ATTACHMENT J.2 usTLD Questions and Answers.pdf

CUI//PROCURE//FEDCON#

1331L526R13350002 .usTLD US Top Level Domain (usTLD) Registry Management Services

Questions & Answers

Number Question Answer 1 F.3 Place of performance: In the draft solicitation, page 12 F.3 Place of Performance states

"The requirements of this contract shall be performed in the United States." . In addition, 5.0 Description of Services within Requirements document states "5.3 The contractor... must be able to demonstrate that all primary registry services will remain within one of the fifty (50) U.S. states, the District of Columbia, or any of the United States possessions or territories.“ Could you define "primary registry services" and the exact services that must be delivered from within the US. For example, does this include the registry database?

The language in section 5.3 has been revised from "primary registry services" to "core registry services." These services include the usTLD registry database, registrant and registration data-related services, authoritative DNS services, DNSSEC operations, data escrow services, primary network and security operations centers, and primary data centers that support the foregoing. See sections 6.3 and 6.23.

2 F3: Place of Performance: In the draft solicitation, page 12 F.3 Place of Performance states "The requirements of this contract shall be performed in the United States.". Could you define which, if any, staff are expected to be based within the US? For example, can any services be provided by existing teams outside of the US? Do all technical staff need to be based in the US?

Staff supporting the management, infrastructure and operations for the usTLD core registry services must be located within the United States. Staff details (e.g. workplace location, composition, qualifications) are requested within the management plan required per section 12.3.8.

3 5.0 Description of Services: Within 5.0 Description of Services, the Requirements document states "5.3 The Contractor shall possess and maintain through the performance of this procurement a physical address within the United States “. Could you confirm whether a physical address needs to exist at the time of bid submission, or by the time of contract award?

The physical address must exist at the time of bid submission.

4 F.3 Place of performance: In the draft solicitation, page 12 F.3 PLACE OF PERFORMANCE states “The requirements of this contract shall be performed in the United States ” and 5.0 Description of Services within Requirements document states “The contractor….must be able to demonstrate that all primary registry services will remain within one of the fifty (50) U.S.

states, the District of Columbia, or any of the United States possessions or territories ”. Could you confirm whether F.3 Place of Performance will be satisfied if 5.0 Description of Services is met?

The "United States" refers to any of the fifty (50) U.S. states, the District of Columbia, or any of the United States possessions or territories.

5 B3 Schedule: In the draft solicitation, we note that B3 Schedule states “This contract consists of a transition period (up to nine (9) months), a base period of 36 months, and four (4) one year ordering periods for a total ordering period of 7 years as depicted in Table 1.” but that t Base Period is shown as 27 months in table 1 with a separate 9-month transition period. In CAR 1352.270‐70 PERIOD OF PERFORMANCE (APR 2010) the Base term is then described as a base period of performance of three years – please can you confirm whether the 9-month transition period is in addition to the base period or inclusive?

This is not a FAR/CAR based requirement. The base period is 36 months, which is inclusive of a 9-month transition period.

6 B1 General: Paragraph B1 (General) of the draft Solicitation notes that select FAR and CAR clauses would be incorporated and that, to the extent FAR or agency specific clauses are incorporated, those clauses are in full force and effect unless subsequently modified by mutual agreement of the parties. Please can you confirm that modifications may be identified and/or proposed by Offerors in their proposal submission and/or that these would be discussed ahead of Phase 2 submissions or during the Negotiations envisaged with the Best Suited Offeror (or next best suited Offeror)?

Such discussions would take place during the negotiation phase.

7 Section J only lists two attachments: “1. Requirements Document (PWS)” and “2. Questions and Answers Submission Sheet.” Yet Section L.6 tells offerors to use a “Reference POC Template provided as an attachment to this solicitation,” and Section L.7 requires a “Fee Structure Template provided in Section J”.

Could you please provide the Reference POC Template and the Fee Structure Template (and confirm their file names), or confirm the intended formats if templates will not be issued.

The Reference POC Template is now provided as an attachment to the solicitation. The Fee Structure Template will be made available to Offerors that are invited to submit Phase 2 proposals.

8 Section L.5 says: “The cover page shall also identify which track(s) the proposal is submitted for.” No tracks are defined anywhere in the Draft FE.

What are the tracks, and how should we indicate them on our cover page?

There are no tracks associated with this solicitation. The solicitation text has been amended to reflect this.

9 Section B.3 (Table 1) shows: Transition period up to 9 months; Base period 27 months; then four 1 year options.

Section F.2 (CAR 1352.270

70) states: Base period is three (3) years, options one year each.

Please confirm the base period (27 months vs 3 years) and the official period of performance dates

Please refer to the response given for #5 and to the solicitation for the period of performance. Period of performance dates are contingent upon the award schedule. As such, there are no official period of performance dates at this time. The solicitation is modified to reflect the period of performance in months.

10 Section L.7 says draft agreements/policies may be attached as annexes and do not count toward the 33 page limit for Technical Volume II.

