Master Service Agreement v1

# nshost Master Service Agreement — Version 1

> **⚠️ DRAFT — NOT LEGAL ADVICE.** This document is a starting point written
> by a software engineer, not a lawyer. It MUST be reviewed by qualified
> legal counsel in the operator's jurisdiction (and the jurisdictions where
> servers are hosted) before being offered to customers.

**Effective date:** _to be set at first publication_
**Version:** 1

This Master Service Agreement ("Agreement") governs your use of the nshost
vanity nameserver service ("Service") operated by nshost ("we", "us").
By submitting a registration request and being subsequently registered, you
("Customer") agree to be bound by this Agreement.

## 1. The Service

nshost reserves subdomain labels under `ns1.host` and `ns2.host` (each, a
"Label") to applicants whose registration is approved. Customer may select
one of two service modes:

- **Self-hosted DNS.** Customer operates authoritative DNS servers and
  supplies their IP addresses; nshost publishes glue records at our domain
  registrar pointing `<label>.ns1.host` and `<label>.ns2.host` to those
  IPs.
- **Hosted DNS** (where offered). nshost operates the authoritative DNS
  on Customer's behalf on its own infrastructure under the same names.
  Hosted DNS may carry separate fees and is subject to its own technical
  limits described at registration.

In both modes the Label itself, and the names `<label>.ns1.host` and
`<label>.ns2.host`, are the property of nshost. Customer is granted a
limited, revocable, non-transferable right to use those names while this
Agreement is in force.

## 1A. Registration by Application; No Self-Serve

**All Label registrations are subject to manual review by nshost.**
Submitting a request via the website does not reserve a Label, does not
create a binding contract for service, and does not commit nshost to
provide service. nshost may, at its sole discretion, decline any request
for any reason or no reason, including but not limited to insufficient
information, suspected abuse, sanctions, regulatory risk, or operational
fit. A registration is created only upon written confirmation from
nshost and the receipt of payment for the agreed term.

## 2. Pay-to-Keep; No Permanent Reservation

Labels are reserved to Customer **only while the current paid term is
active**. If Customer fails to renew before the term ends, the Label
expires, glue records are removed (or hosted-DNS service is terminated),
and the Label becomes available for registration by any other party.
nshost does not guarantee that an expired Label can be re-registered by
the original Customer.

## 3. Pricing and Terms

Current pricing is published on the nshost website as **indicative**.
The final price for any Label is communicated in nshost's reply to the
Customer's registration request and recorded on Customer's invoice at the
time of purchase. Labels are classified as either **normal** or
**premium**:

- **Normal labels** are sold in 12-month terms.
- **Premium labels** are sold in 1, 3, 6, 9, or 12 month terms.

All amounts are in USD or EUR as agreed at registration. No refunds are
offered for unused portions of a term except where required by law or as
expressly provided in this Agreement.

## 4. Price Changes

nshost reserves the right, at its sole discretion, to increase prices by
**up to ten percent (10%) per calendar year** for any Label tier. Price
changes take effect at Customer's next renewal and will be disclosed on
the renewal invoice. Customer's remedy if they do not wish to pay the new
price is to decline renewal and allow the Label to expire under Section 2.

## 5. Reclassification of Labels

nshost reserves the right, at its sole discretion, to reclassify **any
Label as premium** at any renewal boundary. Reclassification does not
affect the Label during the current paid term. If a Label is reclassified
and the Customer declines to renew at the new tier, Section 2 applies.

## 6. Customer Warranties Regarding IP Addresses (Self-Hosted DNS)

Where Customer operates self-hosted DNS, Customer represents and warrants
that each IP address configured for a Label:

1. Is controlled by Customer or an entity Customer is authorized to act for;
2. Is running legitimate authoritative DNS server software;
3. Is **not** operating as an open recursive resolver;
4. Will remain reachable on UDP and TCP port 53 from nshost's probe network;
5. Will not be used to serve DNS for any of the activities prohibited in
   Section 8.

