You spent three months perfecting your music project. You bought the perfect domain. You finally click ‘publish’ on your website. Then, an email lands in your inbox from an address you barely recognize, demanding you upload a copy of your government-issued ID.
Your heart sinks. Is this identity theft? A sophisticated phishing scam targeting indie creators? You scour the internet for answers, only to find a community of confused developers asking the exact same question.
When a security measure feels indistinguishable from a phishing attack, it isn’t a security measure—it’s a threat.
Here is the twist you didn’t see coming: this isn’t a rogue scam. It’s ICANN. When you bought that .music domain, you likely clicked through a terms of service waiver you didn’t read, agreeing to a mandatory identity verification process. The .music domain is a ‘restricted’ Top-Level Domain (TLD). It was created to serve a specific community, and ICANN mandates strict identity checks to prevent domain squatters and bad actors from hoarding them.
But understanding the bureaucratic mechanics doesn’t make this any less dangerous. In fact, it highlights a terrifying trend in our digital infrastructure.
The internet was built on the promise of pseudonymity, but we are now being forced to trade our real-world identities for digital real estate.
The .music registry’s approach is fundamentally broken. Springing a demand for highly sensitive Personally Identifiable Information (PII) on users at the eleventh hour—via a generic support email—is a masterclass in how to erode trust. They are asking for your passport or driver’s license, but offering zero transparency about how that data is stored, who has access to it, and what happens when their inevitably porous database gets breached.
If you own a .music domain, or any restricted TLD, you need to understand the reality of the situation. The verification requirement is real, but the onus is entirely on you to protect yourself. You must verify the verifier. Check the URLs against official ICANN documentation. Use virtual credit cards for registrations. And if you must submit an ID, redact every piece of information that isn’t strictly necessary to prove your identity.
You cannot demand absolute transparency from your users while operating your own registry like a black box.
We are watching the slow death of the open web. Niche digital spaces that were supposed to foster creativity and community are now gated communities guarded by biometric and government checkpoints. The next time a registry asks for your passport to host a side project, remember: the gatekeepers aren’t protecting you. They’re protecting themselves. And you’re the one paying the price.
FAQ
Q: Is the email from [email protected] asking for my ID a scam?
A: No, it is likely a legitimate ICANN-mandated compliance check. Restricted TLDs like .music require identity verification to prevent domain squatting. However, you should still independently verify the URLs (like id.music and verify.music) against official ICANN documentation before uploading anything.
Q: How can I protect my personal data when a registry demands a government ID?
A: Never upload an unredacted document. Use photo editing tools to cross out or black out unnecessary information like your address or barcode, leaving only your name, photo, and date of birth. This proves your identity while minimizing the damage if the registry's database is breached.
Q: Why does the .music verification process feel so sketchy if it's legitimate?
A: Because the registry's communication strategy is terrible. Demanding highly sensitive personal information via a late-stage, generic support email—without clear upfront explanations about data storage and security guarantees—destroys trust and makes a legal requirement feel like a phishing attack.