Please confirm annexe file types, whether annexes may include graphics, and whether hyperlinks in annexes will be reviewed (L.5 discourages hyperlinks)

Hyperlinks will not be reviewed. Any draft agreements/policies attached as annexes may be considered as references for Technical Volume II but will not be separately evaluated as part of the solicitation. Annex file types are limited to Word and PDF. There is no page limit for annexes.

11 Section M.1 uses confidence ratings; Section M.2: Factors 1 & 2 > Factor 3.

Please confirm if there are any mandatory pass/fail gates.

No, there are no mandatory pass/fail gates during the evaluation of Factors. The government intends to conduct a compliance check prior to the evaluation of proposal submissions.

12 Section 5.3 states that the contractor must be incorporated in the United States. Are we correct in understanding that there is no prohibition on foreign ownership of that contractor?

The Contractor must be an American company with a principle place of business in the United States. Foreign majority ownership of the Contractor is prohibited.

13 All primary registry services need to remain within (the US). Please confirm whether secondary services such as support or backup locations can be provided from elsewhere?

Any non-primary services in the performance of the usTLD administration and registry operation proposed to be provided by non-U.S. providers must be specified in the proposal.

14 Locality spaces: If understood correctly, the Registry Services Provider would need to maintain functionalities for these, including for the admin of these spaces by their managers.

Will the management framework and documentation developed for the locality spaces be made available for review and adoption or is it proprietary to the original contractor?

Locality space information, including delegated manager and registrant information, will be made available to the successful Contractor, post-award.

15 Are subdomain registrations in the locality spaces subject to the same fee structure or do the delegated managers maintain their own fee structure?

Delegated Managers maintain their own fee structures, as authorized by the current Delegated Manager agreement. Post-award, the Contractor may propose adjustments to the Delegated Manager agreement, which would then be reviewed by and discussed with the Contracting Officer per Sections 4.10 and 5.6 of the Requirements Document.

16 Section 4.2 states (as does 6.5 of the requirements) that the contractor cannot be a registrar.

Are we correct in understanding that there is no prohibition on affiliates of the contractor being registrars?

Please refer to Section 4.3 of the updated Requirements Document.

17 Requirements Document §6.13 (Registrar–Registrant Agreement) references registrars supporting implementation of DMARC. As DMARC is implemented via DNS records and mail infrastructure and is not a registry- or EPP-enforceable function, please clarify what activities constitute “support” for registrars under this requirement.

Activties that provide guidance and encouragement for registrars constitute "support" under this requirement.

# CUI//PROCURE//FEDCON

18 Requirements Document §6.13 (Registrar–Registrant Agreement) also references DANE.

Please clarify whether expectations for DANE are limited to guidance and encouragement for registrants, or whether any form of validation or compliance assessment is expected from registrars.

The expectations for DANE are limited to guidance and encouragement for registrants.

19 Requirements Document §6.21 and §6.22 reference storage of nameserver information.

Please clarify whether the requirement to collect nameserver IP addresses is limited to in-bailiwick nameservers requiring glue records, and what operational purpose is served by collecting IP addresses for out-of-bailiwick nameservers.

The contractor is advised to follow RFC 9471, which covers both in-bailiwick and out-of-bailiwick. Delegation glue records would be those provided by the registrant.

20 Requirements Document §6.10 and §6.12 (Registrar Accreditation) require ISO 27001 or an equivalent recognised security framework. Please clarify how equivalence will be assessed, whether formal third-party certification is required, and whether attestation or alternative frameworks may be accepted.

Equivalent frameworks will be assessed by the Contractor in consultation with NTIA. While ISO 27001 is preferred, exceptions may be granted under certain circumstances.

21 Requirements Document §6.12 (Registrar Accreditation) sets out technical and security requirements for registrars. Please clarify whether these requirements are intended to be applied proportionally based on registrar size, scope, or volume, and how proportionality will be evaluated in practice.

The application of technical and security requirements for registrars will be determined by the Contractor in consultation with NTIA.

22 Requirements Document §6.20 and §6.12 reference locality registries and delegated managers. Please clarify whether the technical and security requirements applicable to registrars are also intended to apply to locality registries or delegated managers, and if so, how proportionality will be handled for non-commercial or municipal entities.

The technical and security requirements for delegated managers may differ from those required of usTLD registrars. NTIA and the Contractor will define the scope and application of these requirements and the delegated manager agreement, post award.

23 Requirements Document §6.12 and §6.14 reference registrar eligibility and re-accreditation.

Please clarify what legal arrangements satisfy the requirement for registrars to be incorporated in, or validly registered to do business in, the United States for foreign registrars.

Registrars for the usTLD do not need to be based in the United States, but they must be subject to the U.S.

jurisdiction; the applicable law for usTLD data is U.S. law.

24 Requirements Document §6.12 and §6.14 reference registrar accreditation and enforcement.

Please clarify service-of-process and jurisdictional expectations for non-US registrars, including whether contractual consent to US jurisdiction is implied or required.

Consent to U.S. jurisdiction to offer domains within the .us TLD is required. Please refer to the response given to #23.

25 Section B.2 of the draft solicitation (Cost/Price) and Requirements Document §13.0 (Reporting and Deliverables) contemplate that the Contractor may establish and collect fees from third parties. Please clarify whether pricing changes (including wholesale fees or fees for ancillary services) will be subject to a defined notice period for registrars, and if so, what minimum advance notice is anticipated.