Customer further acknowledges that `<label>.ns1.host` and
`<label>.ns2.host` are intended **solely** as authoritative DNS endpoints.
Customer **shall not** operate or knowingly permit any web server, mail
server, or other public-facing TCP/UDP service to be addressed by these
hostnames. To enforce this, nshost publishes Certificate Authority
Authorization (CAA) records on the parent zones restricting public-CA
issuance of TLS certificates for `<label>.ns1.host` and `<label>.ns2.host`
to nshost's own ACME account; Customer acknowledges these CAA records and
shall not request issuance of certificates for these hostnames from any
other party.

nshost runs automated probes against Customer-configured IPs to verify
compliance. Persistent probe failures may result in suspension under
Section 9.

## 7. Glue Record Change Limit

To prevent abuse, Customer may change the glue records for any single
Label **no more than ten (10) times per calendar month**. Requests
exceeding this limit will be rejected until the first day of the
following month.

## 8. Acceptable Use Policy

Customer may not use the Service, directly or indirectly, in connection
with any of the following, and nshost may take action under Section 9
upon reasonable belief of any such use. The categories below are not
mutually exclusive; a single incident may fall under several.

### 8.1 Child Sexual Abuse Material (CSAM)

Any use of the Service to host, transmit, link to, or otherwise facilitate
CSAM is **categorically prohibited**. Reports of CSAM trigger immediate
suspension without prior notice to Customer, preservation of relevant
records, and **mandatory reporting** to the National Center for Missing &
Exploited Children (NCMEC) where US nexus applies, the Internet Watch
Foundation (IWF) for UK/EU nexus, and to the appropriate authority in
the operator's jurisdiction. nshost cooperates fully with law enforcement
in such cases. Section 9A revocation applies; no refund is offered.

### 8.2 Phishing, Credential Theft, and Fraud

Including but not limited to: brand impersonation, fake login pages,
business-email-compromise infrastructure, fraudulent payment portals, and
any operation designed to deceive a third party into disclosing
credentials, payment data, or transferring funds.

### 8.3 Malware, Ransomware, Spyware, and Command-and-Control

Including but not limited to: malware distribution endpoints, exploit
kits, ransomware payment / negotiation infrastructure, and command-and-
control ("C2") servers for botnets, RATs, info-stealers, or similar.

### 8.4 DNS-Layer Abuse

Including but not limited to: DDoS amplification or reflection setups,
fast-flux networks, domain-generation-algorithm ("DGA") infrastructure,
DNS tunneling for data exfiltration, and operation as an open recursive
resolver.

### 8.5 Spam (Unsolicited Bulk or Commercial Email)

See Section 8A for specific provisions.

### 8.6 Sanctions and Restricted Parties

Use of the Service by, or for the benefit of, any person or entity
appearing on the Specially Designated Nationals (SDN) list maintained by
the US Office of Foreign Assets Control (OFAC), the EU Consolidated List,
the UN Security Council Consolidated List, the UK OFSI list, or any
equivalent restricted-party list applicable in the operator's
jurisdiction.

### 8.7 Copyright, Trademark, and Other Intellectual-Property Infringement

Direct or indirect facilitation of large-scale infringement (e.g.
unlicensed streaming/cyberlocker fronts, counterfeit-goods storefronts,
or trademark-infringing brand-impersonation domains).

### 8.8 Other Illegal or Harmful Conduct

Any activity that is illegal in the operator's jurisdiction, in the
jurisdictions where nshost infrastructure is hosted (currently the
European Union and the United States), or in Customer's jurisdiction;
and any activity that, in nshost's reasonable judgment, threatens the
integrity, security, or reputation of the Service or its users.

## 8A. Spam (UCE) — Specific Provisions

Customer warrants that, where the Service supports any zone associated
with email, Customer's mail-sending operation:

1. Sends only to recipients who have given **prior, verifiable,
   affirmative consent** (no opt-out lists, no purchased lists, no
   "co-registration" dumps, no scraped addresses);
2. Honours unsubscribe requests within the timeframes required by
   applicable law (CAN-SPAM, CASL, GDPR/ePrivacy, India DPDP, etc.);
3. Maintains correct SPF, DKIM, and DMARC records;
4. Does not falsify headers, return paths, sender identities, or routing.

