For those following this story, it’s been a pretty confusing and unsettling ordeal. And we’re certainly sorry for the part we played and adding to the confusion. But this was a play with many players, so let us set out below what happened and why. The major players in this drama were: Gandi.net (us), Moxie (the customer) and Comodo (the SSL technology provider). I could add the the Easter weekend, but I won't. And everyone played a part in this going wrong and shares some of the responsibility. We’ll set out why below.

We did it: at 3:59:53 PM (CET) Gandi officially hit 1,000,000 domain names.

Seeing as this is an issue that is now affecting some of our customers, we thought we’d write a quick post to let you know what is going on. As those of you who know Gandi.net will know, our entire history has been about being fair to our customers and taking a stand against the shady practices of the domain name industry, and the internet industry in general. This of course includes anti-spam policies, and indeed we support SpamHaus which is an anti-spam organisation (http://www.gandi.net/supports/)

So it is with surprise and regret that we must tell you that we have been blacklisted by SORBS (http://en.wikipedia.org/wiki/Spam_and_Open_Relay_Blocking_System) for “harbouring spammers”, a charge which I’m sure you can agree is unlikely.

This situation has arisen because of our customer protection processes that are core to our beliefs. Where a customer of ours is a spammer, then we will of course take action. We don’t protect spammers.

But we cannot take action against a customer until we are provided with proof that they actually are a spammer. The requirement of proof is something that we keep strict. There are many situations where complaints by one party against another without proof have led to action by domain companies which is hasty (http://news.cnet.com/2100-1025_3-6153607.html, and an article written about this and registrar complaint procedures following the action http://news.cnet.com/Survey-Are-domain-registrars-free-speech-friendly---page-2/2100-1025_3-6155614-2.html?tag=mncol)

So when you want to make a complaint about a domain or a customer of ours, please do (abuse at gandi.net), but you will require proof. And by proof we mean original and complete documentation showing the offense. In the case of spam, this must be full and complete email headers, and not extracts or a sample, or a cut and paste of something. The original headers please.

Similarly, we cannot take action based solely on circumstantial evidence that a given domain or individual may or may not be simply associated in some form with another person or entity, nor on the basis of simply subjective opinion.

Once we have this proof, we kick off our procedures. Immediately.

Anyway, back to SORBS. So back in December we were blacklisted by SORBS without notice. The SORBS process seems to be that you are blacklisted first, then you can have a conversation, and finally you can pay to be removed from their blacklist (see ‘criticism’ section http://en.wikipedia.org/wiki/Spam_and_Open_Relay_Blocking_System).

We had two objectives at this stage;

1. 1. Understand why we were blacklisted and take appropriate action
2. 2. Get off the blacklist

For part 1, we required proof that an offense had taken place by our customer. SORBS initially did not provide complete and original proof of the spamming domains and the spam email. They wanted us to take action based on their assertion. It took many requests and replies before we were finally able to get the original documentation that they had in their possession all along.

Once we had this documentation, we have kicked off our RIP process to contact the customer and begin proceedings. The issue is still not clear cut, as no spam originated from Gandi, or the domains we host, but 2 domains we host were mentioned in the spam. We will investigate and let you know. So that’s part 1 done.

But for Part 2, we are still blacklisted. It seems the only way to be removed from the blacklist is to make a donation to a legal defence fund for a case won in 2002. We will not pay to be white-listed, this is just not the way we work. We will continue to follow this up with SORBS, but we cannot be sure of the outcome. Why they couldn’t speak first, punish later is still unclear. But paying to be removed is just not Gandi.

We regret that this has led to us being blacklisted, but we make no apology as we would do it all again. We will protect our customers rights until we have proof they have offended. Innocent until proven guilty. Is this so strange?

Apologies for any inconvenience this may cause any of you, but we thought we should explain.

• we have spent a considerable amount of time improving the speed at which your domains are displayed (https://www.gandi.net/admin/domaine) on the page. Following this release your domains will be displayed twice as fast as they were with the initial version 3.0.0 and we are working to make this even faster. The speed improvement is most noticeable for those that display their domains in pages of 100.
• a new location of the information bubble: they are now under the links.
• added a link so that you can access your server's configuration directly from your list of servers
• increased the maximum disk limit per server from 2TB to 4TB (eight 500GB disks)
• the activation of Ubuntu 9.10 (Karmic Koala)
• activated the SSL certificate renewal process
• moved our wiki to match the V3 look and feel, and have started to update its content.

Ok, so it's not the right Episode number, but this version of Gandi represents a major turning point for all of us at Gandi that we have been looking forward to for a long time now: rewriting a number of processes that have not been totally satisfactory for you.

The first visible change is the new version of the website. This update will highlight (some will say shout) our values, and will bring to you improved ergonomics (who was it that asked for faster domain searches and the ability to attach tags to domains?).

• .COM, .NET, .ORG, .INFO, .BIZ, .NAME, and .US domains at €5.50 ($7.50 or £5.00) excl. VAT, with a year added to the expiration date,
• .FR, .RE, .BE, and .EU at 5.50€ ($7.50 or £5.00) excl. VAT with the year added to the transfer date (e.g. the new expiry date is set to be 1 year from the transfer date)
• .CH and .LI domain transfers are free (this is already the case, but not many people may know it

It is true that the summer vacation - lounging about, and getting a nice tan - is on its way, though we have chosen to do the opposite! By staying in doors and slapping on the sun cream we will be making our website lighter and brighter!

3 years after the big makeover (Gandi V1 to Gandi V2), we felt that it was time to brighten up our website. So that's what we did!

This version is not yet Gandi V3, it is more of a transitional stage, which has incorporated only subtle changes here and there - lightening up the graphics and making everything easier to read. Let’s call it Gandi V2.5!

As always, we welcome your comments, criticisms, reactions, large random shipments of candy…

Registry, Registrar, Registrant, (Registratum, Registrata, Registrunt). Ok, so the last 3 are made up words, and the domain name industry wasn't really founded in ancient Rome nor part of your everyday Latin dialect, but what do the first three words actually mean and how does the domain name industry work? We've been working in the industry for years, so we have a pretty good idea. But we can also understand why all this really can just sound like ancient Greek to many people and not mean a thing. So in the spirit of lifting the lid and keeping things honest (as Gandi likes to do), we thought we'd give you a quick overview of what it all means.

A pulling back of the domain business curtain to reveal a few shady practices undertaken by unnamed sources…

1) Transfer Out Fee. It is essential to read the small print when signing up to a domain registrar. There are all kinds of pitfalls waiting for those who couldn’t be bothered to go through the terms and conditions with sufficient care and attention. For instance, hidden deep in there might be an agreement for a charge to be made to your account as a ‘transfer out’ fee if you want to switch your domain to a different registrar. What’s worse is this fee might be several times the price of your original registration.[|/post/2008/12/04/Dodgy-domain-practices-the-story-contines#comments|en]