The Contractor will be required to provide reasonable notice prior to changing price. A notice period will be finalized post award. Please see the response to 31.

26 Section B.2 of the draft solicitation (Cost/Price) and Requirements Document §13.0 (Reporting and Deliverables) contemplate fees for specific services. Please clarify which categories of services (e.g. abuse handling, compliance reviews, audits, registration data access, or transfer-related services) are considered chargeable, and whether such fees must be demonstrably cost-based and transparent to registrars.

These details will be provided to Offerors that are invited to submit Phase 2 proposals.

27 Requirements Document §6.17 (Nexus) and §6.17.2 (Nexus Compliance/Enforcement Program) place obligations on registrars to support Nexus compliance and participate in audits. Please clarify the boundary of registrar responsibility, including whether registrars acting in good faith on provided registrant information are protected from adverse accreditation consequences where a registrant is later found to be non-compliant.

A usTLD registrar's obligations regarding nexus compliance will be articulated in the registry/registrar agreement. The agreement will specify the terms and conditions governing nexus compliance and cooperation between parties.

28 Requirements Document §6.18 (DNS Abuse) and §6.19 (Trusted Notifiers) reference the use of Trusted Notifiers. Please clarify whether registrars are expected to take action solely on the basis of Trusted Notifier reports, or whether registrars retain discretion to independently assess and validate reports prior to taking action.

The Contractor will manage third party trusted notifier relationships. Trusted notifier programs will be implemented by the Contractor at the registry level and will outline a clear process, developed in consultation with registrars, for registrar action and registrant notification.

29 Requirements Document §6.14 (Re-accreditation of Existing Registrars) provides for re-accreditation and potential transfer of registrations upon failure. Please clarify whether registrars will have access to a formal appeal or review process prior to forced transfer of registrations, and whether transitional or remedial measures short of transfer may be applied.

Please refer to revised section 6.15.3.

30 The draft solicitation contemplates that the Contractor may establish and collect fees from third parties, subject to Contracting Officer approval. Please clarify whether pricing changes (including wholesale fees or fees for ancillary services) will be subject to a defined notice period for registrars, and if so, what minimum advance notice is anticipated.

Yes, the Contractor will be required to provide notice to usTLD registrars. This notice period will be defined post award, in consultation with the Contractor, and must receive approval from the Contracting Officer.

31 The Requirements Document and draft solicitation contemplate that the Contractor may charge third parties for specific services, subject to approval. Please clarify which categories of services (e.g. abuse handling, compliance reviews, audits, registration data access, or transfer-related services) are considered chargeable, and whether such fees must be demonstrably cost-based and transparent to registrars.

All fees charged in connection with the usTLD must be fair and reasonable, transparent to the registrar, based in the public interest, and in accordance with standards and policies set forth in this PWS. Please refer to Section L.7, subsection Factor 3 – Fee Structure with Cost Narrative.

32 The Requirements Document places obligations on registrars to support Nexus compliance and participate in audits. Please clarify the boundary of registrar responsibility, including whether registrars acting in good faith on provided registrant information are protected from adverse accreditation consequences where a registrant is later found to be non-compliant.

Please consult the revised language in Section 6.17.2 of the Requirements Document.

33 The Requirements Document references the use of Trusted Notifiers for reporting abuse and other egregious conduct. Please clarify whether registrars are expected to take action solely on the basis of Trusted Notifier reports, or whether registrars retain discretion to independently assess and validate reports prior to taking action.

Please refer to the response given for #28

34 The draft Requirements Document provides for re-accreditation of registrars and potential transfer of registrations upon failure. Please clarify whether registrars will have access to a formal appeal or review process prior to forced transfer of registrations, and whether transitional or remedial measures short of transfer may be applied.

Please refer to the response given for #29

35 Performance Work Statement (PWS) Paragraph 6.12 "Registrar Accreditation": Could NTIA confirm if the requirements as listed apply to all usTLD registrars currently? Which requirements are new?

Post award, the Contractor will be required to run a re-accreditation process for all existing usTLD registrars.

The Contractor will then execute new Registry-Registrar agreements with all accredited registrars to ensure compliance with requirements of this PWS. For comparison, the requirements of the current Statement of Work for the usTLD are available at: https://www.ntia.gov/page/us-domain-space

36 Performance Work Statement (PWS) Paragraph 6.14 "Re-Accreditation of Existing usTLD Registrars" refers to requirements in Section 5.12. However, this section does not exist in the document. Is this reference intended to be 6.12 instead?

The correct reference is 6.13. This change has been reflected in the solicitation.

37 Solicitation Document Section L.6 Table 4 Question 1.2 "Registrar Connectivity" "a) List the ICANN-accredited registrars with which you maintain operational connections. b) Briefly describe how these relationships are, or were previously, securely maintained." The number of ICANN-accredited registrars we work with exceeds 1,800, which would require at least 33 pages to list and respond to part (b) of this question. Can NTIA confirm we can provide the answer to this question as an attachment?

