Application number: 1-1861-18909 for Xiamen 35.com Technology Co.,Ltd

Xiamen 35.com Technology Co.,Ltd

+86 592 5391800

+86 592 5391808

http:⁄⁄www.35.com

Ms. Hongxia Yu

Marketing Director

+86 592 5291694

+86 592 5391808

gtld@35.cn

Mr. Fuchang Luo

Marketing Manager

+86 592 5399545

+86 592 5391808

luofch@35.cn

corporation

The Peopleʹs Republic of China

Not Available

Shenzhen_SE

Hongjun Qiao
Director
Hualin Han
Independent Director
Huaqun Zeng
Independent Director
Juan Zhou
Director
Ping Wang
Vice Chairman of the Board
Shaohua Chen
Independent Director
Shaohui Gong
Chairman of the Board

Chengming Tian
Vice General Manager
Hongjun Qiao
Vice General Manager
Juan Zhou
Vice General Manager
Shaohui Gong
General Manager
Xiaoliang Yang
Vice General Manager and Secretary of the Board
Yunfei Li
Vice General Manager

Shaohui Gong
Chairman of the Board and General Manager

life

Not Available

.life is an ASCII string thus we do not foresee any operational or rendering problems arising from the use of the applied-for gTLD string. Xiamen 35.com Technology Co. Ltd has also tested out the use of the string in a private DNS root setup via popular web browsing and email applications with no problems. 

Xiamen 35.com Technology Co., Ltd aims to apply for .Life top-level domain name and become .Life registry. 

1. What do we think of .Life?

a). Life is a generic word. Even people in non-English native language can easily know the meaning.

b). Life is easy to remember, brandable and personally promoted. Every .life registrant could share, show, record, promote, and enjoy their life at .Life site.

c). we donʹt see .Life just a domain name. We figure it will lose the value if it is just an online identity. People can choose hundreds of online identities, such as .Name, .Tel, .Me - not to mention with the new gTLD program introduced, hundreds of .new domain names extensions will be introduced into the market. As such, Xiamen 35.com Technology Co., Ltd will need to innovate with new domain name features to attract users.

d). after some analysis and investigation, we decide to create a new online platform for .life. How does this idea come up? Every registrant wants to have an online presence. They need to 1). Register a domain name, 2).Configure the DNS, 3).Subscribe to a hosting service, 4). Configure CMS software (or else, they upload files by themselves.). After these 4 steps, finally they have their online presence. It is not easy for non-tech savvy users to go through the 4 steps above. We recognize this is an opportunity for us. If we shorten the 4 steps to 1, users would just need to register a .life domain and are offered by all the other essential products to create an online presence at the same time. The users donʹt need to have any domain name knowledge or technical background. They can easily create an online web presence with .life. 

e). With the bundled products offer in one platform for .life users, we find the market is considerably bigger. People who used to register domain names to create an online presence are tech-savvy. But now ANYONE can have an online presence. In addition, users may forget their “facebook.com⁄yourname”, or the worse “http:⁄⁄user.qzone.qq.com⁄215452121⁄infocenter”. “Yourname.life” would help users create an easy way to remember online presence.

2. The mission of .Life registry: .life registryʹs mission is to make everyone has a unique online presence to share, show, record, promote, and enjoy their daily life.

3. The purpose of .Life registry:

a). Complying with ʺTop-Level Domain Application - Terms and Conditionsʺ (Module 6 of the guidebook), Xiamen 35.com Technology Co., Ltd wish to succeed in the domain name registry business and create social benefit for the both the online and offline community;

b). Introducing .Life, we can increase the choice and competition in domain name industry for users. We also intend to create an innovative platform for .life users using Xiamen 35.com Technology Co., Ltd existing products. For example, online games, email hosting, office automation tools, etc.

c). Xiamen is one of the pioneer of domain name industry in China. There are lots of domain name registrars and good domainers in Xiamen. We believe the .life domain name will become a brand or symbol of Xiamen.

d). We aim to establish a brand new Internet identity and differentiate ourselves in the marketing of our products and services. We even already filed an application for the trademark ʹ.Lifeʺ and .Life logo. 

What is the goal of your proposed gTLD in terms of areas of specialty, service levels, or reputation? 

Answer:

Specialty: .Life will focus on individual market. It is targeted at people who want to share, show, record, promote, and enjoy their life online. We believe there is market demand for personal branding as more and more users go online.

Service levels: Xiamen 35.com Technology Co. Ltd. will provide a series of products, like blog, file hosting, photo sharing etc. We aim to ensure that the uptime of the life platform is consistently 100%.

Reputation: Xiamen 35.com Technology Co. Ltd intends to market and brand .life as a way of life in Xiamen.

ii. What do you anticipate your proposed gTLD will add to the current space, in terms of competition, differentiation, or innovation? 

Answer: .Life will bring more competition to current space. People used to know that .Name, .Me or .Tel is for or partly for individual market. People can choose hundreds of online identities, such as .name, .tel .me - not to mention with the new gTLD program introduced, hundreds of .new domain name extensions will be introduced into the market. As such, Xiamen 35.com Technology Co. Ltd. will need to innovate with new domain name features to attract users. Xiamen 35.com Technology Co. Ltd intends to create a new online platform, which will feature its existing products such as online games, email hosting, office automation etc all bundled into one platform to attract users to register a .life domain name so as to gain access to the platform.

iii. What goals does your proposed gTLD have in terms of user experience? 

Answer: .Life can be used for personal branding. Like the site ʺAbout.meʺ, people need a place to create the image they want to portray to the public. Users could also use it to share and promote their life. Thatʹs what .life for. With the new online platform offered with the purchase of a .life domain name, users get to access a myriad of applications and games for a low price of US$2. As such, our goal in terms or user experience is to offer a life domain name user a useful online platform where he⁄she can manage his⁄her online life.

iv. Provide a complete description of the applicant’s intended registration policies in support of the goals listed above. 

Answer: Actually Xiamen 35 .comTechnology Co. Ltd will adopt General Registration Policy (Like .com, .net). .Life Registry will accredit a number of registrars, for the registration and other domain name operations such as renew, update, transfer, delete etc of domain names. A list of accredited registrars will be maintained and prominently displayed on the Registry website.

Registration policy:
1. The applied-for domain name must not be reserved or blocked by the Registry;
2. Minimum registration of 1 year and a maximum of 10 years;
3. Anyone in the world is able to register .life domain names
4. To register a domain name, the following technical requirements must be met:
i. Contains a minimum of 3 characters and maximum of 63 characters (not including the “.life” suffix);
ii. Contains a minimum of 3 characters selected from the letters ‘a’ to ‘z’ or ‘A’ to ‘Z’ in standard US ASCII character set, the digits ‘0’ to ‘9’ and the hyphen (‘-’);
iii. Does not begin or end with a hyphen (‘-’);
iv. Does not contain a hyphen (‘-’) in both the 3rd and 4th positions;
5. 1 and 2 characters .life domain names will be temporarily reserved by Registry.

The registry will not impose any eligibility requirements on the registration of .life domain names. All registration of domain names must be made in the form and manner prescribed by the registry. Registrants must comply with all rules, policies, procedures and guidelines of .life domain names in respect of registration. .Life Registry may amend such rules, policies, procedures and guidelines from time to time. We will ensure that such changes are communicated to its registrants on a timely basis.

.Life domain names are allocated on a “first-come-first-serve basisʺ, provided the information submitted is complete and all rules, policies, procedures and guidelines relating to the registration have been compiled with. The registry may cancel or suspend a registration accepted by a registrar, which registry in its sole and absolute discretion determines that the registration is not in conformity with the Registryʹs rules, policies, procedures and guidelines. Each of the registrant and registrar agrees that the Registry shall not be responsible for any loss or damages arising out of the rejection and⁄or cancellation of the registration.

The registrant shall provide to his registrar with complete and accurate information and maintain this information during the term of the domain name registration. The failure of a registrant to provide, promptly update or respond to inquires from the registrar in regards to complete and accurate information may constitute to a material breach of the registrant agreement and shall be a basis for cancellation of the domain name registration.

The registry shall not be involved in any dispute that the registrant may have with a third-party. Any dispute arising from the registration and use of a domain name shall be determined in accordance with the abuse handling mechanism in Question 28. 

v. Will your proposed gTLD impose any measures for protecting the privacy or confidential information of registrants or users? If so, please describe any such measures. 

Answer: 

The registry will impose measures for protecting the privacy or confidential information of registrants or users. 

Firstly, all accredited registrars are required to abide by a Code of Practice established by the registry to be used in conjunction with the Registry-Registrar Agreement and all rules, policies, procedures and guidelines published by the registry.

The Code of Practice is a compulsory set of principles and approaches to market conduct for all accredited registrars and their appointed resellers. The objective of the Code of Practice is to promote and protect the interests of the domain name industry, registrants and domain name registrars by: 

a) Establishing minimum standards for dealings between domain name registrars and registrants; 
b) ensuring that registrants receive accurate, complete and timely information concerning domain name activities including, but not limited to registrations, renewals, transfers and solicitations; 
c) Preventing practices that undermine the reputation of the industry and the interests of registrants.

It is mandatory for all domain name registrars to comply with the code of practice herein without exception. 

The Code of Practices addresses data privacy of registrants and states the following:
“Domain name registrars must not disclose the registrantʹs domain data information, including, but not limited to the domain name, registrant, contact persons, name servers, registration, and expiry and billing information to any third party for any reason or purpose.”
Alleged breaches of the Code of Practice will be dealt with severely under the registry’s Complaints Policy. A breach of the Code of Practice is also a breach under the Registry-Registrar Agreement and may result in the suspension or termination of the registrar’s accreditation.

Secondly, an acceptable use policy shall be implemented by the registry in regards to the WHOIS service. The acceptable use policy shall clarify that the information published in the WHOIS service is only for informational purposes and can only be used for lawful purposes. Users are strictly prohibited to use the information published in the WHOIS service for the following purposes, but not limited to:

a) Advertising and⁄or marketing purposes;
b) Unsolicited communication purposes via email or otherwise;
c) Spamming or speculative purposes;
d) Commercial purposes;
e) Illegal purpose; and
f) Any other abusive purposes. 

Any user that is caught abusing the WHOIS service for unlawful purposes will be reported to the relevant authorities for further actions. This will be on a best effort attempt as not every country has implemented relevant policies in regards to SPAM and⁄or use of public information for commercial, illegal and other abusive purposes.
Lastly, two preventive measures can be adopted by the registry to prevent automated scripts from data-mining from the WHOIS service. The measures are as follows:

a) Implement the use of an Image Verification Check (IVC) on web-based WHOIS services where a user is required to type in a random word or phrase that is shown to the user in the form of a graphical picture. The principle is that machines cannot read the words in a graphical picture and only a real person can enter the word or phrase successfully. The technology for IVC has advanced quite a bit over the past few year and is still very effective against data-mining robots today; and

b) Limit the number of WHOIS queries per hour for a particular IP. This helps to thwart data-mining attempts.

Describe whether and in what ways outreach and communications will help to achieve your projected benefits. 

Answer: Yes, we see outreach is good for market education. The projected benefits of some outreach and communication ideas is as follows:

a). Cooperate with education institutes: Xiamen 35.com Technology Co. Ltd has a good relationship with Xiamenʹs education institutions. We would like to introduce .Life to lecturers and students and teach them how to register a domain name and go online if they have not done so.

b). Seed users program: before the launch of .Life and the first year of operation. We would like to identify pioneer users of .life domain name and introduce them as a spokesman for the domain name. They are included but not limited to: bloggers with frequently updated posts, Weibo (Chinese twitter) users with 1 millions+ fans, Qzone users who shared a lot of photos and celebrated domainers.

i. How will multiple applications for a particular domain name be resolved, for example, by auction or on a first-come⁄first-serve basis? 

Answer: There will be three main phases for domain name registration upon the launch of the registry namely:

1. Sunrise
a. Government
b. Trademarks
c. Company Name
2. Landrush
3. General Availability
 
During the Sunrise phase, there are three identified sub-phases as follows:
 
1. Government
This sub-phase is only open to government organizations. If there are multiple applications for the same domain name, the organizations that have applied for the same domain name will be notified of the contention. The domain name contention will be resolved via a English auction, where the highest bidder wins.
 
2. Trademarks
This sub-phase is only open to brand and trademark owners. The registry will work with the Trademark ClearingHouse for the verification and validation of registered marks. If there are multiple applications for the same domain name, Trademark ClearingHouse will only verify and validate the genuine owner(s) of the registered mark. If there are multiple owners of the registered mark in different countries, the registrants that have applied for the same domain name will be notified of the contention. The domain name contention will be resolved via an auction, where the highest bidder wins.
 
3. Company Name
This sub-phase is open to companies that would like to register a domain name similar to their company name but do not have an existing trademark. The company needs to submit a legal document that shows the legal name of the organization with its application. If there are multiple owners of the registered mark in different countries, the registrants that have applied for the same domain name will be notified of the contention. The domain name contention will be resolved via a English auction, where the highest bidder wins.
 
Next, multiple applications for the same domain name will be accepted in the Landrush phase. After the Landrush phase, registrants that have applied for similar domain names will be notified that the domain name contention will be resolved via an auction, where the highest bidder wins.
 
The registration of domain names in the last phase of the launch, General Availability will be on a first-com⁄first-serve basis.

ii. Explain any cost benefits for registrants you intend to implement (e.g., advantageous pricing, introductory discounts, bulk registration discounts). 

