A very brief and very simplified view of how the Agent works
- It is trained on domain-specific knowledge and regulation.
- Internal data is stored locally and processed securely
- External queries are encrypted
- Comparisons are done internally
- No sensitive data leaves the system
- All actions are logged transparently
This complies with GDPR, ISO 27001, and follows the principle of Privacy by Design.
Third-Party Data
In today’s digital landscape, data is powerful — but using it comes with legal and ethical challenges. As WhoseDomain (Sebastián et al., 2023) shows, combining many small signals from different sources can significantly improve the registration data of domains while also mentioning the legal risk. This plug-in would allow users to configure which third-party data sources are used. This matters because different sources impact both accuracy and legal compliance.
Examples of third-party data that could be used include:
- WHOIS / RDAP – Reveal domain registration data
- Public Business Registers –These registries help track legal ownership and status updates.
- Credit Assessment Providers –These are commercial providers of structured business identity data.
- SSL Certificates & Transparency Logs – Certificates can confirm a company’s identity and link domains together.
- Website Content & security.txt – Pages like About, Privacy Policy, and /security.txt can reveal ownership.
- DNS Records – Technical clues like name servers, MX records, and IPs help detect common ownership.Commercial Non-Public Services – These are paid services that collect and combine data from many sources — including historical domain records
Legal
In domain name management, legal compliance revolves around several key areas. Transparency (under NIS2) is crucial for security and incident reporting, while privacy (under GDPR) prioritizes protecting ownership details and limiting public exposure of registrant data. It’s essential to clearly state data sources for transparency and avoid combining data to identify individuals without their consent, as this could constitute profiling under GDPR.
Information security (per ISO 27001) is paramount for safeguarding all relevant data, including ownership details, and unauthorized access must be prevented. Finally, trustworthy AI (as mandated by the AI Act) requires AI systems to be transparent, robust, and rights-respecting. It also means refraining from unauthorized data collection from websites, which can violate rules and data protection laws.
Legal Design of the DNS Agent
The DNS agent was designed with legal compliance at its core, ensuring data protection and transparency. Key features include:
- Secure Access and Purpose Limitation: Users must log in securely and state their purpose when searching for domain data. The agent specifically focuses on organizational domain data, excluding information related to individuals.
- Data Minimization and Encryption: Communication with third-party data sources is encrypted, and data is filtered to remove potential Personally Identifiable Information (PII). Crucially, no personal data is retained after queries, strictly adhering to data minimization principles.
- Transparency of Information: Every search result clearly states its information source, promoting transparency and accountability.
- Accountability and Logging: All actions performed within the system are logged, making them easy to audit and follow up on.