NTIA confirms that you can provide the answer to this question as an attachment.

38 Performance Work Statement (PWS) Performance Requirement Standard in Technical Exhibit 1: The intro paragraph to Exhibit 1 on page 22 makes reference to an Attachment A, but there is no Attachment A in the PWS. Can NTIA provide SLA details as outlined?

Technical Exhibit 1 is Attachment A for the purposes of this solicitation. The language in the final solicitation has been amended to reflect this.

39 Performance Work Statement (PWS) Section 6.22.1.2 "The IP Address of the primary nameserver and secondary nameserver(s) for the registered domain name": According to RFC 1034 (section 4.2.1) and RFC 9471 (section 3), a registry is not required to maintain IP address (glue) records for nameservers that are not subordinate to the zone it operates (i.e.

.US nameservers), based on core DNS architecture and current operational guidance. Can NTIA confirm that the Contractor can continue to conform to these standards and best practices?

Yes, the Contractor should continue to conform to the RFC standards and best practices.

40 Performance Work Statement (PWS) Section 6.21 "usTLD Locality Space": Can NTIA provide the following information to help us shape our response:

1- How many third- and fourth-level locality and affinity zones have been delegated to Delegated Managers (6.21.2), and how many domains under management do they represent?

2- How many third- and fourth-level locality and affinity zones remain undelegated and are supported by the contractor (6.21.3)? How many domains under management do they represent?

3- Are delegated managers in contact with and maintain an open communication channel with the current Contractor? How do delegated managers communicate with the current Contractor about new domain registrations in their zone or updates to existing domain registrations? Is it via email or other methods?

As of November 2025, there were 12,534 total locality domains, 5,276 of which are managed by the Contractor.

There are over 7,000 third-level locality zones. There are over 200 delegated managers. The nature of their relationships with the Contractor are historical and varied. Delegated Managers communicate with the current Contractor through a dedicated portal, developed by the Contractor. The full and complete data regarding the locality space will be made available to the successful Offeror post-award.

41 Performance Work Statement (PWS) Section 6.25.1 "Advocacy for and Participation in Multistakeholder Internet Governance": Can NTIA provide a list of TLDs included in the "North America TLDs" reference?

The solicitation has been revised to replace "North America TLDs" with "ccTLDs of United States territories," which include: .as, .pr, .gu, .mp, and .vi.

42 Performance Work Statement (PWS) Section 6.21.2 "usTLD Locality Space": Can NTIA provide the current minimum technical and service requirements that Delegated Managers must abide by? If they are listed in the Delegated Managers agreement, please provide the specific section number.

Currently, Delegated Managers must, at a minimum: comply with RFC1480, maintain two name servers, enable the Contractor to perform zone transfers, provide customer support, ensure compliance with the U.S. nexus requirement, execute agreements with registrants, and agree to be bound by various usTLD policies. In the event of any transition to a successor Contractor, the Delegated Manager agreements will be assigned.

43 Solicitation Document Section L.6 "Phase 1 Submission: Technical Volume 1" page 30 requires offerers to use a Reference POC Template provided as an attachment to this solicitation.

However, this template is not included. Can NTIA provide this template?

Please refer to the response given for #7.

44 Solicitation Document Section "Factor 3 - Fee Structure with Cost Narrative" page 38 states:

"Offerors must use the Fee Structure Template provided in Section J as an attachment to this solicitation." However, there is no Fee Structure Template in Section J. Can NTIA provide this template?

Please refer to the response given for #7.

45 Solicitation Document Table 5, Scope Element 4.1, page 35 makes references to "6.20 - usTLD locality space and 6.21 - usTLD registration database at the Registry level." However, in the PWS, Section 6.20 is Intellectual Property Protection and Section 6.21 is usTLD Locality Space.

Can NTIA clarify these section references?

The references have been amended in the final solicitation.

46 (RD §5.6) The Requirements Document Section 5.6 states that the Contractor may not implement any policies, procedures, rules, mechanisms, or execute any agreements or subcontracts without prior COR/CO approval. Can NTIA clarify the scope of this requirement, specifically, whether it applies only to policies and procedures created to fulfill the RD requirements, or if it also includes the Contractor’s standard operating policies, procedures, rules, or mechanisms used in routine registry operations?

The scope of this requirement will be discussed with the Contractor post-award.

47 (RD §6.6) Section 6.6 of the Requirements Document references compliance with applicable IETF RFCs and ICANN policies, whereas prior solicitations included references to GAC Principles. To ensure an accurate understanding of the policy frameworks governing performance under the current solicitation, could the NTIA provide guidance on the specific external policy frameworks intended to apply under §6.6.

NTIA will work with the Contractor to adjust the application of RFCs, ICANN policies, and other external policy frameworks as appropriate for the usTLD, and as technology evolves.

48 (RD §6.10.1) If any of the core usTLD registry functions are wholly subcontracted to another party, can the NTIA clarify whether that subcontractor must also hold ISO 27001 certification and if so, must that certification also be provided as part of the reporting deliverables?

Any subcontractors performing core usTLD registry functions will be required to hold ISO 27001 or SOC2 certification. For other non-technical services that are subcontracted (e.g. customer service, accounting, human resource, etc.), such certification is not required.