Answer: 
a). The registry intends to offer a low wholesale price of US$2 for registration and a competitive price for renewal and transfer. 
b). The registry will make use rebate program to get registrars to push for more registrations. Every enrolled registrar will need to pass on some discounts to registrants.
c). we consider a discount price or free for seed users, like bloggers with frequently updated posts, Weibo (Chinese Twitter) users with 1 millions+ fans, Qzone (Chinese Facebook) users who shared photos a lot, celebrated domainers.

iii. Note that the Registry Agreement requires that registrars be offered the option to obtain initial domain name registrations for periods of one to ten years at the discretion of the registrar, but no greater than ten years. Additionally, the Registry Agreement requires advance written notice of price increases. Do you intend to make contractual commitments to registrants regarding the magnitude of price escalation? If so, please describe your plans. 

Answer: Yes, Xiamen 35.com Technlogy Co. Ltd. will provide written notice of price hike in the registry agrreement. However, the registry shall not make any contractual commitment to Registrants regarding the magnitude of price escalation.

No

Not Available

No

The registry is committed to establishing a stable, reliable and secure registration environment and protecting country and territory names against illegal activities. As such, the registry will reserve the following for the protection of geographic names at the second and any other levels under .GDN TLD:

Country and Territory Names 
The registry will reserve the country and territory names at the second and any other levels under the .GDN TLD based on the following internationally recognized lists which are included, but are not limited to:
(1) The short form (in English) of all country and territory names contained on the ISO 3166-1 list, as updated from time to time, including the European Union, which is exceptionally reserved on the ISO 3166-1 list, and its scope extended in August 1999 to any application needing to represent the name European Union;
(2) The United Nations Group of Experts on Geographical Names, Technical Reference Manual for the Standardization of Geographical Names, Part III Names of Countries of the World; and
(3) The list of United Nations member states in 6 official United Nations languages prepared by the Working Group on Country Names of the United Nations Conference on the Standardization of Geographical Names;

The implementation plan for the reservation of the above domain names is as follows:
(1) The list of reserved names will be published on the registry website.
(2) The registry will contact ICANN Governmental Advisory Committee about the reservation of the above country and territory names under the .GDN TLD. GAC should inform (a) governments, distinct economies and public authorities; (b) members of the ICANN governmental advisory committee about the reservation resolution of above country and territory names under .GDN TLD. All governments, distinct economies or public authorities are expected to take the necessary steps to register their country and territory names as soon as possible.
(3) The process for releasing and registering the above country and territory names shall be established in cooperation with ICANN and GAC. The current process is:
ⅰ. The government, distinct economies or public authorities concerned informs the GAC Secretariat of their request to register the name and the designated beneficiary. 
ⅱ. The GAC Secretariat authenticates the request and sends it to the ICANN staff and the registry.
ⅲ.The registry verifies the availability of the name and issues an authorization number that is transmitted directly to the designated beneficiary.
ⅳ. The designated beneficiary registers the name, with an accredited registrar, using the authorisation number as the verification of their identity.

 Registry shall provide Registry Services as defined below: 
(i) The receipt of data from registrars concerning registrations of domain names and name servers; 
(ii) Provision to registrars of status information relating to the zone servers for the TLD; 
(iii) Dissemination of TLD zone files; 
(iv) Operation of the Registry zone servers;
(v) Dissemination of contact and other information concerning domain name server registrations in the TLD as required by the Registry Agreement;
(vi) Internationalized Domain Names (IDN);
(vii) DNS Security Extensions (DNSSEC); 
(viii) WHOIS Data Watch Service;
(ix) Searchable WHOIS Service and
(x) Other products or services that the Registry Operator is required to provide because of the establishment of a Consensus Policy
(xi) .life domain personel application platform
Registry System
Registry utilizes a ‘thick’ registry model which is EPP (Extensible Provisioning Protocol) version 1.0 compliant, where registrant data is maintained on a central registry database as a contact set.
1. Stealth DNS (Zone Generation)
The resolution of domain names is a crucial function in a registry system. The DNS system supports both IPv4 and IPv6. The stealth DNS stores the generated zone file from the database, which will undergo a complicated reconciliation process before the data is reloaded into the master zone. The Stealth DNS is hidden in the internal network and is only visible to the primary DNS server. The primary DNS server is hidden as well and is responsible for the zone transfer to external secondary DNS servers. The DNS is in compliance to RFCs 1034, 1035, 1982, 2181, 2182, 2671, 3226, 3596, 3597, 4343, and 5966.
2. External DNS (Zone Resolution)
The external DNS setup consists of the secondary DNS servers dedicated to resolution of the extension domain worldwide. The Secondary DNS are utilizing 2 of the main providers in the world that supports AnyCast DNS with more than 100 nodes all around the world. The provider is CommunityDNS. All zone transfer will be protected using TSIG. The DNS is in compliance to RFCs 1034, 1035, 1982, 2181, 2182, 2671, 3226, 3596, 3597, 4343, and 5966.
3. DNSSEC
 Registry shall provide DNSSEC services to registrars comply with RFCs 4033, 4034, 4035, 4509 and their successors, and follow the best practices described in RFC 4641 and its successors. The DNSSEC services shall include the publishing of Delegation Signature (DS) records and signed records to the root zones of the applied TLD.
4. WHOIS Services
General public can check the information of a domain name through port 43. Web based searchable WHOIS will be provided for subscribed users. The WHOIS services are highly scalable, capable of handling higher query loads and comply with RFC 3912.
5. Registry Web Interface
The control panel is used by the registry operational staff to administrate domain names, root name servers, registrars and other domain name data. Key features include multi-users function control, flexible product configurations, business process configurations and event-triggered alerts.
6. Registrar Web Interface
A registrar can perform daily operations, channel management and transaction accounting via the web control panel. Major functions include domain, contact and host management for domain names registered under the registrar, account balance and account top-up.
7. EPP Services
A standard EPP server is used to provide flexibility for registrars to automate domain registration and management. The EPP server is configured with a SSL communications link that uses the EPP version 1.0 protocol comply with RFCs 5910, 5730, 5731, 5732, 5733, 5734, 3735.
8. Reporting Services
Standard reports are provided to registry and registrar staff to perform secondary check on transactions made, payment received, domain renewal and balance enquiries.
9. Operational Testing and Evaluation (OT&E)
All newly accredited registrars shall reserve a time slot to access OT&E server and perform a technical test. This is to ensure that the registrar’s system is capable of registering and managing domain names in the production environment without unnecessary problems. Once a registrar passes the OT&E Test, the registrar will receive an account to access the production system to register and manage domain names.
10. Security and Monitoring
User access will be controlled through 3 tiers of authentication: Registrar SSL Certificate, Registrar IP Addresses and Registrar User Name⁄Password Combination. The communication link with registrar will be SSL encrypted.
Multiple firewalls will be in place to ensure multiple levels of security together with IP filtering and Intrusion Detection with Prevention. Multiple security monitoring systems will be setup within and outside of the network of the Registry System to monitor the Registry Services. Host based intruder detection system will be in place on top of hardware based intruder protection system. Multi Router Traffic Grapher (MRTG) will be installed to monitor traffic utilization in the network and each server of the Registry System.
11. Data Escrow
The data will be deposited into ICANN approved escrow agent based on escrow requirements to ensure business continuity and data recovery in the unlikely event of data loss.
12. Call Centre
System support and maintenance to guarantee maximum uptime shall be provided through Email and Phone to registrars. 24⁄7 technical support hotline are available in multiple languages.
13. Channel Management
Client Relation Management (CRM) software is in place to manage communications and contact with the registrars.
14. Other Registry Services
The registry will provide IDN domain names to the end users. The IDN will be deployed according to the IDN RFCs (5890, 5891, 5892, 5893) and the languages supported will be based on registered language tables in IANA.
15. .Life domain personel application platform
Xiamen 35.com Technology Co.,Ltd will also provide a free platform for domain registrant to share, document and boast about their life via the platform. On this platform, people can enjoy free e-mail service, online games, blog, tweet, upload files, share photos and other personel information. People do not need to have any domain name or technical knowledge, they can easily create their own personal online space and customized web presence with .life.

Demonstration of Technical & Operational Capability (External)

Registry is compliance to Specification 6 and Specification 10 in the Registry Agreement. Below is the table compliance for Specification 6. Compliance to Specification 10 is listed in the subsequent section. 
Compliance table (specification 6) is provided in attachment (24-1.xlsx)

1 SRS System Description 

1.1 System Architecture

The SRS application is designed with multiple control interfaces to allow access by different parties via defined user roles and matrixes. All components have been designed to be deployed either in a distributed environment.
Detailed description is provided in attachment (24-2.png)

Core Component of Registry SRS
The Registry SRS is split into multiple components to improve scalability. The Core SRS Component consists of presentation layer, application security framework, application layer and database layer. It supports HTTP, HTTPS and EPP protocols. 
The application layer is used to handle the business flow, audits, messages, processes and the daily tasks in the system. It has a data logger, which stores the details of all requests and responses from the application. The database layer deals with raw data management and utilizes relational databases.

1.2 SRS Data Flow Diagram

The system architecture of the SRS is designed to allow the EPP, WHOIS, registry web panel and registrar web panel to share the same set of business logics. In other words, the processing of the request will be the same regardless the request comes from which interfaces.
Detailed description is provided in attachment (24-3.png)
 

1.3 SRS System Features

Business Process Configuration:
a) Administration module to configure business rules, policies and practices;
b) Utilization of extensions in EPP to store additional information, e.g. language tag etc;
c) Control panels to validate pending transactions and facilitate the submission of documents;
d) Control panels for black and white list coupled with a pragmatic system to restrict sensitive names;
e) Policy manager panels allow registry staff to control access to products and adjust policies;
f) Feature access controller panels allow registry and registrar staff to customize functionalities available at various channels; and
g) User access controller panel allows registry and registrar staff to customize access level of different users.

Channel Marketing (Registrar Support):
a) Web-based multi-tier administrative control panel;
b) Ability to brand email templates and extensive email tracking;
c) Built-in marketing features such as volume discount and period discount tools;
d) EPP connection Software Development Kit (SDK) and toolkits (in Java, PERL);
e) Documentation, registrar technical training and change management.

Billing and Payment:
a) Reminder notification with configurable alerts, content including other parameters; and
b) Billing Manager to manage offline payments, fund alert, incentive rebate calculation and online invoice.

Report Management:
a) Comprehensive statistical and transaction reporting system; and real-time reports for channel management (transaction, balance, renewal, announcements etc).
b) Registrars detail and summary monthly statements; and
c) Transaction tracking and action audit logs

2 Network Diagram

The following diagram shows the network architecture and connectivity for all the components of the Registry SRS System. The Registry System infrastructure is located in 2 different data center for redundancy and scalability purposes. The main data center consist of the SRS, DNSSEC signing and Data Escrow. The secondary site will be running the WHOIS services. DNS Services are fully AnyCast enabled and dispersed geographically.
The main data center has full redundancy up to the node level. The network is separated into 2 segments. The first network segment is IP restricted area for registrars to access the SRS which is the DMZ zone. The second segment is for internal access which consist of the database. All servers are protected by redundant firewall. 
The Web and EPP services are load-balanced between multiple servers. This provides maximum reliability, and is highly extensible by adding more servers behind the load balancers. Each server has redundant components (Power supplies, hard disk RAID, fans, network interfaces). The presence of multiple servers, multiple facilities, and multiple network providers means that the services will be well protected against single points of failure.
All services are setup in the secondary data center for emergency recovery in case of melt down in the main data center. The services in the secondary data center can be online within 2 hours from the activation. Each site has at least 2 different network connections to the Internet. Our data centre belongs to a tier 1 provider with has four backbones peering to other tier 1 provider.
Detailed description is provided in attachment (24-4.png) 
The OTE server connects to the test database where the data resembles the production database. The Disaster Recovery Site (Secondary data center) is designed to replicate the primary site except the OTE environment. The OTE environment is not essential during a disaster. The DR site shall only be used to temporarily take over the registry operations while the primary site is being restored.

3 Interconnectivity

The main components in the systems are SRS, Data Escrow, WHOIS, DNS, Reporting, Registrar Systems, Accounting System and System Monitoring. The diagram provided in attachment (24-5.png) explains the interconnectivity between these components.

The system consists of a SRS system where the main database server resides. The interfaces in the SRS system are mainly web and EPP. The data are received from registrars through Web panel or automation from registrar system to the EPP server in real time. The central data will then be distributed to DNS, Accounting system and Data escrow agent through batch processing mode. 
A bidirectional geographical replicatedsecondary database cluster is configured to replicate data from the main database in the SRS system. The secondary database will provide WHOIS query and data access for reports. The replication will be done using MySQL cluster bidirectional geographical replication feature which is near real time. The monitoring system will probe the services in the SRS in real time. 

4 Synchronization Scheme

Interconnectivity between registry system components appear in 3 synchronization scheme:
4.1 Replication Synchronization (Only for database)
Source (SRS) to Destination (WHOIS)
- Asecondary database cluster will be installed for providing the WHOIS response. The synchronisation is done using bidirectional database replication. The data are replicated to secondary database within mili seconds.

Source (SRS) to Destination (Reporting Services)
- A secondary database cluster will be installed for providing reports. The synchronisation is done using bidirectional database replication. The data are replicated to secondary database within mili seconds.

4.2 Batch Processing
Source (SRS) to Destination (Stealth DNS)
- A DNS reconciliation and generation program is in place to regenerate the zones in the interval of 2 hours.

Source (Stealth DNS) to Destination (Primary DNS)
- The zone is transfer to primary using notify = yes. Once records changed in stealth DNS, the primary will be notified to transfer the zone. The transfer takes less than 1 second.