The following will be treated as automatic, immediate triggers for
suspension under Section 9, **without prior notice and with no refund**:

(a) Inclusion of any Customer-controlled IP, domain, or
    `<label>.ns(1|2).host` name on a recognised abuse list including but
    not limited to **Spamhaus SBL/CSS/DBL/PBL**, **SURBL**, **URIBL**,
    **Barracuda Reputation Block List**, **SpamCop**, or **abuse.ch**;

(b) Receipt by nshost of two or more independent abuse complaints
    relating to the same Label within any rolling 30-day window;

(c) Volume patterns or backscatter detected by nshost's monitoring that
    are characteristic of bulk unsolicited email;

(d) Use of the Service to publish DNS records that support snowshoe spam
    operations, hit-and-run sender-domain rotation, or other patterns
    designed to evade reputation systems.

A Customer suspended under Section 8A is presumed not entitled to
reinstatement. nshost may, at its sole discretion, permit reinstatement
upon receipt of a written remediation plan and removal from the
triggering blocklist; nshost is under no obligation to grant
reinstatement and is not obliged to provide reasons for declining.
Repeat offenders are permanently barred and forfeit all paid fees.

## 9. Suspension and Termination

nshost may **suspend or terminate** any Label, or Customer's account in
its entirety, immediately and without prior notice, upon:

1. Non-payment of fees;
2. Reasonable belief of any prohibited use under Section 8;
3. Persistent failure of Section 6 warranties (e.g., IPs consistently
   failing port 53 probes or being found operating as open resolvers);
4. A lawful order from a competent government authority;
5. Any of the automatic triggers in Section 8A.

Suspension takes effect by removal of glue records (or, where applicable,
disabling of hosted-DNS zones). Termination under this Section 9 does
not entitle Customer to a refund of fees paid for the current or any
prior term except where expressly provided herein or required by law.

## 9A. Discretionary Revocation

In addition to the for-cause rights set out in Section 9, nshost reserves
the **unconditional right to revoke, withdraw, suspend, reclaim, or
refuse to renew any Label at its sole discretion, for any reason or no
reason, with or without prior notice**. Reasons may include, without
limitation:

1. A Label being determined (at any time, including after sale) to fall
   within the categories of system-reserved, brand-protective, or
   prohibited names (for example, but not limited to: nameserver
   aliases such as `ns`/`dns`/`www`, functional endpoints such as
   `docs`/`payments`/`admin`/`login`, or any name likely to be
   confused with an nshost service endpoint);
2. A Label being reclassified as premium or as prohibited following a
   policy update, as contemplated in Sections 5 and 8;
3. Operational, security, legal, regulatory, or business reasons
   affecting nshost;
4. Any other reason nshost deems appropriate, including none.

Upon revocation, nshost will remove the relevant glue records and release
the Label. nshost may, at its sole discretion, offer a prorated credit or
refund for the unused portion of the current term, but is **under no
obligation** to do so, and Customer waives any claim for consequential,
incidental, or indirect damages arising from revocation. Customer
acknowledges that the Service is a discretionary commercial offering and
that no Label confers a property right or vested interest.

**System-reserved and prohibited labels.** Customer acknowledges that
nshost maintains and updates from time to time a list of labels that
are categorically unavailable for registration. Examples of such labels
include, but are not limited to: `ns`, `ns1`, `ns2`, `dns`, `nameserver`,
`nameservers`, `www`, `ww1`, `docs`, `payments`, `pay`, `billing`,
`invoice`, `admin`, `login`, `signup`, `account`, `api`, `auth`,
`dashboard`, `portal`, `help`, `support`, `status`, `blog`, `about`,
`contact`, `legal`, `terms`, `privacy`, `mail`, `email`, `secure`,
`host`, `nshost`, and any variation thereof. nshost may add names to
this list at any time and may revoke previously-registered Labels that
fall within additions to the list under this Section 9A.

