cost-effective technologies.

Verisign’s scaling models are proven predictors of needed capacity and related cost. As such, they provide the means to link the projected infrastructure needs of the .HAIR gTLD with necessary implementation and sustainment cost. Using the projected usage volume for the most likely scenario (defined in Question 46, Template 1 – Financial Projections: Most Likely) as an input to its scaling models, Verisign derived the necessary infrastructure required to implement and sustain this gTLD. Verisign’s pricing for the back-end registry services it provides to L’Oréal fully accounts for cost related to this infrastructure, which is provided as “Total Critical Registry Function Cash Outflows” (Template 1, Line IIb.G) within the Question 46 financial projections response.


30A.3 Technical plan adequately resourced in the planned costs detailed in the financial section

30A.3.1 Resource Planning

It is anticipated that L’Oréal’s existing IT personnel will provide security support services, as necessary, to operate the .HAIR registry. In addition, L’Oréal will engage the services of subject matter experts to provide consulting services on any DNS-specific matters that may be outside the skill set of its internal IT staff.

30A.3.2 Resource Planning Specific to Back-End Registry Activities

Verisign, L’Oréal’s selected back-end registry services provider, is an experienced back-end registry provider that has developed a set of proprietary resourcing models to project the number and type of personnel resources necessary to operate a gTLD. Verisign routinely adjusts these staffing models to account for new tools and process innovations. These models enable Verisign to continually right-size its staff to accommodate projected demand and meet service level agreements as well as Internet security and stability requirements. Using the projected usage volume for the most likely scenario (defined in Question 46, Template 1 – Financial Projections: Most Likely) as an input to its staffing models, Verisign derived the necessary personnel levels required for this gTLD’s initial implementation and ongoing maintenance. Verisign’s pricing for the back-end registry services it provides to L’Oréal fully accounts for cost related to this infrastructure, which is provided as “Total Critical Registry Function Cash Outflows” (Template 1, Line IIb.G) within the Question 46 financial projections response.

Verisign employs more than 1,040 individuals of which more than 775 comprise its technical work force. (Current statistics are publicly available in Verisign’s quarterly filings.) Drawing from this pool of on-hand and fully committed technical resources, Verisign has maintained DNS operational accuracy and stability 100 percent of the time for more than 13 years for .COM, proving Verisign’s ability to align personnel resource growth to the scale increases of Verisign’s TLD service offerings.

Verisign projects it will use the following personnel role, which is described in Section 5 of the response to Question 31, Technical Overview of Proposed Registry, to support its security policy:
Information Security Engineers: 11

To implement and manage the .HAIR gTLD as described in this application, Verisign, L’Oréal’s selected back-end registry services provider, scales, as needed, the size of each technical area now supporting its portfolio of TLDs. Consistent with its resource modeling, Verisign periodically reviews the level of work to be performed and adjusts staff levels for each technical area.

When usage projections indicate a need for additional staff, Verisign’s internal staffing group uses an in-place staffing process to identify qualified candidates. These candidates are then interviewed by the lead of the relevant technical area. By scaling one common team across all its TLDs instead of creating a new entity to manage only this proposed gTLD, Verisign realizes significant economies of scale and ensures its TLD best practices are followed consistently. This consistent application of best practices helps ensure the security and stability of both the Internet and this proposed gTLD, as Verisign holds all contributing staff members accountable to the same procedures that guide its execution of the Internet’s largest TLDs (i.e., .COM and .NET). Moreover, by augmenting existing teams, Verisign affords new employees the opportunity to be mentored by existing senior staff. This mentoring minimizes startup learning curves and helps ensure that new staff members properly execute their duties.


30A.4 Security measures are consistent with any commitments made to registrants regarding security levels

Verisign is L’Oréal’s selected back-end registry services provider. For the .HAIR gTLD, no unique security measures or commitments must be made by Verisign or L’Oréal to any registrant.

30A.5 Security measures are appropriate for the applied-for gTLD string 

No unique security measures are necessary to implement the .HAIR gTLD. As defined in Section 1 of this response, Verisign, L’Oréal’s selected back-end registry services provider, commits to providing back-end registry services in accordance with the following international and relevant security standards:
- American Institute of Certified Public Accountants (AICPA) and Canadian Institute of Chartered Accountants (CICA) SAS 70 
- WebTrust⁄SysTrust for Certification Authorities (CA)

L’Oréal does not foresee the need for any enhanced security mechanisms beyond those currently provided by Verisign based upon the following factors; existing L’Oréal IT security protocols; the restrictive nature of the .HAIR registrant universe; validation procedures that L’Oréal will be undertaking prior to allocating names in the gTLD; security features imposed at the registrar level; and, the limited number of registrars that will be connecting to the registry.