49 (RD §6.12.1) To assist in assessing operational impacts, could NTIA provide guidance on whether exceptions or transitional accommodations may be considered for existing long standing foreign based registrars with a record of compliant operations and timely handling of domain name abuse reports?

Please refer to revised section 6.13.

50 (RD §6.12.3) Could NTIA provide examples of security standards or frameworks that would be considered ‘equivalent’ to ISO27001 for purposes of meeting the requirements of §6.12.3?

SOC2 is one example of a framework that would be considered 'equivalent' to ISO27001.

51 (RD §6.14) Could NTIA provide additional context regarding the purpose of the re accreditation requirement in Section 6.14?

NTIA is searching for cutting-edge approaches to DNS stability and security, the disruption and mitigation of DNS abuse, usTLD nexus policy enforcement, and privacy-respecting registration data access. American consumers and usTLD users will be best served by a re-accreditation process of the 250+ current usTLD registrars to ensure that any accredited registrar is committed to fulfilling usTLD policies.

52 (RD §6.14.1) Could NTIA confirm whether the reference to Section 5.12 within §6.14.1 should be referring to Section 6.12?

Please see the response to #36.

53 (RD §6.18.6). Could NTIA clarify whether the appeals process referenced in §6.18.6 is intended to apply only to actions between the Registrar and the Registry, or whether any portion of the appeals requirement is expected to extend to individual registrants?

The appeals process referenced in 6.19.6 is provided to the registrant and is managed by the Contractor. The Contractor must outline the steps that would be involved in the appeal process, including any timelines, fees, and requirements for Registrants appealing anti-abuse actions.

54 (RD §6.22.1.10 & §6.17.1) Could NTIA clarify how the distinction between legal and natural persons depicted in §6.22.1.10 should be applied in coordination with Nexus categorizations outlined in §6.17.1?

Currently, we see no distinction between the registration data and the nexus requirements with respect to legal and natural persons.

55 (RD §6.24). This section references the potential use of government run processes such as Notices of Inquiry, Requests for Comment, or other mechanisms to support stakeholder engagement. For planning purposes, could NTIA clarify whether this may also include the establishment of a federal advisory committee as defined under the Federal Advisory Committee Act (Pub. L. 92

463)?

NTIA intends to use all available mechanisms to gather stakeholder input, which includes NOIs and RFCs and may, in the future, include a FAC, as permitted by Federal Law.

56 (RD §7(3)). Could NTIA clarify whether the Contractor must submit detailed discount, rebate, and incentive pricing for all base and option years at the start of the contract, including how NTIA will review and approve any pricing adjustments or new incentives during performance;

or whether a proposed approach with incentive guidelines will satisfy the requirement?

In Phase II of the solicitation, NTIA will review pricing information for the base years of the contract. At their option, bidders may submit pricing information for option years, beyond the base period. All incentives, as well as fees, must be in the public interest, reasonable, and market based. Throughout the performance period, NTIA reserves the right to review fees and incentives to ensure that they adhere to this critera.

57 (RD Technical Exhibit 1) Can the NTIA confirm that the references to 5.18.6 and 5.20 should reference 6.18.6 and 6.20 in the first column of the table?

This is correct and the references have been amended in the final solicitation.

58 (Solicitation §L.5) Can the NTIA clarify what the “track(s)” are in the following statement?

“The cover page shall include the offeror name, contact information, and Unique Entity Identifier (UEI). The cover page shall also identify which track(s) the proposal is submitted for.”

Please see the response to #8.

59 (Solicitation §L.6, Factor 1) The Reference POC Template is listed as an attachment to the Solicitation, but there was no corresponding attachment. Can the NTIA provide the ‘Reference POC’ template?

Please see the response to #7.

60 (Solicitation §L.7) Can the NTIA confirm that the reference to "13.0 - Reporting and Deliverables" in the second column of the last row of Table 5 should be "12.0 - Reports and Deliverables"?

This is correct and the reference has been amended in the final solicitation.

61 (Solicitation §L.7, Table 5) Noting that 4.2, 4.8 and 4.9 have zero page limits, can NTIA provide further detail as to what information is expected?

The items listed as having a zero page limit are requirements that the Contractor must meet, but do not have a corresponding written requirement within the proposal. Proof that the requirement is met may be requested during the oral presentation, the negotiation period, and/or in the post-award period.

62 (Solicitation §L.7, Table 5) "6.14 - Re-accreditation of existing Registrars" appears in the Corresponding Work Statement Submission (WSS) column, however no WS Submission appears in the usTLD Requirements Document Section 6.14. Can the NTIA confirm whether there is a corresponding WSS and the text of such?

Please see the revised Requirements Document.

63 (Solicitation §L.7, Factor 3) Offerors must use the Fee Structure Template provided in Section J as an attachment, but there was no corresponding attachment. Can the NTIA provide the ‘Fee Structure Template’?

Please see the response to #7.

64 Reference: Performance Work Statement (PWS) §1.0; §4.0 Please clarify which registry-adjacent activities (e.g., policy communications, compliance monitoring) are considered within the scope of the Contractor’s responsibilities versus those retained by the Government.