Source (Primary DNS) to Destination (Secondary DNS)
- The zone is transfer to secondary using notify = yes. Once records changed in primary DNS, the secondary will be notified to transfer the zone. The transfer takes less than 1 second.
- 
Source (SRS) to Destination (Data Escrow)
- A backend program will be running daily to deposit the data into Escrow agents SFTP server.

Source (SRS) to Destination (Accounting System)
- A backend program will be running daily to generate data file in the accounting system data import format.

4.3 Real Time Access
Source (Registrar System) to Destination (SRS)
- All transactions will be processed in real time and response will be returned immediately after processing.

Source (System Monitoring) to Destination (SRS)
- The monitoring software will be probing the services in near real time interval (every second).

5 Resource Plan

Xiamen 35.com Technology Co., Ltd will deploy the Registry Service using its existing system and infrastructure. During the implementation, new server hardware will be provisioned for SRS services. Our Data Center Engineer will perform the server provisioning and installation of OS. Once the hardware is provisioned, System Administrator shall continue to install the required software and perform security configurations. On the other hand, the Database Administrator will create the required schemas. The assigned Software Developer will configure the rules and policies into the SRS system. Once done, our Test Engineer will perform rigorous testing procedures to ensure the system performs according to specifications. Upon the testing is fully completed, the SRS system shall be hand-over to System Administrator to perform deployment to production environment. Throughout the process, a Project Manager is assigned to perform project management and overall control on the implementation. The Project Manager will conduct training to the registry users on the functionalities of the system. The SRS setup shall be completed within a month.
The system will be in maintenance mode after the SRS is deployed. The SRS will be supported by general helpdesk support for enquiries. Any support issue related to SRS will be escalated to the Software Engineer for trouble shooting. System Administrator is tasked to monitor the SRS availability. Whenever there is a support ticket, Software Engineer and System Administrator will further escalate the support request base on severity. The emergency response team will be triggered whenever there is a catastrophe scenario at the highest severity. 

Once a remedy is identified, Test Engineer will perform testing on the fixes before deployment by System Administrator. During maintenance, Xiamen 35.com Technology Co., Ltd will commit the following resources for the 24 x 7 helpdesk, 2 data center engineers, 2 software engineers, 1 support manager, 1 test engineer and 1 system administrator. As part of on going policy changes, a team of software developer is available for any standards upgrade to the SRS and the changes will trigger the change request procedure in accordance to CMMI standards.

Please further refer to the detailed resource plan in question 31 for the human resource policy, job description and skills-required for the above-mentioned resources.

6 Service Level Agreement (SLA)

Registry is committed to provide SLA according to the parameters below in accordance to Specification 10:

DNS
- DNS service availability: 0 min downtime = 100% availability
- DNS name server availability: ≤432 min of downtime (≈99%)
- TCP DNS resolution RTT: ≤1500 ms, for at least 95% of the queries
- UDP DNS resolution RTT: ≤500 ms, for at least 95% of the queries
- DNS update time: ≤60 min, for at least 95% of the probes

RDDS
- RDDS availability: ≤864 min of downtime (≈98%)
- RDDS query RTT: ≤2000 ms, for at least 95% of the queries
- RDDS update time: ≤60 min, for at least 95% of the probes

EPP
- EPP service availability: ≤864 min of downtime (≈98%)
- EPP session-command RTT: ≤4000 ms, for at least 90% of the commands
- EPP query-command RTT: ≤2000 ms, for at least 90% of the commands
- EPP transform-command RTT: ≤4000 ms, for at least 90% of the commands

1 Introduction

Xiamen 35.com Technology Co., Ltd deploys real time Interface between registry and registrar based on EPP implementation. EPP implements a thick model registry where WHOIS information is stored in registry main database as contact set. Every registration requires a set of contacts to be submitted to registry system. The EPP commands and responses are compliance to RFC 5730 to RFC 5734. The EPP supports all Login Commands (login, logout), Query Commands (check, info, poll, transfer) and Object Transform Commands (create, delete, renew, transfer, update). The full set of commands and responses are in a 30 pages document which can be furnished on demand. 

1.1 EPP Status

The system utilizes all EPP statuses stated in the RFC as follows: 

- clientDeleteProhibited: Requests to delete the object must be rejected. 
- serverDeleteProhibited: Requests to delete the object must be rejected. 
- clientHold: Delegation information must be withheld from publication in the objectʹs nominal zone. 
- serverHold: Delegation information must be withheld from publication in the objectʹs nominal zone. 
- clientRenewProhibited: Requests to renew the object must be rejected. 
- serverRenewProhibited: Requests to renew the object must be rejected. 
- serverTransferProhibited: Requests to transfer the object must be rejected. 
- clientUpdateProhibited: Requests to update the object (other than to remove this status) must be rejected. 
- serverUpdateProhibited: Requests to update the object (other than to remove this status) must be rejected. 
- ok: This is the nominal status value for a domain object at all times, whether or not the domain has pending operations or prohibitions. 
- pendingRestore: A restore reequest has been received for the object, and completion of the request is pending. 
- pendingDelete: A delete request has been received for the object, but the object has not yet been purged from the server database. 
- pendingTransfer: A transfer request has been received for the object, and completion of the request is pending. 
- redemptionPeriod: The object has expired and can be still be renewed.
- registryHold: Delegation information must be withheld from publication in the objectʹs nominal zone.
- registryLock: The object cannot be modified through any action. Hierarchical and associated objects also cannot be added or removed.

1.2 EPP Connection

Registrar will be required to download the EPP SDK (bundle with documentation) to establish connection to EPP Server. Procedure of TCP connection:

a. Post SSL request
b. SSL Handshaking
c. SSL session established
d. Send Greeting command
e. Greeting acknowledgment
f. Send login information
g. Authentication process
h. TCP over SSL connection established
i. Send command for operation such as Domain check command
j. Send Poll command to keep connection alive
k. Session will be closed automatically after 20 minutes if Poll command is not issued
l. Send logout command
m. Session closed

XML parser will be used against request and response to ensure integrity of the data and detect corruption of data. Once data is found to be loss or corrupted, EPP command fail response will be sent to the requestor.

1.3 Registration Tools

a. EPP 1.0 client SDK and documentation (no proxy required); and
b. Tools are downloadable from registrar interface.

1.4 EPP Extensions Schemas

The EPP shall implement extensions for DNSSEC according to RFC 5910 and IDN according to RFC 3735. The extensions are applied to the following commands only:

a. Domain Info
b. Domain Create
c. Domain Update

The XML for the commands and responses is provided in attachment (25-1.pdf)
 
2 Resource and Operation Plan

Xiamen 35.com Technology Co., Ltd will deploy the Registry Service using its existing system and infrastructure. During the implementation of .life Registry, new server hardware will be provisioned for EPP services. Our Data Center Engineer will perform the server provisioning and installation of OS. Once the hardware is provisioned, System Administrator shall continue to install the required software and perform security configurations. The assigned Software Engineer will configure the rules and policies into the EPP system. Once done, our Test Engineer will perform rigorous testing procedures to ensure the system performs according to specifications. Upon the testing is fully completed, the EPP system shall be hand-over to System Administrator to perform deployment to production environment. Throughout the process, a Project Manager is assigned to perform project management and overall control on the implementation. The Project Manager will conduct training to the registry users on the functionalities of the system. The EPP setup shall be completed within a month.
The system will be in maintenance mode after the System is deployed. The EPP will be supported by general helpdesk support for enquiries. Any support issue related to EPP will be escalated to the Software Engineer for trouble shooting. System Administrator is tasked to monitor the EPP availability. Whenever there is a support ticket, Software Engineer and System Administrator will further escalate the support request base on severity. The emergency response team will be triggered whenever there is a catastrophe scenario at the highest severity. 

Once a remedy is identified, Test Engineer will perform testing on the fixes before deployment by System Administrator. During maintenance, Xiamen 35.com Technology Co., Ltd will commit the following resources for the 24 x 7 helpdesk, 2 data center engineers, 2 software engineers, 1 support manager, 1 test engineer and 1 system administrator. As part of on going policy changes, a team of software developer is available for any standards upgrade to the EPP and the changes will trigger the change request procedure in accordance to CMMI standards.

Please further refer to the detailed resource plan in question 31 for the human resource policy, job description and skills-required for the above-mentioned resources.

1 WHOIS System Architecture 

The WHOIS service contains data submitted by registrars during the domain name registration process. Any changes made to the data will be reflected in real-time, thus providing all interested parties with up-to-date information.
The WHOIS services to be provisioned include:
a) Port 43 command prompt WHOIS;
b) Searchable Port 80 web based WHOIS;
c) Configurable Port 43 rate limiter to prevent excessive request from the same IP;
d) Penalty for violation of query limit (e.g. barring access for the next 24 hours);
e) Ability to exclude certain IPs from normal rate limiting facilities;
f) Support multilingual WHOIS display; 
g) Easy, scalable and reliable WHOIS service;
h) Ensure accuracy in the display of WHOIS data; and
i) Conforms to RFC 3912.

2 WHOIS Access Method

WHOIS service shall be accessed via:

2.1 Command line (port 43)

The command line WHOIS allow queries by domain name in compliance to RFC 3912. The information will be displayed in a standard format. The WHOIS client makes a text request to the WHOIS server, then the WHOIS server replies with text content. All requests are terminated with ASCII CR and then ASCII LF. The response might contain more than one line of text, so the presence of ASCII CR or ASCII LF characters does not indicate the end of the response. The WHOIS server closes its connection as soon as the output is finished. The closed TCP connection is the indication to the client that the response has been received.

2.2 Registry Public Web Site (port 80)

The web based WHOIS is a searchable WHOIS by domain name, host name and registrant ID. The corresponding information will be displayed if a match is found.
 
Both web and command prompt WHOIS will be accessing a standard database connection pool before connecting to the database as shown below. The secondary database is configured to replicate the data from production database in real time.
Detailed description is provided in attachment (26-1.png)

3 DB Connection Thread Controller

The WHOIS system will connect directly to replicate secondary database using a connection pool which will limit the number of maximum connections that can be connected to the database at any given time. Once the maximum is reached, the remaining requests are queued until the current connections are released. If the connection(s) could not be released on time (until database timeout hits), the system will throw an error out stating that the system is currently busy. 

4 WHOIS Data Watch Service

 Registry will provide a watch service for alerts on WHOIS information change. Any changes on the WHOIS data will be alerted to the previous and the new email address of the registrant contact. This feature provides extra security to ensure accuracy of the WHOIS information. 

5 Searchable WHOIS Service

 Registry will offer searchable the web-based WHOIS Service. The searchable WHOIS will have partial match capabilities on the following fields: 
a) domain name
b) registrant’s name
c) registrant’s postal address
d) all the sub-fields described in EPP (e.g., street, city, state or province, etc.).

The WHOIS will offer exact-match capabilities on the following fields: 
a) registrar id
b) name server name
c) name server’s IP address (only applies to glue records).

The searchable WHOIS will allow Boolean search capabilities supporting logical operators to join a set of search criteria: AND, OR, NOT. The search results will include domain names matching the search criteria.

The web search is protected by Image Verification Check (IVC) and it is only provided to the verified subscribers. The subscribers shall provide identification card number or social security number and contact number as verification to ensure non-abusive use of this feature. The access to this service will be monitored by Registry.

All subscribers will agree to abide by all applicable privacy laws and policies as stated in the Searchable WHOIS Subscription Agreement.

6 WHOIS Query Control

The WHOIS service has the capability to perform query limit to avoid bulk access. The registry has the flexibility to amend the rate limit any time. To avoid further access to the registrant information, the search do not allow direct query on the registrant name for port 43. The search only allows query on Registrant ID. The search will return exact match results on port 43 to avoid harvesting of related matching records. 

7 WHOIS and Privacy

 Registry shall provide access to registrant information to the extent compatible with applicable privacy laws and policies. Registry shall not use the WHOIS data to send any unsolicited email to registrants, to solicit registrants by telephone or to otherwise engage in unauthorized uses of their data. Registry shall not sell any WHOIS data to third party under any circumstances. 
Registrars will agree to abide by all applicable privacy laws and policies as stated in the Registry Registrar Agreement. Registrars shall require customers to enter into an agreement prohibiting the customer from using the WHOIS database to send email, contact by phone or use it for other commercial purposes. 
Registrars are required to post privacy policies that provide clear and complete notice to registrants of the type of data that will be collected, the use of such data in operating the registry service and correct data maintained by Registry. Such data are required for submission of domain registration.

8 System Network and Hardware:

For optimum effect of WHOIS server, minimum 2 WHOIS servers will be provisioned. 2 database servers are provisioned as replicated secondary database cluster from the production site. The network diagram is provided in attachment (26-2.png).

9 Interconnectivity and Synchronization

A replicated secondary database cluster is configured to replicate data from the main database in the SRS system. The secondary database will provide WHOIS query and data access for reports. The replication will be done using MySQL bidirectional geographical replication feature which is near real time and providing active-active hot site. The monitoring system will probe the services in the SRS in real time. 
Source (SRS) to Destination (WHOIS)
- A secondary database cluster will be installed for providing the WHOIS response. The synchronisation is done using bidirectional database replication. The data are replicated to secondary database within mili seconds.

