Monitoring and Compliance Plan

.nz Regulatory and Compliance Approach 

In August 2025, the .nz Regulatory and Compliance Approach and foundational strategy was approved by the Domain Name Commission (DNC) Board to guide the delivery of the DNC’s regulatory functions. 

Our aim in publishing our approach is to ensure that our regulatory activities are operated and enforced in a fair and transparent manner. Under our new approach, we commit to publishing our annual Monitoring and Compliance Plan in April each year and to publishing a report on our findings and the outcomes of those monitoring activities. While to date, we have largely operated reactively based on reports and complaints received from the public, other regulators and law enforcement agencies, domain name holders, and registrars, we are now carrying out more proactive oversight to ensure the security and stability of the .nz domain name space and to maintain the integrity of the .nz register.

This Monitoring and Compliance Plan sets out our regulatory priorities for the period 1 April 2026 to 31 March 2027 in support of these outcomes and as the first step to implementing the new InternetNZ Group long-term Strategy.  

InternetNZ Group Strategy and DNC’s focus areas

The new InternetNZ Group Strategy will be published on both InternetNZ and DNC websites from April 2026. DNC’s focus areas for its monitoring and compliance activities to implement the new strategy in year one include:

Disrupting scam activity and malicious use of .nz domain names

Relevant outcomes 

Ensuring the .nz domain name space is trusted.

We will focus on continuing to disrupt scam activity and malicious use of .nz domain names by domain name holders by reviewing and improving how we use our registration check tool to obtain samples of .nz domain names for auditing.

While we currently see very low rates of abuse and malicious activity in the .nz domain name space, we will also continue to develop our partnerships with other regulators and agencies to enable faster information sharing where that is possible and, continue to tackle emerging scams and illegal activity to ensure .nz is trusted and harm to the public is minimised. 

Why this is our focus 

• Scams are increasingly affecting New Zealand consumers, and growing in complexity and volume globally. This underscores the importance of strong partnerships across government and private sector to disrupt scams and the malicious use of domain names for fraudulent activities, including phishing and malware.  

• Reduces the risk that scam activity and malicious registrations undermine trust in the .nz domain name space. 

 

Ensuring domain name holder registration information is accurate, complete and up to date

Relevant outcomes 

Quality .nz domain name registrations and the integrity of the .nz register is maintained.

We will continue to proactively undertake data validation and identity verification audits based on a sample of .nz domain names identified via our registration check tool. This is to ensure domain name holders meet the eligibility criteria in the .nz Rules, and that their contact information is accurate, correct, and domain name holders are contactable. 

We will undertake sample testing of registrar portfolios to ensure .nz domain names are being registered to identifiable individuals or lawfully constituted entities in accordance with the .nz Rules.  

Why this is our focus

• We have identified a correlation between false, incorrect, or fraudulent domain name holder details used in the .nz register and suspected malicious domain name registrations which fail audits.

• We have become aware of domain name registrations that appear to be in breach of the .nz Rules. For example, we have observed the domain name holder names being registered as ‘admin’ or ‘privacy’ or using only a first name or under an alleged trading name for an organisation, which means the domain name holder is not identifiable, and the integrity of the .nz register is compromised.  

 

Ensuring .nz domain names are not registered in the name of registrars or resellers when they were requested by and are being managed for their customers (i.e the domain name holder)

Relevant outcomes 

Protecting the rights of domain names holders

We will undertake sample testing of registrar portfolios to ensure that if any .nz domain names are registered to a registrar or reseller they are only for the registrar or resellers' own business use and are not domain names that are being managed on behalf of a domain name holder.  

Why this is our focus

• We have seen an increase in complaints from domain name holders who are either unable to contact their reseller or unable to transfer their domain name to another registrar or reseller, as the domain name has not been registered with the domain name holders’ name or contact details, in breach of the .nz Rules.

 

Ensuring the privacy option is only applied when domain name holders meet the eligibility criteria 

Relevant outcomes 

Ensuring compliance with the .nz Rules 

We will undertake sample testing of registrar portfolios to ensure domain name holders do not have the privacy option applied when they do not meet the eligibility criteria.  

Why this is our focus

• We have received complaints from the public that the privacy option has been applied where domain name holders clearly don’t meet the eligibility criteria (for example, when the domain name holder is a limited liability company).  

• Some registrar processes rely on domain name holders to self-certify they meet the eligibility criteria and registrars may not be carrying out any independent checks to verify this.

• We have observed examples of suspicious registrations having the privacy option applied correlating with failed audits.

 

Thematic survey of registrar systems and security processes

Relevant outcomes 

Understanding the risk to the security and stability of the .nz domain name space

We will develop a questionnaire to survey registrars about their DNS redundancy, business continuity, security capabilities and resourcing plans to obtain a better understanding of the risk to the security and stability of the .nz domain name space.

Why this is our focus

• Over the last two years, several registrars have experienced outages. In some cases, part of the issue was caused by a lack of redundancy. In other cases, there was no, or an inadequate, business continuity plan in place and insufficient resources to support domain name holders who were impacted.  

• We want to better understand the risks across registrars and to support the uplift of good practices to ensure good outcomes for domain name holders and users of the .nz domain name space.