The Government holds the policy authority for the usTLD and does not manage registry-adjacent activities.

NTIA works with the Office of Acquisitions Management (OAM) and the Contractor to ensure that the usTLD administrator is performing according to its contract requirements.

65 Reference: PWS §1.0; §4.0 Please clarify the boundary between operational decision-making authority delegated to the Contractor and policy decisions reserved to NTIA.

The Contractor implements usTLD policies specified by NTIA, including those that guide day-to-day operations.

Implemention approaches are generally presented by the Contractor and reviewed for approval by OAM and NTIA to ensure that the Contractor fulfills the purposes of the contract.

66 Reference: PWS §1.0 Are anticipated policy changes during the contract term expected to be handled within the base scope of work, or would such changes be implemented via contract modification?

Whether contract modification is required will depend on the scope and nature of the proposed policy change.

67 Reference: PWS §5.0 Is there an expected or maximum transition period from the incumbent registry operator to the successor Contractor?

Offerors can expect approximately a 9 month transition period.

68 Reference: PWS §5.0 Will the incumbent registry operator be required to provide transition assistance (e.g., DNS transition cooperation, documentation, historical data, existing .us website, marketing materials or data escrows), and if so, to what extent are the obligations?

In the event of a transition, the current Contractor must ensure an orderly transition while maintaining continuity and security of operations. Further information regarding transition planning is available here:

https://www.ntia.gov/page/us-domain-space#2019.

69 Reference: PWS §5.0 What obligations for the transition expected or permitted by the incumbent registry operator? In particular will the existing RRAs be assigned to new Contractor?

Please refer to the response given in #68. Yes, existing RRAs will be assigned to any successor contractor, however, following the re-accreditation process, new RRAs are expected to be completed.

70 Reference: PWS §6.0 May offerors propose alternative technical architectures (including cloud-native or hybrid designs) provided all performance, availability, and security requirements are met?

Yes, Offerors may propose alternative technical architectures provided that such architectures conform with U.S. jurisdiction requirements for primary registry services, as well as performance, availability, and security requirements.

71 Reference: PWS §6.0 Are there minimum geographic diversity or provider-diversity requirements for authoritative DNS services beyond general resiliency expectations?

General resiliency expectations encompass geographic, provider, and network diversity. Please see Section

6.3.1 of the Requirements Document.

72 Reference: PWS §6.0 Please clarify whether DNSSEC key management procedures must align with any existing NTIA-approved processes or whether offeror best practices are acceptable subject to Government approval.

Offerors may submit their own best practices for DNSSEC key management procedure as part of their proposals.

73 Reference: PWS §7.0; Security Requirements Should offerors assume compliance with a specific NIST security baseline (e.g., NIST SP 800- 53 Moderate), or propose an appropriate framework for Government approval?

Offerors should assume compliance with either ISO 27001, NIST SP 800-53, or SOC2 will fulfill the requirement.

74 Reference: PWS §7.0 What is the expected frequency and scope of operational, security, or financial audits during the contract term?

Please refer to Section 6.30 and Technical Exhibit 1.

75 Reference: PWS §7.0 Please clarify severity thresholds and timelines for reportable security or operational incidents, including DNS availability events.

Offerors are expected to propose thresholds and timelines for reportable security or operational incidents, including DNS availability events, as described in updated section 6.5.1.

76 Reference: PWS §8.0; SLA Requirements How will Service Level Agreement (SLA) compliance be measured (e.g., Contractor self-reporting, NTIA monitoring, or third-party tools)?

The Contractor is expected to engage an independent third party audit of SLA compliance on terms to be determined by the Contractor and the Department post-award. Additionally, the Contractor should maintain its own monitoring capabilities for the purposes of availability and performance checks as well as monitoring and reporting on adherence to its SLA.

77 Reference: PWS §8.0 Are SLA failures subject solely to service credits, or may they also trigger other contractual remedies?

SLA failures shall be subject solely to service credits. Offerors are expected to propose details for service levels, and associated service credits, as described in updated section 6.3.7.

78 Reference: PWS §6.0; §8.0 Are there defined expectations or constraints for scheduled maintenance windows that may impact registry services?

Offerors are expected to propose service levels for scheduled maintenance as described in updated section 6.3.7.

79 Reference: PWS §6.0; Data Escrow Please confirm registry data escrow frequency, format standards, follow ICANN standards and whether specific escrow agents are required or preferred.

Registry data escrow deposits must be made daily, in line with RFC 8909, and with a data escrow agent based in the United States. Please refer to Section 6.23.2 of the Requirements Document.

80 Reference: PWS §6.0 Please identify any required reports (type, cadence, and format) as standard deliverables under §6.0 and confirm whether ad-hoc/custom reporting is expected as part of the base scope.

Please refer to section 12.0 of the Requirements Document and Section H.3 of the UCF.

81 Reference: PWS §9.0 What reporting cadence is expected for operational, security, and performance reporting?

Please refer to Section 12.0 of the PWS.

82 Reference: PWS §9.0 Is the Contractor expected to communicate directly with registrars and other stakeholders, or only through Government-approved channels?