10 WHOIS Output

The WHOIS server is based on a template system for both web interface and command line based WHOIS. The templates can be configured and changed in real time. The standard WHOIS output format is as below:

10.1 Sample WHOIS Output (Search By Domain):

Domain Name:EXAMPLE.LIFE 
Created On:18-Feb-1996 05:00:00 UTC
Last Updated On:26-Mar-2010 16:53:27 UTC
Expiration Date:19-Feb-2015 05:00:00 UTC
Sponsoring Registrar:GoDaddy.com, Inc. (R91- )
Status:DELETE PROHIBITED
Status:TRANSFER PROHIBITED
Status:UPDATE PROHIBITED
Registrant ID: -0000012
Registrant Name:Registration Department
Registrant Organization:Domain Company.
Registrant Street1: 1511 Hayden Rd.
Registrant Street2:Ste 160, PMB 353
Registrant Street3:
Registrant City:Scottsdale
Registrant State⁄Province:Arizona
Registrant Postal Code:85260
Registrant Country:US
Registrant Phone:+1.4806242599
Registrant Phone Ext.:
Registrant FAX:+1.4806242598
Registrant FAX Ext.:
Registrant Email:admin@example.com
Admin ID: -22131674
Admin Name:Registration Department
Admin Organization:Domain Company.
Admin Street1:1511 Hayden Rd.
Admin Street2:Ste 160, PMB 353
Admin Street3:
Admin City:Scottsdale
Admin State⁄Province:Arizona
Admin Postal Code:85260
Admin Country:US
Admin Phone:+1.4806242599
Admin Phone Ext.:
Admin FAX:+1.4806242598
Admin FAX Ext.:
Admin Email:admin@example.com
Tech ID: -12131674
Tech Name:Registration Department
Tech Organization:Domain Company
Tech Street1:1511 Hayden Rd.
Tech Street2:Ste 160, PMB 353
Tech Street3:
Tech City:Scottsdale
Tech State⁄Province:Arizona
Tech Postal Code:85260
Tech Country:US
Tech Phone:+1.4806242599
Tech Phone Ext.:
Tech FAX:+1.4806242598
Tech FAX Ext.:
Tech Email:admin@example.com
Name Server:NS1.EXAMPLE. 
Name Server:NS2.EXAMPLE. 
DNSSEC:Signed
DS Created 1:26-Mar-2010 16:52:50 UTC
DS Maximum Signature Life 1:3456000 seconds
DS Key Tag 1:54135
Algorithm 1:5
Digest Type 1:1
Digest 1:225F055ACB65C8B60AD18B3640062E8C23A5FD89
DS Created 2:26-Mar-2010 16:53:27 UTC
DS Maximum Signature Life 2:3456000 seconds
DS Key Tag 2:54135
Algorithm 2:5
Digest Type 2:2
Digest 2:6CDE2DE97F1D07B23134440F19682E7519ADDAE180E20B1B1EC52E7F58B2831D

If the information does not exist, WHOIS will display a message e.g. “No Record Found”.

10.2 Sample WHOIS Output (Search By Host or Host IP: Web WHOIS Only):

Hostname: ns1.fivio. 
Created On:18-Feb-1996 05:00:00 UTC
Last Updated On:26-Mar-2010 16:53:27 UTC
Expiration Date:19-Feb-2015 05:00:00 UTC
Sponsoring Registrar:GoDaddy.com, Inc. (R91- )
IP address: 202.11.11.90
IP address: 202.11.11.91

10.3 Sample WHOIS Output (Search By Registrar Name, Address, Phone etc: Web WHOIS Only):

Registrar Name: Example Registrar, Inc.
Street: 1234 Admiralty Way
City: Marina del Rey
State⁄Province: CA
Postal Code: 90292
Country: US
Phone Number: +1.3105551212
Fax Number: +1.3105551213
NEW GTLD AGREEMENT SPECIFICATIONS
Email: registrar@example.tld
WHOIS Server: whois.example-registrar.tld
Referral URL: http:⁄⁄www. example-registrar.tld
Admin Contact: Joe Registrar
Phone Number: +1.3105551213
Fax Number: +1.3105551213
Email: joeregistrar@example-registrar.tld
Admin Contact: Jane Registrar
Phone Number: +1.3105551214
Fax Number: +1.3105551213
Email: janeregistrar@example-registrar.tld
Technical Contact: John Geek
Phone Number: +1.3105551215
Fax Number: +1.3105551216
Email: johngeek@example-registrar.tld

10.4 Sample WHOIS Output (Search By Registrant ID: Web WHOIS Only):

Registrant ID: -0000012
Created On:18-Feb-1996 05:00:00 UTC
Last Updated On:26-Mar-2010 16:53:27 UTC
Expiration Date:19-Feb-2015 05:00:00 UTC
Sponsoring Registrar:GoDaddy.com, Inc. (R91- )
Registrant Name:Registration Department
Registrant Organization:Domain Company.
Registrant Street1: 1511 Hayden Rd.
Registrant Street2:Ste 160, PMB 353
Registrant Street3:
Registrant City:Scottsdale
Registrant State⁄Province:Arizona
Registrant Postal Code:85260
Registrant Country:US
Registrant Phone:+1.4806242599
Registrant Phone Ext.:
Registrant FAX:+1.4806242598
Registrant FAX Ext.:
Registrant Email:admin@example.com

11 Internationalized Domain Name (IDN)

The same templates that are used for the English version will be used for IDN display. Users will have to convert the domain name to xn—before executing the query. 

12 IPv6 Address

Any hostname submitted with IPv6 AAAA record will be displayed. 

13 Resource and Operation Plan

Xiamen 35.com Technology Co., Ltd will deploy the Registry Service using its existing system and infrastructure. During the implementation of .life Registry, new server hardware will be provisioned for WHOIS services. Our Data Center Engineer will perform the server provisioning and installation of OS. Once the hardware is provisioned, System Administrator shall continue to install the required software and perform security configurations. On the other hand, the Database Administrator will ensure the database cluster work fine across geographically different data centers. The assigned Software Engineer will configure the WHOIS display template into the WHOIS system. Once done, our Test Engineer will perform rigorous testing procedures to ensure the system performs according to specifications. Upon the testing is fully completed, the WHOIS system shall be hand-over to System Administrator to perform deployment to production environment. Throughout the process, a Project Manager is assigned to perform project management and overall control on the implementation. The Project Manager will conduct training to the registry users on the functionalities of the system. The WHOIS setup shall be completed within 2 weeks.
The system will be in maintenance mode after the System is deployed. The WHOIS will be supported by general helpdesk support for enquiries. Any support issue related to WHOIS will be escalated to the Software Engineer for trouble shooting. System Administrator is tasked to monitor the EPP availability. Whenever there is a support ticket, Software Engineer and System Administrator will further escalate the support request base on severity. The emergency response team will be triggered whenever there is a catastrophe scenario at the highest severity. 

Once a remedy is identified, Test Engineer will perform testing on the fixes before deployment by System Administrator. During maintenance, Xiamen 35.com Technology Co., Ltd will commit the following resources for the 24 x 7 helpdesk, 2 data center engineers, 2 software engineers, 1 support manager, 1 test engineer and 1 system administrator. As part of on going policy changes, a team of software engineers is available for any standards upgrade to the WHOIS and the changes will trigger the change request procedure in accordance to CMMI standards.
Please further refer to the detailed resource plan in question 31 for the human resource policy, job description and skills-required for the above-mentioned resources.

1. Domain Life Cycle
A typical life cycle consists of six phases as Available、Registered、Auto-Renew Grace Period、Redemption Grace Period、Pending Delete、Released. Detailed description is provided in attachment (27-1.png)

2. Available phase：
The domain name is available for registration. There is no whois display when whois it. When query via command（domain：info）it returns message: Object doesn’t exist. The value of “Avail” is “1” when query via command（domain：check）, which means it is available for registration. In this phase, there is no record in the root zone till it is registered.

3. Registered phase：
The domain name is no longer for registration after being registered. Within the 5 days of initial registration of domain name, this period is called Add Grace Period
Registration rules,
(1). It is not reserved or blocked by the Registry;
(2). Minimum registration of 1 year and a maximum of 10 years;
(3). Anyone in the world is able to register .life domain names that must meet the following technical requirements:
(4). Contains a minimum of 3 characters and maximum of 63 characters (not including the “.life” suffix);
(5). Ccontains a minimum of 3 characters selected from the letters ‘a’ to ‘z’ or ‘A’ to ‘Z’ in standard US ASCII character set, the digits ‘0’ to ‘9’ and the hyphen (‘-’);
(6). Not beginning or ending with a hyphen (‘-’);
(7). Not containing a hyphen (‘-’) in both the 3rd and 4th positions;
(8). 1 and 2 characters .life domain names will be reserved by the Registry.

4. Add-Grace Period：

The Add Grace Period is a specified number of calendar days following the initial registration of the domain. The proposed Add Grace Period is 5 calendar days. If a domain name is deleted within the Add Grace Period, the sponsoring registrar will be refunded the amount of the registration fee. The domain name is immediately deleted from the registry database and available for registration by any registrar.
The registered phase lasts in the time span between domain being registered and expiration. Usually, it lasts for 1-10 years. The returned value of commanding （domain：check）is “0” when you query it in this phase, which means it is unavailable fore registration. The returned message contains information of sponsoring registrar, registration date, expiration date and status when querying via commanding （domain：info）. The domain name can be resolved and record exists in root zone. In this period, the common status of domain name is “ok”, whereas it also has other status. More detail is as below.

(1). 〈OK〉 --- This is the normal status value for a domain name that has no pending operations or prohibitions. This value is set and removed by the server as other status values are added or removed. ʺOKʺ status MUST NOT be combined with any other status.
〈clientDeleteProhibited〉 and 〈serverDeleteProhibited〉 ---The domain name can not be deleted in the following instances, which include, but are not limited to:
a. Evidence of fraud; 
b. UDRP action; 
c. Court order by a court of competent jurisdiction; 
d. Reasonable dispute over the identity of the Registered Name Holder or Administrative Contact; 
e. No payment (including credit card charge-backs); 
f. Express written objection to the deletion from the domain name Contact. (e.g. - email, fax, paper document or other processes by which the domain name Contact has expressly and voluntarily objected through opt-in means).

(2). 〈clientHold〉 and 〈serverHold〉 --- DNS delegation information MUST NOT be published for the object in the following instances, which include, but are not limited to:
a. Evidence of fraud; 
b. Court order by a court of competent jurisdiction; 
c. Express written statement to hold the domain name from the domain name Contact. (e.g. - email, fax, paper document or other processes by which the domain name Contact has expressly and voluntarily objected through opt-in means).

(3). 〈clientRenewProhibited〉 and 〈serverRenewProhibited〉 --- The domain name can not be renewed. If the domain name Contact expresses written objection to the renewal. (e.g. - email, fax, paper document or other processes by which the domain name Contact has expressly and voluntarily objected through opt-in means), the domain name can not be renewed.

(4). 〈clientTransferProhibited〉 and 〈serverTransferProhibited〉 --- The domain name can not be transferred in the following instances, which include, but are not limited to:
a. Evidence of fraud
b. UDRP action
c. Court order by a court of competent jurisdiction 
d. Reasonable dispute over the identity of the Registered Name Holder or Administrative Contact 
e. No payment for previous registration period (including credit card charge-backs) 
f. Express written objection to the transfer from the Transfer Contact. (e.g. - email, fax, paper document or other processes by which the Transfer Contact has expressly and voluntarily objected through opt-in means) 
g. The transfer was requested within 60 days of the creation date as shown in the registry Whois record for the domain name. 
h. A domain name is within 60 days (or a lesser period to be determined) after being transferred (apart from being transferred back to the original Registrar in cases where both Registrars so agree and⁄or where a decision in the dispute resolution process so directs). ʺTransferredʺ shall only mean that an inter-registrar transfer has occurred in accordance with the procedures of this policy.

(5). 〈clientUpdateProhibited〉 and 〈serverUpdateProhibited〉--- The domain can not be updated in the following instances, which include, but are not limited to:
a. Evidence of fraud; 
b. UDRP action; 
c. Court order by a court of competent jurisdiction; 
d. Reasonable dispute over the identity of the Registered Name Holder or Administrative Contact; 
e. No payment (including credit card charge-backs); 
f. Express written objection to the deletion from the domain name Contact. (e.g. - email, fax, paper document or other processes by which the domain name Contact has expressly and voluntarily objected through opt-in means).

Transfer Status
(1). 〈 clientApproved 〉 ---The transfer contact approved the transfer request. 
(2). 〈 clientCancelled〉 ---The transfer contact cancelled the transfer request.
(3). 〈 clientRejected 〉 ---The transfer contact rejected the transfer request.
(4). 〈 pending 〉 ---The domain name is in pending transfer.
(5). 〈 serverApproved 〉 --- The registry appproved the transfer request.
(6). 〈 serverCancelled 〉 ---The registry cancelled the transfer request.

A transform command has been processed for the object, but the action has not been completed by the server. Server operators can delay action completion for a variety of reasons, such as to allow for human review or third-party action. A transform command that is processed, but whose requested action is pending, is noted with response code 1001.
When the requested action has been completed, the pendingDelete, pendingRestore or pendingTransfer status value MUST be removed. All clients involved in the transaction MUST be notified using a service message that the action has been completed and that the status of the object has changed.
(1). 〈pendingDelete〉--- ʺpendingDeleteʺ status MUST NOT be combined with either ʺclientDeleteProhibitedʺ or ʺserverDeleteProhibitedʺ status.
(2).〈pendingRestore〉--- ʺpendingRestoreʺ status MUST NOT be combined with either ʺclientRenewProhibitedʺ or ʺserverRenewProhibitedʺ status.
(3). 〈pendingTransfer〉--- ʺpendingTransferʺ status MUST NOT be combined with ʺserverTransferProhibitedʺ status.
The pendingCreate, pendingDelete, pendingRenew, pendingTransfer, and pendingUpdate status values MUST NOT be combined with each other.

