Acceptable Use Policy

Last updated 19 September 2026

For DNS hosting and related services operated by KumoDNS

1. Purpose and acceptance

This Acceptable Use Policy (the “AUP”) protects the security, reliability and lawful use of the KumoDNS services operated by KumoDNS (“we”, “us” or “our”). It forms part of the agreement governing each customer’s use of the Services. By creating or using an account, submitting or hosting a DNS zone, using an API, or otherwise accessing the Services, the customer agrees to this AUP and must ensure that its users, administrators, resellers, contractors and end customers comply with it.

If this AUP conflicts with the applicable service order or Terms of Service, the order of precedence stated in those documents applies. This AUP does not require KumoDNS to permit any use that creates legal, security, operational or reputational risk.

2. Scope and definitions

“Services” means KumoDNS authoritative DNS hosting, DNS management, control panels, APIs, nameservers, monitoring and any related products, infrastructure or support supplied by KumoDNS. “Customer Content” includes domain names, hosted-zone data, DNS records, configuration, metadata and other information submitted to or transmitted through the Services. “Abuse” means conduct prohibited by this AUP or applicable law.

3. Customer responsibilities

• Provide accurate, current account, billing and administrative contact information, and promptly update it when it changes.
• Maintain the authority and all licences, permissions and rights required to control each domain name, zone and record submitted to the Services.
• Keep credentials, API tokens, DNSSEC keys and account recovery methods secure; use reasonable access controls and promptly report suspected compromise.
• Configure zones and records carefully, avoid lame delegations and harmful misconfigurations, and respond promptly to operational or abuse notices.
• Ensure that resellers and downstream users are contractually bound to rules at least as protective as this AUP; the customer remains responsible for their use of the Services.
• Comply with all laws and regulatory requirements applicable to the customer, its users, Customer Content and use of the Services, including laws of Singapore and any other relevant jurisdiction.

4. Prohibited use

A customer must not use, facilitate, direct, encourage or knowingly permit the Services to support any of the following:

Illegal or harmful activity

Any conduct that violates applicable law, court order, regulatory direction or binding requirement; facilitates a criminal offence; threatens national security or public safety; or creates a material risk of harm to any person.

Malware and malicious infrastructure

Malware distribution or command-and-control; ransomware; botnets; malicious payload delivery; exploit kits; drive-by downloads; cryptojacking; credential-stealing infrastructure; malicious fast-flux or domain-generation activity; or DNS records used to coordinate, conceal or sustain such activity.

Unauthorized access or interference

Unauthorized access, attempted access, scanning or exploitation of systems or data; credential attacks; interception; unauthorized modification; denial-of-service or distributed denial-of-service attacks; DNS amplification or reflection; cache poisoning; deliberate query floods; or conduct intended to impair a computer, network or service.

Phishing, fraud and deception

Phishing, pharming, smishing support, business-email compromise, impersonation, fraudulent investment or e-commerce schemes, deceptive redirects, fake login or payment pages, identity theft, or any scam or misleading practice.

Spam and abusive messaging

Unsolicited bulk communications, address harvesting, snowshoe activity, or DNS infrastructure used to send, route, authenticate or support spam or abusive messaging, including deliberately deceptive SPF, DKIM or DMARC configurations.

Child sexual abuse and exploitation

Child sexual abuse material, grooming, sexual exploitation of minors, or any related facilitation, linking, promotion or concealment.

Violence, terrorism and serious harm

Credible threats, incitement or instructions for violent crime; terrorist propaganda, recruitment or financing; or services used to facilitate trafficking, extortion or other serious harm.

Intellectual-property infringement

Infringement or misappropriation of copyright, trade marks, patents, trade secrets or other rights; domains or records used for counterfeiting or flagrantly infringing locations; or repeated rights infringement after valid notice.

Privacy and personal data abuse

Unlawful collection, disclosure, sale, doxxing, stalking or misuse of personal data; hosting records that expose secrets or personal data without authority; or evasion of data-protection requirements.

Prohibited content and commerce

Unlawful gambling, controlled drugs, weapons, counterfeit goods, sanctions evasion, money laundering, prohibited financial activity, or the sale or promotion of goods or services that are illegal where offered or received.

Abuse of the Services

Resale or access outside the customer’s plan or authorisation; bypassing limits; probing KumoDNS systems without written permission; creating excessive or abnormal load; interfering with logging, security or abuse controls; using false identities; or concealing the responsible user from KumoDNS.

DNS integrity abuse

DNS hijacking, unauthorized zone transfers, malicious dangling records, deliberate rebinding, tunnelling or exfiltration without lawful authorization, deceptive internationalized-domain use, typo-squatting for abuse, or manipulation intended to misdirect users or defeat security controls.