The Contractor is expected to communicate directly with registrars and other stakeholders.

83 Reference: Section B; Period of Performance Please confirm whether the base period of performance begins on the contract award/effective date or upon completion of transition/migration (e.g., cutover to production operations).

Please refer to #5.

84 Reference: Pricing Instructions Are there historical or projected domain volume figures the Government can share to assist offerors in developing pricing assumptions?

As of January 20, 2026, there are roughly 2,175,340 .us domains. The Government is not able to share historical or projected domain volume figures.

85 Reference: Pricing Instructions How should offerors structure pricing for significant changes in transaction volume or new technical requirements introduced during the contract term?

Please refer to section 7.0 of the Requirements Document and section L.7, subsection Factor 3 – Fee Structure with Cost Narrative for guidance on pricing instructions. Please be advised that only offerors invited to Phase 2 are required to submit a fee structure. Details and characteristics of the fee structure, including pricing structures dependent on transactional volumes, should be proposed by the offeror. The pricing structure to be submitted during Phase 2 should be built off the technical requirements included in the Requirements Documents, not unknown and future technical requirements.

86 Reference: PWS §1.0; Future Requirements Does the Government anticipate major registry modernization initiatives (e.g., new services or eligibility enforcement tooling) during the contract term?

Please refer to section 6.0 of the Requirements Document. Offerors are invited to propose modernization initiatives and activities through the work statement submissions outlined in section 6.0. The objective of the solicitation is to modernize the usTLD as stated in the Press Release available at https://www.ntia.gov/press-release/2025/ntia-issues-draft-request-proposals-administration-us-top-level-domain.

87 Reference: PWS §6.0 Are there current or planned requirements related to internationalized domain names (IDNs) or expanded character support within the .US TLD?

No, there are no current or planned requirements related to IDNs or expanded character support within the usTLD.

88 Reference: Draft FE §L.6; Table 4 (Factor 1) The solicitation requests evidence that the offeror "currently operates a TLD," has operated it continuously for at least the past five (5) years, and meets the stated domains-under-management threshold, and notes that evidence may include ICANN Registry Agreements.

Please clarify whether an offeror’s experience as a prime contractor providing end-to-end registry backend services for a TLD—where the offeror is contractually responsible for meeting applicable ICANN SLAs/requirements (e.g., SRS/EPP, DNS/DNSSEC, escrow delivery, operational security/compliance support, abuse operations as applicable)—is considered to satisfy the "operate a TLD" experience requirement. If so, please confirm what documentation is acceptable as evidence in lieu of an ICANN Registry Agreement in the offeror’s name (e.g., backend services agreement excerpts, SLA performance reports, escrow confirmations, audit reports, letters of reference from the TLD registry operator).

An Offeror who has experience as described is considered to satisfy this requirement. The Offeror would be expected to provide specific documentation noting this experience.

89 Reference: PWS §4.2; §6.5; RD §6.28, Draft FE §H.2 (CAR 1352.209-74)

Please confirm whether the restriction that “The Contractor shall not serve as a registrar in the usTLD space” renders an Offeror ineligible solely because the Offeror, or its corporate parent or affiliates owns or operates one or more ICANN-accredited domain name registrars and/or registry operators or be part of a broader corporate structure that includes one or more ICANN-accredited registrars, provided that:

(a) the legal entity performing the usTLD Registry Operator services does not itself act as a .US registrar except as expressly permitted under the Requirements Document;

(b) the Contractor registry operator maintains strict operational, data, and governance separation from any affiliated registrars;

(c) equal access, neutrality, and non-discrimination are ensured for all registrars; and

(d) effective policy, technical, organizational, and governance related obligations are met and safeguards are in place to prevent any affiliated registrar from receiving non-public, confidential, or commercially sensitive information (including data related to other registrars or their customers), and to fully mitigate any organizational conflict of interest.

If such an ownership or affiliation structure is permitted, please identify any specific disclosures, structural safeguards, certifications, audits, or ongoing compliance measures the Government expects Offerors with registrar affiliates to demonstrate as part of their proposal (e.g., information firewalls, neutrality controls, independent audits, certifications).

Section 4.2 does not render an Offeror ineligible as described. Please refer to the updated language in Sections

4.3 and 12.3.4.

90 Reference: Draft FE §L; OCI provisions; Subcontracting/Teaming Please clarify whether subcontractors, teaming arrangements, or consortium partners are permitted for performance of registry management services, and if so, whether any limitations apply to the scope of work that may be performed by such third parties (e.g., DNS operations, abuse mitigation, dispute resolution, marketing/outreach).

Subcontractors, teaming arrangements, and/or consortium partners are permitted. Please refer to the responses given to questions #1, #2, #13, and #48 regarding the requirements and limitations.

91 Reference § 6.1: Registrant Audits Please clarify the registrant audit process expected under §6.1, including: (a) the triggers for initiating an audit (e.g., random sampling, complaint-based, risk-based); (b) the roles/responsibilities of the registry operator versus registrars in conducting audits and collecting evidence; (c) acceptable forms of documentation to satisfy audit requirements;

and (d) the required outcomes, timelines, and reporting to NTIA (including any standard templates or metrics).