5. Auto-Renew Grace Period:

The Auto-Renew Grace Period is a specified number of calendar days following the completion of the auto-renewal (via batch process) of the domain name. The proposed Auto-Renew Grace Period is 45 calendar days. 

If the sponsoring registrar does not renew the domain name prior to its expiration date, the registry automatically renews the domain for 1 year. The renewal of the domain name is executed by the registry system the day prior to the expiration date via a batch process. The sponsoring registrar has 45 calendar days to delete the domain and receive a refund for the domain name renewal fee. 

If a Delete, Renew, or Transfer operation occurs within the 45 calendar days, the following rules apply:

(1). If the domain is not deleted within the auto-renew grace period, the 1 year auto-renewal takes into effect and the domain name will then go into Registered phase, but in the case, there will be no Add-Grace Period. 
(2). If the domain name is explicitly renewed for additional years (up to total 10 years of duration) or transferred within Auto-renew grace period, there will also be no Add-Grace Period
(3). If a domain name is deleted within the Auto-Renew Grace Period, the sponsoring registrar will be refunded the renewal fees. After deletion, the domain enters into Redemption grace period.
(4). In this Auto-renew grace period, the domain record exists in Root zone. After deletion, the domain goes through Redemption Grace Period.

Status might apply：
(1). 〈clientDeleteProhibited〉 and 〈serverDeleteProhibited〉 ---The domain name can not be deleted in the following instances, which include, but are not limited to:
a. Evidence of fraud; 
b. UDRP action; 
c. Court order by a court of competent jurisdiction; 
d. Express written objection to the deletion from the domain name Contact. (e.g. - email, fax, paper document or other processes by which the domain name Contact has expressly and voluntarily objected through opt-in means).
(2). 〈clientHold〉 and 〈serverHold〉 ---The domain will be in “hold” status according to court order by a court of competent jurisdiction.
(3). 〈clientRenewProhibited〉 and 〈serverRenewProhibited〉--- The domain name can not be renewed. If the domain name Contact expresses written objection to the renewal. (e.g. - email, fax, paper document or other processes by which the domain name Contact has expressly and voluntarily objected through opt-in means), the domain name can not be renewed.
(4). 〈clientTransferProhibited〉 and 〈serverTransferProhibited〉 --- The domain name can not be transferred once the domain name expired.
(5). 〈clientUpdateProhibited〉 and 〈serverUpdateProhibited〉 ---The domain name can not be updated once the domain name expired.

6. Redemption Grace Period:
When a domain name is deleted outside of the Add grace period it is placed on Redemption Period status for 30 days. When a domain name is deleted within the 5-day Add grace period, it is immediately removed from the zone file and made available for registration. The redemption period is designed to help registrars defend against inadvertent deletions. By placing the domain name on Redemption period status for 30 days, the registrar has a significant amount of time to correct the mistaken deletion and not worry about the domain name being deleted from the system.

No modification or resolution can be carried out to the domain name while in Redemption Grace period status. If the domain name is not restored during the 30 days grace period, the domain name is then placed on Pending Delete status for 5 days.

Status may apply：
〈pendingRestore〉--- This status value is used to describe a domain that is in the process of being restored after being in the redemptionPeriod state. The domain name stays in pendingRestore status for 7 calendar days or until a Restore Report is received from the Registrar and verified to be complete.

7. Pending Delete Period:
The proposed Pending Delete Period is 5 calendar days. A domain name that is deleted outside of the Add Grace Period, and does not have a RESTORE command issued during the 30 day Redemption Period is placed into the Pending Delete Period. 

Once a domain enters the Pending Delete Period, it cannot be restored. The domain stays in pendingDelete status for 5 days and then it is purged from the system at the end of the 5 days. It should be noted that no EPP operations can be performed on domains with the pendingDelete status. Once it is purged from the registry’s system, it becomes available for registration.

Status may apply：
〈pendingDelete〉---The status only applies to the instance when the domain name was not renewed and redeemed and dropped into the pending delete period.

8. Released：
Once the domain name is released, it becomes available for registration again.

9. Resource and Operations Plan
Xiamen 35.com Technology Co., Ltd will deploy the Registry Service of .life Registry using its existing system and infrastructure. The assigned Software Engineer will configure the domain life cycle into the system. Once done, our Test Engineer will perform rigorous testing procedures to ensure the system performs according to specifications. Upon the testing is fully completed, the configurations shall be hand-over to System Administrator to perform deployment to production environment. Throughout the process, a Project Manager is assigned to perform project management and overall control on the implementation. The Project Manager will conduct training to the registry users on the domain life cycle of the system. The domain life cycle setup shall be completed within 2 weeks.
The system will be in maintenance mode after the System is deployed. The domain life cycle will be supported by general helpdesk support for enquiries. Any support issue related to domain life cycle will be escalated to the Application Support Engineer for trouble shooting. Whenever there is a support ticket, Application Support Engineer will further escalate the support request base on severity. The emergency response team will be triggered whenever there is a catastrophe scenario at the highest severity. 
Once a remedy is identified, Test Engineer will perform testing on the fixes before deployment by System Administrator. During maintenance, Xiamen 35.com Technology Co., Ltd will commit the following resources for the 24 x 7 helpdesk, 2 software engineers, 1 support manager, 1 test engineer and 1 system administrators. As part of on going policy changes, a team of software developer is available for any standards upgrade to the domain life cycle and the changes will trigger the change request procedure in accordance to CMMI standards.

Please further refer to the detailed resource plan in question 31 for the human resource policy, job description and skills-required for the above-mentioned resources.

Domain Name Anti-Abuse Policy

The following policy (ʺ.Life Domain Anti-Abuse Policyʺ) is defined by the Registry and to be adhered by its Registrars and agents. 

1. Abusive Use
Abusive use(s) of .Life domain names shall not be tolerated. The nature of such abuses creates security and stability issues for the registry, registrars, registrants, as well as users of the Internet in general. ...Life registry defines abusive use of a domain as the wrong or excessive use of power, position or ability, and includes, without limitation, the following:

Illegal or fraudulent actions;

Spam: The use of electronic messaging systems to send unsolicited bulk messages. The term applies to e-mail spam and similar abuses such as instant messaging spam, mobile messaging spam, and the spamming of Web sites and Internet forums. An example, for purposes of illustration, would be the use of email in denial-of-service attacks;

Phishing: The use of counterfeit Web pages that are designed to trick recipients into divulging sensitive data such as usernames, passwords, or financial data;

Pharming: The redirecting of unknowing users to fraudulent sites or services, typically through DNS hijacking or poisoning;

Willful distribution of malware: The dissemination of software designed to infiltrate or damage a computer system without the ownerʹs informed consent. Examples include, without limitation, computer viruses, worms, keyloggers, and trojan horses;

Fast flux hosting: Use of fast-flux techniques to disguise the location of Web sites or other Internet services, or to avoid detection and mitigation efforts, or to host illegal activities. Fast-flux techniques use DNS to frequently change the location on the Internet to which the domain name of an Internet host or name server resolves;

Botnet command and control: Services run on a domain name that is used to control a collection of compromised computers or ʺzombies,ʺ or to direct denial-of-service attacks (DDoS attacks);

Distribution of child pornography; and

Illegal Access to Other Computers or Networks: Illegally accessing computers, accounts, or networks belonging to another party, or attempting to penetrate security measures of another individualʹs system (often known as ʺhackingʺ). Also, any activity that might be used as a precursor to an attempted system penetration (e.g., port scan, stealth scan, or other information gathering activity).

2. Registration(s) abuse
Registration(s) abuse of .life domain names, according to Registration Abuse Policies Working Group Initial Report includes the following, which are all prohibited.

Cybersquatting: Cybersquatting is the deliberate and bad-faith registration or use of a name that is a registered brand or mark of an unrelated entity, for the purpose of profiting (typically, though not exclusively, through pay-per-click advertisements). We adopt the provisions 4(a) and 4(b) of the UDRP as a sound definition of Cybersquatting.

Domain kiting ⁄ tasting: Registrants may abuse the Add Grace Period through continual registration, deletion, and re-registration of the same names in order to avoid paying the registration fees. This practice is referred to as “domain kiting.” This term has been mistakenly used as being synonymous with domain tasting, but it refers to multiple and often consecutive tasting of the same domain. 

3. Prohibition Suspension and Cancellation
You agree that you will not (i) use our services to commit a criminal offense or to encourage conduct that would constitute a criminal offense or give rise to a civil liability, or otherwise violate any local state, Federal or international law or regulation; (ii) upload or otherwise transmit any content that you do not have a right to transmit under any law or contractual or fiduciary duty; (iii) interfere or infringe with any trademark or proprietary rights of any other party; (iv) interfere with the ability of other users to access or use our services; (v) claim a relationship with or to speak for any individual, business, association, institution or other organization for which you are not authorized to claim such a relationship; (vi) interfere with or disrupt the service or servers or networks connected to the service, or disobey any requirements, procedures, policies or regulations of networks connected to the service; or (vii) reproduce, duplicate, copy, use, distribute, sell, resell or otherwise exploit for any commercial purposes any portion of the services.

Upon the provisions of RRA, registrar shall promptly investigate complaints alleging any abusive practices, and shall take all appropriate actions based on investigations. Registrar shall use commercially reasonable effort to resolve the complaints, as request or recommended by the registry or any legal authority. Registrarʹs failure to comply with the policy shall constitute a material breach of the RRA, and shall give rise to the rights and remedies available to the registry under the RRA.

Please acknowledge that, according to relevant provisions in RRA, the registry reserves the right to deny, cancel or transfer any registration or transaction, or place any domain name(s) on registry lock, hold or similar status, that it deems necessary, in its discretion; (1) to protect the integrity and stability of the registry; (2) to comply with any applicable laws, government rules or requirements, requests of law enforcement, or any dispute resolution process; (3) to avoid any liability, civil or criminal, on the part of the registry, as well as its affiliates, subsidiaries, officers, directors, and employees; (4) per the terms of the registration agreement or (5) to correct mistakes made by the registry or any Registrar in connection with a domain name registration.
 
The abusive activities, as defined above, undertaken with respect to ...life domain names shall give rise to the right of its registry to take such actions under Section 3.6.5 of the RRA in its sole discretion.

Single Abuse Point of Contact

1. The registry will prominently publish abuse contact information on its website. 
2. The public can easily discover the contact page on the registryʹs home website
3. The abuse contact information consists of telephone and email address.
4. The contact at the registry will be empowered to act in response to a well-founded report of illegal, criminal or malicious activity or any other abuse outlined activities in abuse policy.
5. All reports of abuse should be sent to our abuse department at
Email: abuse@registry.life.
Mailing Address: 35.com building, No8 Guanri Road, XiaMen, China.
Link published: http:⁄⁄www.registry.life⁄abuse-policy.htm
 
Anti-Abuse Measures

To enhance the security, integrity and quality of .life domain names, we are committed to delivering reliable and appropriate measures⁄services to mitigate and prevent harm the rights and interests of third parties and keep .life safe. The registry will incorporate the Anti-Abuse policy into the Registry Registrar Agreement (RRA). 

The follow tools or measures aim to against illegal online activity.

1. Phishing and Spam feed - this service provides registrars with information about domain names on their account that are suspected of being involved in phishing and or unsolicited email behavior. We will work with Top Anti-Fraud Centers & security companies in the industry for instance Netcraft, Spamhaus, which will provide the data feed of sites that have been reported as phishing sites. This data will alert the registrar(s) of domain names belonging to. Once registrars received the alert notification, they can check on the domain names and take further appropriate actions. The 〈Hold〉 operation is the auxiliary method to lame the domain name involved during investigation process. 

2. Registry⁄Client Hold - this operation means DNS delegation information MUST NOT be published for the object, which results in any web site or email associated with the domain name will no longer be available. As indicated, the Server Hold operation is applicable for registry operator whilst the Client hold is applicable for registrar(s). Client Hold can be accomplished by EPP mode or registrar domain management panel.

3. Trademark Clearinghouse - The Trademark Clearinghouse is a central repository for information to be authenticated, stored, and disseminated, pertaining to the rights of trademark holders. ICANN will enter into an arms-length contract with service provider or providers, awarding the right to serve as a Trademark Clearinghouse Service Provider, i.e., to accept, authenticate, validate and facilitate the transmission of information related to certain trademarks. The trademark clearinghouse being required to provide two primary functions:
(1) Authentication and validation of the trademarks in the Clearinghouse
(2) Serving as a database to provide information to the new gTLD registry to support pre-launch Sunrise or Trademark Claims Services

The Registry will give owners of trademarks entered in the Trademark Clearinghouse the right to register a domain name consisting of the trademark before registration is available to the general public. In the meantime, those attempting to register a domain name that is in the Trademark Clearinghouse will be notified that the proposed domain name is a trademark while owners of those trademarks, and if entered in the Trademark Clearinghouse, will receive notifications when someone tries to register a domain name that is identical to their trademarks. 

4. UDRP – As stated on ICANN’s UDRP page, all registrars must follow the Uniform Domain-Name Dispute-Resolution Policy (often referred to as the ʺUDRPʺ). Under the policy, most types of trademark-based domain-name disputes must be resolved by agreement, court action, or arbitration before a registrar will cancel, suspend, or transfer a domain name. Disputes alleged to arise from abusive registrations of domain names (for example, cybersquatting) may be addressed by expedited administrative proceedings that the holder of trademark rights initiates by filing a complaint with an approved dispute-resolution service provider. In this regard, we absolutely adopt this policy and implemented in RRA (Registry-Registrar-Agreement). 