5. Security testing and research

Security testing of KumoDNS systems is permitted only with KumoDNS’s prior written authorisation and within the approved scope. Testing of systems owned by others must be lawfully authorised by those owners. A customer must not publish, exploit or retain data obtained through unauthorized testing. Good-faith vulnerability reports should be sent to Contact us. This clause does not grant a licence to test.

6. Abuse reports

Reports should be submitted through KumoDNS's abuse report form. To allow a fair and efficient review, a report should include:

• Reporter’s name, organisation and contact details;
• Affected domain name, fully qualified hostname, DNS record or account identifier;
• A clear description of the alleged abuse, including why it violates this AUP or law;
• Relevant URLs, timestamps (with time zone), logs, screenshots, message headers or other evidence;
• For intellectual-property claims, identification of the protected work or right, the allegedly infringing location, the claimant’s authority, a good-faith statement and a declaration that the information supplied is accurate; and
• Any urgent safety risk or deadline imposed by a court, regulator or law-enforcement authority.

KumoDNS may request further information, forward a report to the customer or relevant provider, preserve evidence, or decline reports that are incomplete, abusive or not reasonably verifiable. KumoDNS does not adjudicate private disputes over domain ownership, contractual rights or trade marks and may require an order from a competent court or authority where the facts are genuinely disputed.

7. Investigation, enforcement and remediation

KumoDNS may investigate suspected Abuse and take proportionate action based on the nature, severity, evidence, recurrence, legal requirements and risk to the Services or third parties. Where reasonably practicable and safe, KumoDNS may notify the customer and allow an opportunity to remedy the issue. No advance notice is required for urgent threats, compromised accounts, ongoing crime, child-safety matters, malware, phishing, attacks, legal compulsion, or material operational risk.

Available measures include:

• Requesting information, identity verification or corrective action;
• Blocking, removing, refusing, quarantining or modifying a DNS record or zone where technically appropriate;
• Rate-limiting, restricting API or account access, disabling DNSSEC signing or other affected functionality, or placing an account on hold;
• Suspending or terminating some or all Services, including repeat-infringer accounts in appropriate circumstances;
• Preserving and disclosing relevant information where permitted or required by law; and
• Referring matters to registrars, registries, upstream providers, payment providers, CERTs, regulators or law-enforcement authorities.

KumoDNS may act on a lawful notice, direction, order or request from a competent authority and may take reasonable steps to restrict access to relevant online activity. Enforcement does not limit KumoDNS’s other contractual or legal rights. KumoDNS is not obliged to monitor all DNS traffic, zones or Customer Content, but may use reasonable technical and manual measures to detect and prevent Abuse.

8. Emergency suspension and service protection

KumoDNS may immediately suspend, isolate or restrict a zone, record, credential, account or Service where KumoDNS reasonably believes this is necessary to protect security, service availability, customers, third parties or the public; prevent or respond to unlawful activity; comply with law; or contain a compromise. KumoDNS will seek to limit the action to what is reasonably necessary and restore service when the underlying risk has been resolved, subject to the agreement and applicable law.

9. Cooperation and records

Customers must cooperate promptly with reasonable investigations and remediation requests. KumoDNS may retain relevant account, configuration, security and abuse records for legitimate business, security, dispute-resolution and legal-compliance purposes, in accordance with its Privacy Policy and applicable data-protection law. Customers must not destroy or alter evidence after receiving a preservation request or becoming aware of a likely investigation or proceeding.

10. Privacy and confidentiality

KumoDNS will handle personal data associated with accounts, support and abuse matters in accordance with its Privacy Policy and applicable law, including the Singapore Personal Data Protection Act 2012 where applicable. Abuse reporters should submit only information reasonably necessary for the report. KumoDNS may disclose report details to the customer or relevant third parties where reasonably necessary to investigate, remediate, protect rights, or comply with law, but may withhold information where disclosure may create risk, compromise an investigation or be prohibited.

11. Appeals and reinstatement

A customer may request review of an enforcement decision by writing to KumoDNS through its appeal form within 14 calendar days, identifying the decision, relevant account or zone, grounds for review, remediation completed and supporting evidence. Unless KumoDNS agrees otherwise, an appeal does not stay the enforcement action. Reinstatement may be conditioned on verification, removal of Abuse, security remediation, payment of applicable fees, contractual assurances, or enhanced controls. KumoDNS may refuse reinstatement where risk remains material or termination is permitted under the agreement or law.

12. Changes to this AUP

KumoDNS may update this AUP to address legal, regulatory, security, technical or service changes. Material changes will be notified in the manner stated in the Terms of Service and will take effect on the stated effective date. Continued use after that date constitutes acceptance to the extent permitted by law. The current version should be published at https://www.kumodns.com/aup.php.

13. Contact details