Please see the response given to #101.

92 References: Draft FE §H.2, CAR 1352.209-74 (Organizational Conflict of Interest) PWS (general performance and responsibility requirements).

Please clarify whether offerors may rely on subcontractors, third-party service providers, joint ventures, or other formal consortium or teaming arrangements to deliver portions of the required services (including, for example, marketing and outreach support, abuse monitoring and response services, or dispute resolution administration), provided that the prime contractor or joint venture entity remains fully accountable for performance. If permitted, please confirm whether organizational conflict-of-interest, neutrality, security, confidentiality, and audit requirements apply collectively to all subcontractors or consortium members, and whether any categories of subcontractors or teaming arrangements require advance Government approval or specific disclosure at the proposal stage.

Yes, the Offeror may rely on subcontractors to deliver portions of the required services. Please refer to the responses given to #1, #2, #13, #48, #94, and #95. Please also see the revised Section 6.1.1 WS Submission and Section 12.0 for reporting requirements, which must include the activities of subcontractors and consortium members, and Section 4.11 regarding Government approval. Relevant experience should be detailed in the Offeror's proposal and response to Factor 1 of the UCF. Please note that the successful Offeror is expected to provide a management plan to the Government for review and approval by the CO and COR.

93 Reference: Draft FE §L.6 (Phase 1 Submission: Technical Volume I) This section identifies eligibility criteria relating to domain management operations and scale, including requirements that the offeror: (a) currently operate a TLD; (b) has operated a TLD continuously for at least the past five (5) years; and (c) manages a TLD with at least two million domains under management (DUM). Please confirm whether these criteria are intended to be cumulative and that an offeror must independently meet each requirement.

In addition, please clarify whether evidence such as ICANN registry agreements and operational disclosures may be used collectively to demonstrate compliance with these criteria.

Please refer to the updated Background Question #1 in Table 4 of the UCF as well as to the updated Description of Services provided in Section 5.0 of the Requirements Document. Evidence such as ICANN Registry Agreements and operational disclosures can be used collectively to demonstrate compliance.

94 Reference: Draft FE §F.3 (Place of Performance) Section F.3 states that performance of all obligations under the contract shall occur within the United States. Please clarify whether this requirement is intended to apply to the location of the Contractor’s primary performance and contractual accountability only, or whether it also requires that all personnel and subcontractors performing any portion of the work be physically located within the United States, regardless of the nature of the services performed.

Please refer to the responses given to questions #1, #2, and #13.

95 Reference: RD §5.3 (Location of Primary Registry Services) Section 5.3 of the Requirements Document requires that primary registry services remain within one of the fifty (50) U.S. states, the District of Columbia, or a United States possession or territory. Please confirm whether this requirement applies solely to core registry systems, infrastructure, and operational control, and does not extend to ancillary or support functions that do not constitute primary registry services (such as registrar outreach, abuse monitoring and investigation, or marketing strategy), which may be performed by subcontractors located outside the United States.

Please refer to the responses given to questions #1, #2, and #13.

96 Reference: Section L.6 / Technical Volume I (as applicable); Requirements related to DNS abuse reporting Please clarify the transparency reporting requirement regarding DNS abuse. Specifically:

(a) Does the Government expect the registry operator to publish new public-facing DNS abuse transparency reports as part of .US operations, or would non-public reporting (e.g., internal reporting and reporting to NTIA) satisfy this requirement?

(b) What is the intended audience and distribution for such reports (e.g., NTIA only, registrars, and/or public disclosure), and is there an expected cadence and minimum content?

DNS Abuse transparency reporting by the Contractor must have at least some public-facing element, in addition to internal reporting to NTIA. Audience, cadence, and minimum content will be discussed post-award.

97 Reference: RD §6.28; RD §6.3.4 Please consider revising RD §6.28 (Code of Conduct) to explicitly require non-discrimination among/between registrars (not only registrants), including a requirement that any affiliated registrar receive no preferential treatment (e.g., pricing, access, performance, support, or dispute resolution) relative to other registrars using the Shared Registration System.

Please see the revised Section 6.29 and Section 4.3 of the Requirements Document.

98 Reference: RD §6.26.2; RD §6.28; RD §6.22 Please clarify and/or revise the RD to require that registrar and registry data (including commercially sensitive information provided by registrars and registration data maintained at the registry level) be protected by enforceable information barriers, role-based access controls, logging/audit trails, and periodic independent audits—so that an affiliated registrar (or other affiliate) cannot access other registrars’ confidential data or operational information.

Please see the revised Section 6.27.

99 Reference: RFP §L.6 / Table 4 / Factor 1 / Q1.a The draft solicitation states that evidence of operating a TLD at scale “may include Registry Agreements with ICANN.” Please confirm that this is illustrative only, and that Offerors may provide other evidence of operating/managing TLD(s) at scale in an ICANN-compliant manner (including compliance with applicable ICANN policies), even where the ICANN Registry Agreement is held by an affiliate, subsidiary, or a contracted registry operator for whom the Offeror is contractually responsible for fulfilling registry operations.

P…