5. URS – Also known as Uniform Rapid Suspension System is designed to offer trademark owners a quick and low-cost procedure to take down infringing websites. Unless the decision is reversed, the domain name will point to a mandatory URS placeholder page for the remaining registration period. Within 1 working days of the receipt of the notice of Complaint from the accredited URS provider, we will place administrative “lock” on the domain name; in the case, the domain name can’t be transferred, deleted, and its whois information can’t be updated. Upon receipt of the determination, we will act to comply with the Determination within 1 working day of receipt.

6. Deletion-Limit in AGP- As known, the five-day ‘Add Grace Period’ is commonly given to registrars to rectify errors when registering new domain names without cost. However, it is unfairly token advantage of by speculators testing the profitability of domain names through advertising revenues and or put it in bad-faith use. Based on this, we will introduce limits on the number of domains a registrar could delete against this kind of abuse. The limit is set at 10% of the total number of domains registered, which will deter abuse and at the same time keep the flexibility for registrars to correct the genuine errors might occur, like mistype, anti-fraud, etc. 

The registry seeks Collaborative work with Law Enforcement and the Antiphishing Working Group (APWG), the Computer Emergency Response Teams (CERT) and share data with them. Besides that, the registry intends to apply for membership of industry groups, like the RISG (Registry Internet Safety Group, thus sharing best anti-abuse practices and set up collaboration across the industry.

Note, 
All the requests and decisions from the UDRP & URS provider will be executed in the time scope defined by the consensus policy published.
 
Handling Complaints procedure

In addition to the Phishing and Spam feed provided to help accredited registrars monitor and reduce domain’s abusive use, we will also provide an channel for the public to report any abuse. Any individual and party can lodge a complain via abuse@registry.life. Below is the procedure of for handling complaints:

1.Categories:

[Category 1], 24-hour Response:
Spam

[Category 2], 16-Hour Response:
Fast flux hosting

[Category 3], 8-Hour Response:
Phishing
Pharming
Willful distribution of malware
Botnet command and control
Illegal Access to Other Computers or Networks
Illegal or fraudulent actions

[Category 4], 1-Hour Response:
Distribution of child pornography

1.1 Above is the standard response time for the various categories imposed on registrars. The response times act as a guide and are not a guarantee and may be modified on a case-by-case basis depending on the abuse type, severity, history, quantity of complaints, upstream provider requirements, and other factors.

2. Procedure for handling complaint:

2.1 The complainant collects the evidence of abuse in connection to the alleged domain name and sends them to abuse@registry.life. The content must include the domain name in question, the abuse type and evidence material.

2.2 Within 24 hours of the receipt of complaint, if material is verified, we will forward the complaint to the registrar that is sponsoring the registration of domain name concerned. 

2.3 The sponsoring registrar shall take appropriate steps to investigate the case and act within the response time given in 1 paragraph. The registrar might suspend the domain name first to prevent further abuse to third parties. 

2.4 The domain name will be taken out of the zone by the registry if the registrar fails to respond to the complaint.

2.5 In the event that the breach has been resolved, the “hold” status can be removed from the domain name.

The registry is committed to offering a high level of cooperative service with law enforcement. Our legal team will respond to the request of all subpoenas, court orders, search warrants, emergency requests and the other legal requests within 24 hours of receipt of the request which could be accepted by email and fax. The email and fax contact information being published on our website contact page. The registry is permitted to disclose account’s registered information, log-in and other information voluntarily to a federal, state, or local governmental entity, and reserve the right to temporarily suspend or even terminate the account, disclose the information according to the relevant Electronic Act where applicable. 

Orphan Glue Record

As definition in SAC 048 - SSAC Comment on Orphan Glue Records in the Draft Applicant Guidebook, orphan records used to be glue records, however, it becomes an ʺorphanʺ when the delegation point NS record referencing it is removed without also removing the corresponding glue record. The delegation point NS record is sometimes referred to as the parent NS record. 

As pointed out in the book, there might be inconsistencies and even abuse behavior connecting to the domain name which is still using on the orphan record because of the lack of administrative control and lack of attribution for this orphan record. The registry doesn’t allow the existence of orphan records. Once the parent NS record is removed, the associated glue record(s) will also be removed consequently. 
 
Service Level Requirement for resolution

1. Rapid Takedown Dispute Resolution Policy

The registry may provide a Rapid Takedown process through engagement with a dispute solution provider that consists of a response team of qualified expert (qualified UDRP panelists). The registry agrees that majority of cases that go through the Uniform Dispute Resolution Process (UDRP) are mainly obvious variant of well-known marks. As such, it would be a waste time or resources for the most obvious cases of infringement to go through the UDRP fillings. Registry may provide a rapid takedown process where a response team of qualified experts (qualified UDRP panelists) will be involved to determine within 48 hours of receipt of a short and simple claim of involving a well-known mark or otherwise inherently distinctive mark and a domain name where no conceivable good faith basis exists. The results may result in an immediate termination of the domain name, but will not prejudice either partyʹs election to pursue other dispute mechanisms.

2. Response to Law enforcement requests

In response to law enforcement requests, the registry will use the provision within the Anti-abuse policy to act quickly to take down sites that are being involved with any illegal activities. 

3. Uniform Rapid Suspension System

Registry will cooperate with ICANN for the implementation of URS, shall the policies and procedures are finalized. The involvement of the registry for the scope of URS shall include the followings:

3.1. Upon completion of the Administrative Review, the URS Provider will immediately notify the registry (via email) (“Notice of Compliant”) after the Compliant has deemed compliant with the filing requirements. Within 24 hours of receipt of the Notice of Complaint from the URS Provider, the registry shall “lock” the domain name, meaning the registry shall restrict all changes to the registration data, including transfer and deletion of the domain names, but the name will continue to resolve. The registry will notify the URS provider immediately upon locking the domain name (“Notice of Lock”).

3.2. If after the Examination in Default case, the Examiner rules in favor of the Registrant, the URS provider shall notify the registry. Upon receiving the official notice from the URS provider, the registry will unblock the name and return full control of the domain name registration to the Registrant.

3.3 If the Determination is in favor of the Complainant, upon receiving the official decision from the URS provider, the registry will suspend the domain name, which shall remain suspended for the balance of the registration period and would not resolve to the original web site. The nameservers shall be re-directed to an informational web page provided by the USR Provider. 

The Registry will incorporate URS into the Registration policies, as a takedown measures and procedures to minimize abusive registration. 

4. Disqualification of Registrant

Traditionally, speculative abusive domain name registrations have always attracted a small group of individuals and organizations specializing in high volume registrations due to the profitability of abusive registrations. Registry may disqualify any registrants that have been found to be making abusive registrations and their agents or any parties determined to be acting in cahoots will also be disqualified from maintaining any registrations or making future registrations.

Measures to promote Whois accuracy

1. Registrar and Registrant Obligations About Whois. 
1.1 Submission of Registered Name Holder Data to Registry
1.1.1 Registrar shall submit the following data elements to the registry:
The name of Registered Name being registered;
The IP addresses of the primary name server and secondly name servers for the registered name;
The original creation date of the registration;
The expiration date of the registration;
The name, postal address, e-mail address, voice telephone number, and (where available) fax number of the registrant for the registered name;
The name, postal address, email address, voice telephone number, and (where available) fax number of the administrative contact for the registered name; and
The name, postal address, email address, voice telephone number, and (where available) fax number of the technical contact for the registered name; and
The name, postal address, email address, voice telephone number, and (where available) fax number of the billing contact for the registered name; and

1.2 Upon receiving any updates to the data elements listed in Section 3.3 from the Registrant, Registrar shall promptly, and no later than twenty-four (24) Hours, update its database and provide such updates to the Registry.

1.3 Registrar shall require all registrants to enter into an electronic or paper registration agreements with registrar including at the least the following provisions:
1.3.1 The registrant shall provide to registrar accurate and reliable contact details and promptly correct and update them during the term of the registered name registration, including: the full name, postal address, email address, voice telephone number, and fax name if available of the registrant; name of authorized person for contact purposes in the case of a registrant that is an organization, association, or corporation.

1.3.2 A registrantʹs willful or grossly negligent provision of inaccurate or unreliable information, its willful or grossly negligent failure promptly to update information provided to registrar shall constitute a material breach of the registration’s registration agreement with the registrar and be a basis for cancellation of the registered name registration.

1.3.3 Any Registered Name Holder that intends to license use of a domain name to a third party is nonetheless the Registered Name Holder of record and is responsible for providing its own full contact information and for providing and updating accurate technical and administrative contact information adequate to facilitate timely resolution of any problems that arise in connection with the Registered Name. A Registered Name Holder licensing use of a Registered Name according to this provision shall accept liability for harm caused by wrongful use of the Registered Name, unless it promptly discloses the identity of the licensee to a party providing the Registered Name Holder reasonable evidence of actionable harm.

1.4 Enforcement of Accurate Whois Data

1.4.1 Registrar shall accept written complaints from third parties regarding false and⁄or inaccurate whois data of registrants.

1.4.2 No later than thirty (30) days after receipt of a written complaint, the registrar shall conduct an initial investigation into the veracity and accuracy of the contact details. If the registrar determines that the information is false, inaccurate or not up to date, registrar shall issue a letter to the registrant via email, and regular fist class mail, stating that the information contained in the registrant’s whois record may be false, inaccurate or not up to date.

1.4.3 The registrant shall be required to update its contact information not later than thirty (30) calendar days from the date of such notice. If, within(30) days, registrant can either (i) show that it has not provided false or inaccurate contact information or (ii) provide the updated whois information, then the registrant will be allowed to maintain its TLD domain name registration. If, however, after thirty (30) days, the registrant either does not respond to registrar’s notice or is unable to provide true and accurate contact information, the registrant shall be deemed to have breached its registration agreement and the registrar shall be required to delete the registration.

1.4.4 The registrant shall abide by any specifications or policies establish, (a) verification, at the time of registration, of contact information associated with a registered name sponsored by Registrar or (b) periodic re-verification of such information. Registrar shall, upon notification by registry or any other third party of an inaccuracy in the contact information associated with a registered name sponsored by registrar, take the steps to investigate the claimed inaccuracy. In the event registrar learns of inaccuracy contact information associated with a registered name it sponsors, it shall take the steps to correct that inaccuracy. In addition, registrar shall designate an agent to receive notification from registry regarding inaccurate or incomplete data concerning all active registered name sponsored by registry in the .Life TLD, and shall provide to registry the name, postal address, voice telephone number and e-email address of such designated agent.

2. Whois Reminder

2.1 Routine Whois Data Reminder 

At least annually, a registrar must present to the registrant the current Whois information, and remind the registrant that provision of false Whois information can be grounds for cancellation of their domain name registration. Registrants must review their Whois data, and make any corrections. 

2.1.1 Time for Coming into Compliance: As provisions stated in our Accreditation Agreement, all accredited registrars must come into compliance with the WDRP by their ʺCompliance Dateʺ, as described in the next two sentences. The compliance date for registrars accredited is the effective date of their accreditation agreements.

Beginning on its Compliance Date, each registrar must provide, before the passage of the anniversary of the creation date of each registration the registrar sponsors, a WDRP Notice (described below) to the registrant for that registration. By way of example, a registrar with a Compliance Date of April 15, 2012 is required to give a WRDP notice for registrations it sponsors on the following schedule: 

Compliance Date is April 15, 2012 
Domain Name | Creation Date | DRP Notice Required No Later Than 
example.life | 14 October 2013 | 14 October 2014 (and by 14 October of every year thereafter) 
Example2.life| 25 January 2014 | 25 January 2015 (and by 25 June of every year thereafter) 

(Note: WDRP Notices for registrations with creation dates of 29 February may be given no later than 1 March in non-leap years.) 

2.1.2 What the WDRP Notice Must Include: Each WDRP notice must include a copy of the data elements listed in RAA subsection 3.3.1 as contained in the registrarʹs database for each registration, plus a statement reminding the registrant that under the terms of the registration agreement the provision of false Whois information can be grounds for cancellation of a domain name registration.

2.1.3 How, and to whom, the WDRP Notice May Be Presented: The WDRP Notice can be presented via web, fax, postal mail, e-mail, or other appropriate means. It can be presented in one or more languages, including at least the language of the registration agreement. The Notice may be presented to the registrant either directly or through the administrative contact for each registration.

2.1.4 Documentation Requirements: Registrars must maintain either copies of each WDRP Notice or an electronic database documenting the date and time, and the content, of each WDRP notice sent under this policy. Registrars shall make these records available for inspection by ICANN in accordance with the usual terms of the Registrar Accreditation Agreement. ICANN will consider proper notification to have been given for a registration if the registrar can show that a WDRP Notice meeting the requirements stated above was given at any time in the year before each anniversary of the registrationʹs creation date (for anniversary dates on or after the Compliance Date).

Model WDRP Notice: In order to assist registrars in preparing the required notice, the following sample of WDRP Notice has been given below:

[Sample begins] 
Whois Data Reminder 
Dear Valued Customer,
This message is a reminder to help you keep the contact data associated with your domain registration up-to-date. Our records include the following information:
Domain: example.life
Registrar Name: Registry Registrar
Registrant Contact:
Name: 35.com. 
Address: 35.com building 
No 8 guanri road
City: Xiamen 
State⁄Province: Fujian 
Country: CN
Postal Code: 361008
Phone: 0086-0592-539-0000
Fax: 0086-0592-539-0000
Email: support@registry.life
Administrative Contact:
Name: 35.com. 
Address: 35.com building 
No 8 guanri road
City: Xiamen 
State⁄Province: Fujian 
Country: CN
Postal Code: 361008
Phone: 0086-0592-539-0000
Fax: 0086-0592-539-0000
Email: support@registry.life
Technical Contact:
Name: 35.com. 
Address: 35.com building 
No 8 guanri road
City: Xiamen 
State⁄Province: Fujian 
Country: CN
Postal Code: 361008
Phone: 0086-0592-539-0000
Fax: 0086-0592-539-0000
Email: support@registry.life
Billing Contact:
Name: 35.com. 
Address: 35.com building 
No 8 guanri road
City: Xiamen 
State⁄Province: Fujian 
Country: CN
Postal Code: 361008
Phone: 0086-0592-539-0000
Fax: 0086-0592-539-0000
Email: support@registry.life
Original Creation Date: 25⁄10⁄2012
Expiration Date: 25⁄10⁄2013
Nameserver Information:
Nameserver: ns1.registry.life
Nameserver: ns2.registry.life

If any of the information above is inaccurate, you must correct it by visiting our website. (If your review indicates that all of the information above is accurate, you do not need to take any action.) Please remember that under the terms of your registration agreement, the provision of false Whois information can be grounds for cancellation of your domain name registration.

