CHANGES.md
This file should record changes worth mentioning from the SIG and its meetings. No particular rules, just what seems appropriate to record. Entries should be in reverse chronological order.
2026-06-11
Updated the stakeholder advice section:
1) Moved all stakeholder advice documents out of the "detection" subfolder and into the main "stakeholder-advice" folder.
2) Updated stakeholder advice links and left navigation to use the flattened URLs.
3) Added "See Also" links between stakeholder advice documents.
4) Updated the stakeholder advice index heading from "Detection of DNS Abuse" to "DNS Abuse Technique Types".
2026-06-09
Updates to the HTML version of the DNS Abuse Techniques Matrix:
1) Renamed "Dynamic DNS Resolution (as obfuscation technique)" to "Obfuscation via Dynamic DNS".
2) Updated the definition in the GitHub techniques to reference the Stakeholder Advice First Portal.
https://firstdotorg.github.io/dns-abuse-sig/techniques/
2026-05-29
Published v1.3 of the DNS Abuse Techniques Matrix.
2026-05-28
Reviewed and updated the definition of CSIRT in the Matrix according to the CSIRT Framework definition. Removed ISAC from the definition. Updated links related to CSIRTs.
Fixed row splitting in tables in the Matrix.
Adjusted dates, headers, footers. Still a bit rubbish but hey, we're not experts in Google Docs.
2026-04-30
Renamed "Spoofing or otherwise using unregistered domain names" to "Use of an unregistered domain" and updated the definition to remove references to spoofing.
Renamed "Dynamic DNS Resolution (as obfuscation technique)" to "Obfuscation via Dynamic DNS".
Updated definitions for:
- Use of an unregistered domain
- Creation of Malicious Subdomains Under Dynamic DNS Providers
- Fast flux (added note about "double fast flux")
Updated acknowledgements in the Matrix source document.
2026-04-27
Updated mission statement point 1 to: "Provide globally-accessible descriptions and definitions of DNS Abuse in an operational context for purposes of global policy recommendations."
Added link to DNS Abuse Techniques Matrix to left nav.
Republished Fast-flux, DGA, cache poisoning, and DNS tunneling stakeholder advice documents with small changes to wording for consistency.
Published CONTRIBUTORS.md.
2026-04-23
HTML version changes (https://firstdotorg.github.io/dns-abuse-sig/)
- "CSIRT" -> "CSIRTs"
- "DNS tunneling - tunneling another protocol over DNS" -> "DNS Tunneling"
- "Dynamic DNS resolution: Fast flux (as obfuscation technique)" -> "Fast Flux"
- "Spoofing or otherwise using unregistered domain names" -> "Use of an unregistered domain"
2026-04-16
- Updated contributors list on Matrix and CONTRIBUTORS.md
- Changed "CSIRTs / ISACs" to just "CSIRTs"
- Updated notes about how the term "DGA" is used, and made consistent across documents
- Shortened the term "DNS Tunneling" from its longer form
- Updated "fast flux" everywhere to use the shorter version without clarifications
- Noted that there are legitimate uses of fast flux, in the stakeholder advice
- Fixed "spoofing of a registered domain (for abuse)" in DNS Abuse Techniques Matrix
2026-04-06
HTML version updates:
- CSIRT definition updated
- Nav bar update - CSIRTs/ISACs -> CSIRT
2026-04-05
Created v1.3 of the DNS Abuse Techniques Matrix
Updated lame delegations detection capabilities
Changed ordering of CHANGES.md updates
2026-02-05
Created CHANGES.md (yes, after the first change!)
2026-01-22
Finished going through the TODO list.
