← Back to home

Last updated 1 October 2026

Acceptable Use Policy

This policy sets the rules for using DNS by echo reply and related services when incorporated into your Terms of Service or another agreement you accept.

1. Scope

The policy covers services provided by echo reply ApS, CVR 43548441, Gammel Kongevej 11, 5. Sal, 1610 København V, Denmark, including DNS by echo reply, its web interfaces, APIs, and related infrastructure. Product-specific rules apply only to the products identified in the relevant section.

You are responsible for activity under your account and for taking reasonable steps to keep credentials secure. You must not knowingly permit another person to use your account or resources in breach of this policy.

2. Prohibited uses

You may not use echo reply services to facilitate, support, or engage in:

  • Malware and harmful code, Distributing or directing users to ransomware, trojans, credential stealers, or other malicious software
  • Phishing and impersonation, Deceiving people into disclosing credentials, financial information, or other sensitive data by impersonating a person, organisation, or service
  • Spam infrastructure, Supporting bulk unsolicited messages or a known spam operation
  • Illegal content or activity, Distributing child sexual abuse material, facilitating human trafficking, or using the service for other activity prohibited by applicable law
  • Fraud and deception, Supporting fake shops, investment scams, advance-fee fraud, or other fraudulent schemes
  • Rights violations, Knowingly using the service to infringe another party's intellectual property or other legal rights
  • Attacks and unauthorised access, Launching or facilitating denial-of-service, brute-force, exploitation, intrusion, or similar attacks against systems or people
  • Evasion, Deliberately concealing prohibited activity or attempting to circumvent a restriction imposed under this policy

The prohibitions above do not prohibit the lawful, authorised and contained security activities described in section 3. They do not create an exception to applicable law or binding registrar or registry requirements.

3. Security research and authorised exercises

Good-faith security research is permitted when you are authorised by the owner of the system being tested, remain within the agreed scope, minimise disruption and data access, and comply with applicable law. Authorisation to test a third party's system does not authorise testing echo reply's own services or infrastructure.

Authorised phishing simulations, security training, controlled malware analysis, defensive research and sinkholing are permitted when conducted within the relevant authorisation, with appropriate containment, minimal data collection and no material harm to uninvolved parties. Ordinary authorised exercises do not require separate approval from us. Contact abuse@echo-reply.net in advance to coordinate activities reasonably likely to materially affect shared infrastructure or generate significant abuse reports. Coordination does not waive the safeguards or authorise testing our infrastructure.

Research must not cause material harm, degrade service for others, retain personal data beyond what is necessary to document a finding, or use a discovered issue for extortion or unrelated access. To report a vulnerability in echo reply, contact abuse@echo-reply.net before testing beyond passive observation.

4. DNS-specific restrictions

The following additional restrictions apply to DNS by echo reply:

  • DNS amplification, You may not configure zones or records for the purpose of amplifying denial-of-service traffic against a third party
  • Malicious fast flux, You may not use rapidly changing DNS records to conceal malicious infrastructure, frustrate abuse response, or evade lawful investigation
  • Cybersquatting and typosquatting, You may not register or manage a domain in bad faith to exploit another party's name or trade mark, impersonate them, misdirect their users, or demand payment from the rights holder
  • Wildcard abuse, You may not use wildcard DNS records to intercept, deceive, or harm users seeking non-existent subdomains
  • Malicious redirection, You may not intentionally direct users to malicious or deceptive destinations

Ordinary domain investment, registration for a future project, and lawful resale are not prohibited merely because a domain is offered above its registration cost. Wildcard records, low TTLs, automated failover, dynamic DNS, and rapid record changes are also permitted when they serve a legitimate purpose and are not used for prohibited activity.

5. Compromise and attacks against customers

We do not treat you as violating this policy solely because your account, domain, or systems are attacked, or because a third party compromises them without your knowledge. We may take temporary protective action to limit harm while we investigate. We expect you to cooperate with reasonable containment and remediation requests after we notify you of the issue.

6. Reporting abuse

If you become aware of a suspected violation, report it to abuse@echo-reply.net. Please include, where available:

  • The domain names, DNS records, account details, or other resources involved
  • A description of the suspected violation and when it occurred
  • Supporting evidence such as URLs, screenshots, or relevant log excerpts
  • Contact information so we can request clarification or report an outcome where appropriate

We assess reports based on the available evidence and may ask for more information. We limit access to reporter information to people who need it to handle the report, but may disclose information where required by law or necessary to investigate and respond to abuse. See our Privacy Policy for more information about how we handle personal data.

Our contact page identifies the electronic contact points for authorities and service users under the Digital Services Act. Authority communications may be sent in Danish or English. Users can contact our monitored support inbox for human assistance and our abuse inbox for reports and appeals.