Thank you for your attention.

Best regards, 
Registry registrar 
[Sample ends] 

2.2 Whois Reminder

Upon receiving the update to the data elements to the domain name sponsored, Registrar shall provide separate notices to new registrant and old registrant about the details of the update, including the old data and the new data and IP conducted the change. This is to inform the old registrant that change might be done without his⁄her consent and he⁄she shall report this to registrar’s support team for this potential illicit change and make any corrections. The new registrant must review the whois data, and assure its accuracy. A sample of notice to the old registrant given below,

[Sample begins] 
Dear Domain Registrant, 

We have detected that the change below. If you believe someone else has changed your account without authorization, please contact our support team by any means available immediately for data protection. The time of modification and IP address of the computer sending the request are below.

Time of modification: Year-Month-Day Time IP address: 110.222.113.114

[Domain name]

[The Old Data]

[The New Data]

Sincerely,

Registry Registrar

[Sample ends]
 
3. Whois Data Compliance 

3.1 Outside Reach

Every accredited Registrar is required to maintain accurate WHOIS information for all domain names as per the RAA. if there are reported inaccuracies in the contact information for any domain name, the sponsored registrar shall investigate and take steps for correction.

The registry makes every endeavor on improving Whois data accuracy. The registry also provides a reporting tool to allow the public to report the inaccuracy of Whois data on any .life domain names. The link will be located at http:⁄⁄www.regsitry.life⁄whois-report.html. The domain’s sponsoring Registrar is required to act on the complaint according to ICANN’s Registrar Advisory Concerning the ʺ15-day Periodʺ in Whois Accuracy. 

How the public reporting system works

3.1.1 Upon receiving a compliant from the public, the registry will ask for verification from the complainant by email. If the complainant does not reply within 2 days, the report will be disregarded.
 
3.1.2 Once complaint is verified, the registry will forward it to the registrar, that is sponsoring the domain names in question, for handling according to ICANN’s Registrar Advisory Concerning the ʺ15-day Periodʺ in Whois Accuracy. 
3.1.3 The sponsoring registrar will initiate an investigation and update its findings to the registry accordingly. The result may include: 1) The data inaccuracy was corrected. 2) The information was verified and found to be correct. 3) The domain has been deleted, cancelled or suspended. 

3.1.4 The reporting system will record the result and close the complaint automatically.

3.1.5 The registry compliance team will review the case and ask for for more supporting information if necessary.

The complaint will remain open in the Registry’s internal tracking system untill the Registrar’s investigation result has been received. The registry’s compliance manager will give registrar formal notice if the report has been ignored.

3.2 Registry’s Audit

3.2.1 The registry will randomly sample registered domain names from every active accredited registrar and attempt to verify the validity of the Whois data on daily basis. Each Whois record will be reviewed for population of the following data fields:
The name of the registered name
The names of the primary nameserver and secondary nameservers for the registered name
The identity of registrar (which may be provided through the registrarʹs website)
The original creation date of the registration 
The expiration date of the registration
The name and postal address of the registered name holder
The name, postal address, e-mail address, voice telephone number, and (where available) fax number of the technical contact for the registered name
The name, postal address, e-mail address, voice telephone number, and (where available) fax number of the administrative contact for the registered name

3.2.2 If the Whois output by registry’s manual verifying is deemed satisfactory, the result will be noted so the domain name will not be sampled next round again.

3.2.3 If the Whois output is deemed unsatisfactory, the sponsoring registrar will be notified of their obligation to take reasonable steps to investigate and correct the Whois inaccuracies. The registrar will be requested to submit the investigation steps and result to the registry’s compliance team within 15 days. 

3.2.4 The failure of response to the WDPRS reports filed concerning domain names registered through their companies constitutes the breach of registrar’s obligation provisions in RRA and RAA. The registry’s compliance manager will then contact the registrar to ensure the breach is resolved.


Data Access Security Control

The registry include provision below in RRA that,
1. the data access requires strong passwords given to domain’s registrant to process update, transfer, and deletion requests.
2. the only registrant contact is authorized to process update, transfers, and deletion requests. 
3. the notification of multiple, unique points of contact when a domain name has been updated, transferred or deleted.

 
Resourcing Plan

Xiamen 35.com Technology Co. Ltd will commit the following resources to manage domain name abuse and Whois accuracy:

Job description and requirements:

Position⁄Number 
The Compliance Manager ⁄ 1
Responsibilities:
Coordination with the outsource service providers towards the RPM mechanisms namely Trademark Clearing House, URS, PDDRP, and UDRP, and legal affairs.
Responsible for various compliance matters of .Life registry
Works independently within established policies, guidelines and strategies; develop relevant policies and procedures as necessary. 
Advanced professional knowledge and expertise.
Demonstrates seasoned and proven judgment.
Compliance Training & Compliance Manual.
Internal reports and inquiries: prepare compliance internal reports.
Supervision: supervise compliance rep and delegate some of the responsibilities as appropriate.
Other compliance matters that may be assigned.

Requirements:
5 years industry experience required.
Extensive knowledge and understanding of the internet and network.
Previous compliance experience is required.
Computer literate.
Strong interpersonal skills and a team player.
Strong written and spoken English in addition to the local language.
Bachelor⁄University degree.
Skilled in MS OS and Office software.
Legal background is a plus.

The compliance staff ⁄ 1
Job Responsibilities:
Receive incoming reports and abuse complaints.
Carry out handling procedure.
Review the issues.
Regular Report to the manager.

Requirements:
Solid understanding of internet terminology.
Knowledge of basic office skills (Word, Outlook, Excel, general database).
Exceptional written & verbal communication.
Ability to learn and effectively utilize customer support tools⁄resources.
Six months customer service experience.
Preferred educational background in legal and Computer technology.
Strong written and spoken English in addition to the local language.

The registry compliance team’s daily work may mostly include the following,
1.Randomly sample domain for domain’s whois validation 
2.Review the result on public whois reporting system and contact the registrar(s) for further supporting information wherever necessary.
3.Receive the public abuse report and handle it in accordance with applicable polices and procedures. Keep in contact with the registrar(s) for solution and support when needed.
4.Liaison with ICANN for the compliance issues
5.Coordination with the outsource service providers towards the RPM mechanisms namely Trademark Clearing House, URS, PDDRP, and UDRP, and legal affairs.

Please further refer to the detailed resource plan in question 31 for the human resource policy.

The registry shall implement and adhere to any Rights Protection Mechanisms (RPMs) that may be mandated by ICANN from time to time. Additional RPMs as further described below may also be developed and implemented by the Registry to discourage and prevent abusive domain name registrations. All RPMs mandated by ICANN and independently developed by the Registry will be included in the Registry registry-registrar agreement.

Definition
Rights Protection Mechanisms are processes or mechanisms adopted and implemented by registry for the purpose of protecting legal rights by discouraging or preventing registration of domain names that violate or abuse a participant’s legal rights.

The mechanisms include:
Source: the file-PROTECTING THE RIGHTS OF OTHERS WORKING GROUP (PRO WG) FINAL REPORT from ICANN
1. Trademark Clearinghouse 
Trademark Clearinghouse is a single database of authenticated registered trademarks. It will be operated by a third party under license or agreement with ICANN. Thus trademark holders do not need to register their trademarks in many databases as the domain name is launched.

The registry use the Trademark Clearinghouse to support the prelaunch or initial launch period rights protection mechanisms which includes a Trademark Claims service and a Sunrise Process. 

The registry agrees to adhere to the Clause 6 ‘Mandatory Rights Protection Mechanisms’ and Clause 7 ‘Protection for Marks in Clearinghouse’ of the Trademark Clearinghouse attachment to the DAG. 
Source: the file-Applicant Guidebook P301-306⁄ the file- Information for Rights holders from ICANN

(1) Trademark Claims service
The registry will provide Trademark Claims services for marks in the Trademark Clearinghouse during the first 60 days that registration is open for general registration. The intention of the service is to provide clear notice to the prospective registrant of the scope of the mark holder’s rights.
 
The Trademark Claims Notice provides the prospective registrant access (the links or other sources) to the Trademark Clearinghouse Database information referenced in the Trademark Claims Notice to enhance understanding of the Trademark rights being claimed by the trademark holder. The notice should warrant that: 
(i) the notification should be provided in English;
(ii) the prospective registrant has received notification that the mark(s) is included in the Clearinghouse;
(iii) the prospective registrant has received and understood the notice; 
(IV) to the best of the prospective registrant’s knowledge, the registration and use of the requested domain name will not infringe on the rights that are the subject of the notice.
Source: the file-Applicant Guidebook P301-306 from ICANN

(2) Sunrise Process
This is a process that the owners of legal rights have the opportunity to register domain names before the landrush process opens to the public. 

During sunrise process, Sunrise Eligibility Requirements (SERs) and a Sunrise Dispute Resolution Policy (SDRP) will guide our sunrise service.

A. Sunrise Eligibility Requirements (SERs)
They include:
(i) ownership of a mark which should meets follows requirements:
(a) nationally or regionally registered and for which proof of use – which can be a declaration and a single specimen of current use – was submitted to, and validated by, the Trademark Clearinghouse; 
or (b) that have been court-validated; 
or (c) that are specifically protected by a statute or treaty currently in effect and that was in effect on or before the date when the registry initiates the sunrise process.
(ii) international class of goods or services covered by registration; 
(iii) representation that all provided information is true and correct; 
(iv) provision of data sufficient to document rights in the trademark.

B. Challenge Mechanism 
(i)Sunrise Registration Challenge Policy administered by TCH or Hong Kong International Arbitration Center (HKIAC)
(ii)During the domain auction, an invited bidder who disputed the entitlement of a competing bidder must notify the Registry and initiate a dispute prior to the commencement of the auction. 

2. Professional anti-abuse department
The registry will maintain a professional anti-abuse department to protect people’s legal rights against abusive registrations and other activities that affect the legal rights of others. All reports of abuse should be sent to our abuse department at
Email: abuse@registry.life.
Mailing Address: 35.com building, No.8 Guanri Road, XiaMen, China.

3. Uniform Rapid Suspension System (URS) 
Registry will cooperate with ICANN for the implementation of URS, shall the policies and procedures are finalized. The involvement of the registry for the scope of URS shall include the followings:
3.1. Upon completion of the Administrative Review, the URS Provider will immediately notify the registry (via email) (“Notice of Compliant”) after the Compliant has deemed compliant with the filing requirements. Within 24 hours of receipt of the Notice of Complaint from the URS Provider, the registry shall “lock” the domain name, meaning the registry shall restrict all changes to the registration data, including transfer and deletion of the domain names, but the name will continue to resolve. The registry will notify the URS provider immediately upon locking the domain name (“Notice of Lock”).

3.2. If after the Examination in Default case, the Examiner rules in favor of the Registrant, the URS provider shall notify the registry. Upon receiving the official notice from the URS provider, the registry will unblock the name and return full control of the domain name registration to the Registrant.

3.3 If the Determination is in favor of the Complainant, upon receiving the official decision from the URS provider, the registry will suspend the domain name, which shall remain suspended for the balance of the registration period and would not resolve to the original web site. The nameservers shall be re-directed to an informational web page provided by the USR Provider. 

The Registry will incorporate URS into the Registration policies, as a takedown measures and procedures to minimize abusive registration. 

4. Uniform Domain Name Dispute Resolution Policy (UDRP)
The registry provides the Uniform Domain Name Dispute Resolution Policy (UDRP) for the solution of disputes over the abusive registration. Under the policy, most types of trademark-based domain-name disputes must be resolved by agreement, court action, or arbitration before a registrar will cancel, suspend, or transfer a domain name. 

The disputes concerning an alleged abusive registration of a domain name only apply to the following criteria: 
(1) the domain name registered by the domain name registrant is identical or confusingly similar to a trademark or service mark in which the complainant (the person or entity bringing the complaint) has rights; and 
(2) the domain name registrant has no rights or legitimate interests in respect of the domain name in question; and 
(3) the domain name has been registered and is being used in bad faith
The disputes alleged to arise from abusive registrations of domain names (for example, cybersquatting) will initiate, when the hold of trademark rights either 
(1) files a complaint in a court of proper jurisdiction against the domain-name holder (or where appropriate an in-rem action concerning the domain name) 
or (2) in cases of abusive registration submits a complaint to an approved dispute-resolution service provider such as WIPO and others.