7. Investigation and enforcement

Technical controls and human review. Technical safeguards, including request rate limits, can automatically limit access to protect the service. A temporary technical restriction does not by itself establish an AUP violation. Abuse reports and appeals are assessed by our staff using the available evidence. You may ask for human review through the appeal route in section 8, including where a restriction was applied automatically. Registrar and registry restrictions may be imposed independently, as described below.

We consider the nature, severity, persistence, intent, and likely impact of a suspected violation, as well as the customer's response and any previous violations. Depending on those circumstances, we may:

  • Request remediation, Notify you of the issue and provide a reasonable opportunity to correct it
  • Restrict an affected resource, Disable or limit a specific record, zone, credential, integration, or other resource while the issue is investigated or remedied
  • Suspend wider access, Temporarily suspend a product or account when action on an affected resource cannot reasonably contain the risk, ownership or scope is unclear, violations are repeated, or continued access would impede investigation
  • Terminate service, End access for severe or repeated violations, deliberate misuse, or failure to remedy a violation after notice
  • Notify relevant parties, Cooperate with infrastructure providers, rights holders, regulators, or law enforcement when appropriate and lawful

Where feasible, we act on the affected resource rather than unrelated services or resources. We may act without prior notice where necessary to prevent imminent or ongoing harm, protect the service or third parties, comply with law, or preserve the integrity of an investigation. We will provide notice and a reason as soon as reasonably practicable unless prohibited by law or doing so would create a material security risk.

Remediation and restoration. Where reasonably possible, we will explain which resources are restricted, what must be corrected, and what evidence is needed to restore service. Once the reason for a temporary restriction has been resolved, we will restore access without undue delay unless another legal or security reason prevents it. We do not promise a fixed restoration time.

Upstream decisions and authority orders. A registrar, registry or competent authority may impose a restriction we cannot reverse ourselves. We will communicate the reason and available review route where permitted. We assess authority requests for authenticity, legal basis and scope, distinguish them from ordinary abuse allegations, and limit action or disclosure to what is required. An upstream restriction does not automatically justify restricting unrelated services.

Payments. A justified suspension for a deliberate or material breach does not automatically entitle you to a service credit. Being attacked without wrongdoing does not itself establish a breach, and we assess protective restrictions and any applicable remedies on the facts. If we restrict service in error, we will restore it promptly and assess the appropriate refund or credit. Permanent termination stops future billing for the terminated service. Unused prepaid fees are assessed under our Terms and applicable law, rather than automatically forfeited. Any recovery of losses or costs requires a separate lawful basis. Mandatory rights remain unaffected.

8. Appeals, preservation, and deletion

If you believe an enforcement action was taken in error or is disproportionate, you may appeal by emailing abuse@echo-reply.net within 14 days of the enforcement notice. Include your account identifier, the affected resources, your reasons for appealing, and any supporting evidence.

The 14-day period is for our internal appeal process and does not limit statutory remedies or access to courts or competent authorities. We will consider a late appeal where there is a reasonable explanation for the delay or material new evidence.

We will review the evidence and the scope of the action and communicate the outcome. Where feasible, the review will involve someone who was not solely responsible for the original decision. An appeal does not automatically pause measures needed to contain ongoing harm, but we may narrow or reverse an action when the evidence supports doing so.

We preserve information reasonably necessary to investigate the matter and support an appeal. Abuse reports, appeal correspondence, security records and billing records may have different retention periods, depending on their purpose and any continuing legal basis. The 14-day appeal period is not a deletion deadline. We delete or anonymise personal data when it is no longer needed for those purposes and no applicable retention obligation or justified legal hold requires us to keep it, in accordance with our Privacy Policy. Termination does not require immediate deletion of records still needed for security, legal, billing, or dispute-resolution purposes.

9. Changes to this policy

Changes to this AUP follow section 13 of the Terms of Service, including its permitted reasons, individual email and in-service notices, minimum 30-day notice for ordinary material changes, and applicable exit rights. Continued use does not by itself authorise changes outside the agreed amendment rights. Exceptional replacement agreements require the renewal-boundary process, at least 60 days’ notice and repeated reminders described there.

We may make a change sooner when reasonably necessary to address an urgent security threat, active abuse, or a legal or regulatory requirement that cannot reasonably wait for the ordinary notice period. We will limit the change to what is necessary, explain it, and notify affected customers as soon as reasonably practicable. An urgent change will not retroactively make previously permitted conduct a violation or remove accrued rights. Existing enforcement powers remain available to contain active harm.

For questions about this policy, contact abuse@echo-reply.net.