Source: the file-What types of disputes are covered by the UDRP Administrative Procedure? from World Intellectual Property Organization (WIPO)

5. Thick, Reliable WHOIS
...Life registry provide thick and reliable WHOIS to improve the accuracy and completeness of whois data and do rapid data search and resolution to malicious conduct activities, as they are identified. A standard thick whois includes a broader set of data elements including contact information for the registrant and designated administrative and technical contacts. Here is an example of ʺthickʺ Whois output: 

Domain: example.life
Registrar Name: Registry Registrar
Registrant Contact:
Name: 35.com. 
Address: 35.com building 
No 8 guanri road
City: Xiamen 
State⁄Province: Fujian 
Country: CN
Postal Code: 361008
Phone: 0086-0592-539-0000
Fax: 0086-0592-539-0000
Email: support@registry.life
Administrative Contact:
Name: 35.com. 
Address: 35.com building 
No 8 guanri road
City: Xiamen 
State⁄Province: Fujian 
Country: CN
Postal Code: 361008
Phone: 0086-0592-539-0000
Fax: 0086-0592-539-0000
Email: support@registry.life
Technical Contact:
Name: 35.com. 
Address: 35.com building 
No 8 guanri road
City: Xiamen 
State⁄Province: Fujian 
Country: CN
Postal Code: 361008
Phone: 0086-0592-539-0000
Fax: 0086-0592-539-0000
Email: support@registry.life
Billing Contact:
Name: 35.com. 
Address: 35.com building 
No 8 guanri road
City: Xiamen 
State⁄Province: Fujian 
Country: CN
Postal Code: 361008
Phone: 0086-0592-539-0000
Fax: 0086-0592-539-0000
Email: support@registry.life
Original Creation Date: 25⁄10⁄2012
Expiration Date: 25⁄10⁄2013
Nameserver Information:
Nameserver: ns1.registry.life
Nameserver: ns2.registry.life

6. Registry Restriction Dispute Resolution Procedure (RRDRP)
.life is a generic use TLD and there is no intention to set out any registration restriction in the Registry Registrar Agreement. At such, it is unclear if the RRDRP would apply with to the Registry. 

7. Transfer Dispute Resolution Policy (TDRP)
The Transfer Dispute Resolution Policy (TDRP) applies to transactions in which a domain-name holder transfers or attempts to transfer a domain name to a new registrar. The TDRP concerns registrar disputes under the Inter-Registrar Transfer Policy.

The Registry will support the TDRP, and the proceedings may be filed with an independent dispute resolution provider approved by ICANN.

8. Accredited Registrars. 
Only the accredited registrars by the registry are allowed to resell .life domain names directly or through their reseller networks around the world. 

9. Additional Measures Specific to Rights Protection
Sunrise Program for Registrant Pre-Verification
Registry intends to adopt a Sunrise Program that has the following details:
RPMs 
Sunrise with three phases:
Phase 1: Sunrise for Governments
Phase 2: Sunrise for registered trade marks
Phase 3: Sunrise for company names

Schedule ⁄ Length of Sunrise 
Phase 1: one month
Phase 2: one month
Phase 3: one month
Landrush: 2 weeks
General Availability

Term of Registration
Sunrise: Two years minimum
Open registration: One year minimum, ten year maximum

Submission Process
Via the Registry accredited registrars.
All applications under each Sunrise phase deemed to have arrived at the same time. Electronic auctions held between eligible competing applicants for the same term. 
English auction format selected with highest bidder winning. 
The auction will be carried out by outsourcing provider.

Key terms and conditions
Comply with terms in Trademark Clearing House

Character strings
Comply with terms in Trademark Clearing House

Authentication
All application validated by third party Verification Agent, namely Trademark Clearinghouse appointed by ICANN.

Amendments & Reconsiderations 
Verification Agent could request an Amendment Clarification from applicant to correct a typographical mistake. No additional fee charged.
Applicant could apply for Reconsideration within seven days of a rejection on the basis of original application or with the provision of further information.

Supporting information 
Proof of eligibility such as certified copy of trade mark certificate could be requested by Verification Agent. Certified translations of such document into English could also be requested.

Challenge Mechanism 
Sunrise Registration Challenge Policy administered by TCH or Hong Kong International Arbitration Center (HKIAC)
During the domain auction, an invited bidder who disputed the entitlement of a competing bidder must notify the Registry and initiate a dispute prior to the commencement of the auction. 

Dispute 
All registrants agree to be bound by the UDRP. 

Dispute provider
Hong Kong International Arbitration Centre (HKIAC)

Auction 
Selecting auctions between competing applicants rather than First Come First Served.
Pre-validation offer by Validation agent. Pre-validation applications were to assign a code with which permitted instant approval following submission to the registry. 

Sunrise Challenge Policy
The Sunrise Challenge Policy shall be applied only during the sunrise period for the .life TLD. The challenges under the Sunrise Challenge Policy shall be administered by the Hong Kong International Arbitration Centre (the “Centre”).
A third-party (the “Challenger”) is required to submit to a mandatory administrative proceeding to seek cancellation, transfer or other changes to a domain name registration, in compliance with the rules that:

Phase 1: Sunrise for Governments
The corresponding government body objects to the right the applicant claims or fails to acknowledge the application.

Phase 2: Sunrise for registered trade marks
(1)The applicant is not the owner, co-owner or assignee of the corresponding registered mark.
(2)The registered mark was not registered in full force and effect at the time of application of the domain name.
(3)The applied-for domain name is not a exact match or acceptable match to the textual or word elements of the registered mark which the application of the domain name is based on.
(4)The registered mark was not registered with a trademark office or trademark registry that corresponds to one of the states or other entities set out in the WIPO Standard ST.3 code.

Phase 3: Sunrise for company names
(1)The applied-for domain name does not correspond with the name of the registered entity.
(2)The applied-for domain name is not an exact match or acceptable match to the textual or word elements of the name of the registered entity which the application of the domain name is based on.

All challenges under this Policy must be submitted to the Centre no later than 120 days after the conclusion of the proposed Sunrise Period. The first challenge to be filed will be granted priority by the Centre if there are multiple challenges for the same domain name. The Centre’s challenge is of an administrative nature and shall be final. The Centre shall not be required to state reasons for its decision. The fees for the submission of a challenge and its response shall be decided by the Centre prior to the start of the Sunrise Period. 

The Registry shall not participate in the administration or conduct of any proceeding before the Centre under this Policy. The Registry shall also not be liable as a result of any decisions rendered by the Centre.
The Centre shall notify the challenger and .the Registry of all its decision made under this Policy. If the Centre rules in favor of the challenger and the domain name is to be transferred to the new registrant, the Centre shall provide an authorization code provided by the Registry to transfer the domain name to its preferred registrar and update all the WHOIS information within 30 days that the authorization code is provided.

Abusive Use Policy

The registry will incorporate Anti-Abuse policy into the Registry Registrar Agreement(RRA). The registry does not tolerate any abusive use of .life domain names which causes security and stability issues for the the registry, its registrars and the general internet community. The registry defines abusive use of a domain name as the wrong or excessive use of power, position or ability, and includes, without limitation, the following,
Illegal or fraudulent actions;

Spam: The use of electronic messaging systems to send unsolicited bulk messages. The term applies to e-mail spam and similar abuses such as instant messaging spam, mobile messaging spam, and the spamming of Web sites and Internet forums. An example, for purposes of illustration, would be the use of email in denial-of-service attacks;

Phishing: The use of counterfeit Web pages that are designed to trick recipients into divulging sensitive data such as usernames, passwords, or financial data;

Pharming: The redirecting of unknowing users to fraudulent sites or services, typically through DNS hijacking or poisoning;

Willful distribution of malware: The dissemination of software designed to infiltrate or damage a computer system without the ownerʹs informed consent. Examples include, without limitation, computer viruses, worms, keyloggers, and trojan horses;

Fast flux hosting: Use of fast-flux techniques to disguise the location of Web sites or other Internet services, or to avoid detection and mitigation efforts, or to host illegal activities. Fast-flux techniques use DNS to frequently change the location on the Internet to which the domain name of an Internet host or name server resolves.

Botnet command and control: Services run on a domain name that is used to control a collection of compromised computers or ʺzombies,ʺ or to direct denial-of-service attacks (DDoS attacks);

Distribution of child pornography; and

Illegal Access to Other Computers or Networks: Illegally accessing computers, accounts, or networks belonging to another party, or attempting to penetrate security measures of another individualʹs system (often known as ʺhackingʺ). Also, any activity that might be used as a precursor to an attempted system penetration (e.g., port scan, stealth scan, or other information gathering activity).

Please acknowledge that, according to relevant provisions in RRA, .Life registry reserves the right to deny, cancel or transfer any registration or transaction, or place any domain name(s) on registry lock, hold or similar status, that it deems necessary, in its discretion; (1) to protect the integrity and stability of the registry; (2) to comply with any applicable laws, government rules or requirements, requests of law enforcement, or any dispute resolution process; (3) to avoid any liability, civil or criminal, on the part of .Life registry, as well as its affiliates, subsidiaries, officers, directors, and employees; (4) per the terms of the registration agreement or (5) to correct mistakes made by .Life registry or any Registrar in connection with a domain name registration. 

Implementation Plan

To enhance the security, integrity and quality of .life domain name, we implement rights protection mechanisms against abusive registrations and activities.
1. A professional anti-abuse department is set up for minimizing abuse registration and other activities that affect the legal rights of others. 
2. During the sunrise period of .life domain names, trademark clearinghouse including trademark claims service and sunrise process will be implemented to protect the rights of trademark holders and other rights holders from infringing intellectual property rights and abusive registrations.
3. Abusive registrations and uses of .life domain names should be prohibited. 
4. The registry will adhere to any Rights Protection Mechanisms (RPMs) that may be mandated by ICANN from time to time

During the implementation phase, the software engineer shall configure the reserve words based on input by the compliance manager and ICANN default reserve list. The Software engineer shall perform the configuration of the sunrise, landrush and general availability phases into the SRS between sunrise cooling periods. 

Upon the completion of the implementation phase, the Test Engineer will perform rigorous testing procedures to ensure that the system performs according to specifications. Once the test phase is completed, the configuration shall be hand-over to System Administrator to be deployed to the production environment. A Project Manager is assigned to perform project management and overall control during the implementation phase. The Project Manager will conduct training for the registry users on the sunrise, landrush and general availability handling in the system. The setup shall be completed in stages according to the sunrise process. The configuration in each stage shall be completed in 2 weeks.

The compliance manager shall perform policy review and refinement from time to time so that the rights protection policy can cover as much cases as possible. The software engineer is tasked to maintain the reserve list according to instructions given by the compliance manager.

Resourcing Plan
Xiamen 35.com Technology Co. Ltd will commit the following resources to maintain the Right Protection Mechanisms for the registry as follows:
Job description and requirements:

Position⁄Number 
The Compliance Manager ⁄ 1
Responsibilities:
Coordination with the outsource service providers towards the RPM mechanisms namely Trademark Clearing House, URS, PDDRP, and UDRP, and legal affairs.
Responsible for various compliance matters of .Life registry
Works independently within established policies, guidelines and strategies; develop relevant policies and procedures as necessary. 
Advanced professional knowledge and expertise.
Demonstrates seasoned and proven judgment.
Compliance Training & Compliance Manual.
Internal reports and inquiries: prepare compliance internal reports.
Supervision: supervise compliance rep and delegate some of the responsibilities as appropriate.
Other compliance matters that may be assigned.

Requirements:
5 years industry experience required.
Extensive knowledge and understanding of the internet and network.
Previous compliance experience is required.
Computer literate.
Strong interpersonal skills and a team player.
Strong written and spoken English in addition to the local language.
Bachelor⁄University degree.

The compliance staff ⁄ 1
Job Responsibilities:
Receive incoming reports and abuse complaints.
Carry out handling procedure.
Review the issues.
Regular Report to the manager.

Requirements:
Solid understanding of internet terminology.
Knowledge of basic office skills (Word, Outlook, Excel, general database).
Exceptional written & verbal communication.
Ability to learn and effectively utilize customer support tools⁄resources.
Six months customer service experience.
Preferred educational background in legal and Computer technology.
Strong written and spoken English in addition to the local language

The registry compliance team’s daily work may mostly include the following,
1.Randomly sample domain for domain’s whois validation 
2.Review the result on public whois reporting system and contact the registrar(s) for further supporting information wherever necessary.
3.Receive the public abuse report and handle it in accordance with registry polices and procedures. Keep in contact with the registrar(s) for solution and support when needed.
4.Liaison with ICANN for the compliance issues
5.Coordination with the outsource service providers towards the RPM mechanisms namely Trademark Clearing House, URS, PDDRP, and UDRP, and legal affairs.

Please further refer to the detailed resource plan in question 31 for the human resource policy.

Summary of Security Policies
The policies established provides a comprehensive approach as highlight below, to identify and prevent unauthorized access, intrusion, loss of information and software error. 
1. Physical Security
Physical security is provided by data center. Only authorized personnel are allowed to enter the premises of the data center. Below are standard policies set:
a) Data Center Access Policy
b) Equipment Policy
c) Site Visits Policy
2. Network Security
This layer protects all equipment in the network from hacker or malicious attack. Another layer of sniffer (IPS) is put in place as second layer of screening. Security alarm will be triggered if there are abnormal activities in the network. Standard policies applied:
a) Firewall Policy
b) Denial of Services Policy
c) System Monitoring Policy
3. Host Security
At the server level, governance policy is required to establish control over access to the servers and movement of servers. Below are the standard policies to achieve control over these parameters:
a) Server Access Policy
4. Application Security
Security is built within the applications running on the servers. The applications are built using the well known OWASP security policy 
5. General
Other that the above policies, general policies below applied across the network, server, application and data center to ensure system and registrants are well protected:
a) Password Policy
b) Data Integrity Policy
c) System audit Policy
d) Security Patch Policy
e) Security Response Policy
f) Acceptable Use Policy
g) Registrar Agreement