## 9B. Abuse Reporting Channel

Reports of abuse, prohibited use, or other policy violations should be
sent to **abuse@ns.host**. nshost acknowledges receipt of abuse reports
within one (1) business day for routine reports and within four (4) hours
for reports concerning CSAM, active phishing, or imminent harm. nshost
also accepts reports through industry trusted-notifier channels
(NCMEC, IWF, Spamhaus, anti-phishing working groups, and equivalent
bodies) and prioritises such reports.

## 9C. Takedown Procedure and Service Levels

Upon receipt of a credible abuse report, nshost triages by category and
acts within the following indicative service levels:

| Category | Action SLA |
|---|---|
| CSAM | Immediate suspension; mandatory reports filed; account terminated. |
| Active phishing / malware / C2 | Suspension within 24 hours; Customer notified. |
| Spam (UCE), including any Section 8A trigger | Suspension within 24 hours; no notice required. |
| Sanctions list match | Immediate suspension; review by counsel. |
| Copyright / trademark complaint | Customer notified; counter-notice window (Section 9D); suspension if no counter-notice received within ten (10) business days, or sooner where required by law. |
| Defamation, "this content is illegal in country X", and similar single-jurisdiction complaints | Reviewed; nshost generally requires a court order from a court of competent jurisdiction before acting. |

These targets are aspirational and not warranted; failure to meet them
does not constitute a breach. nshost may, at its sole discretion, escalate
or de-escalate any report.

## 9D. Counter-Notice (Copyright / Trademark)

A Customer who believes a copyright or trademark complaint targeting
their Label is mistaken or unjustified may submit a written
counter-notice to abuse@ns.host within the window specified in Section
9C. The counter-notice must (i) identify the Label, (ii) set out the
factual basis for disputing the complaint, (iii) include Customer's full
contact details, and (iv) include a statement made under penalty of
perjury (or local equivalent) that the counter-notice is made in good
faith. nshost will forward the counter-notice to the original complainant
and may, at its discretion, restore the Label after a reasonable
holdback period if no court order is produced.

## 10. Legal Compliance and Cooperation with Authorities

nshost operates infrastructure in the European Union and the United
States and is subject to the laws of those jurisdictions as well as the
operator's jurisdiction. nshost will cooperate with lawful orders,
subpoenas, warrants, and other legal process issued by competent
authorities in those jurisdictions. nshost may disclose Customer
information, suspend Labels, or remove glue records (or hosted DNS
zones) in response to such process without prior notice to Customer
where prior notice is prohibited or impracticable.

## 10A. Mandatory Reports

Where required by law, nshost will file mandatory reports without prior
notice to Customer. This includes, without limitation, reports of CSAM
to NCMEC and equivalent bodies, reports of suspected sanctions
violations to the appropriate financial-intelligence unit, and any
disclosure compelled by court order. Customer waives any contractual
notice requirement that would conflict with these obligations.

## 11. No Service Level Agreement

The Service is provided on a **best-effort basis**. nshost does not
warrant any specific uptime, latency, or availability. Hosted-DNS
service, where offered, is similarly provided without an SLA unless an
SLA addendum is separately executed in writing. nshost disclaims all
warranties, express or implied, to the maximum extent permitted by law.

## 12. Limitation of Liability

To the maximum extent permitted by law, nshost's total cumulative
liability to Customer for any and all claims arising out of or relating
to this Agreement or the Service shall not exceed **the amount of fees
paid by Customer to nshost during the current paid term** for the Label
or Labels giving rise to the claim. In no event shall nshost be liable
for indirect, incidental, consequential, special, or punitive damages.

## 13. Changes to This Agreement

nshost may issue new versions of this Agreement. Customer will be
required to accept the new version at their next renewal or, where
required by law, sooner. The version accepted by Customer is recorded
on their account and is the version that governs their use of the
Service until replaced.

## 14. Statutory Compliance Contacts

The following contacts are published for the purpose of complying with
intermediary-liability and notice-and-takedown regimes in the
jurisdictions where nshost operates:

- **General abuse contact:** abuse@ns.host
- **DMCA designated agent (United States):** _to be registered with the
  US Copyright Office; current details published at_ `https://ns.host/legal/dmca`
- **EU Digital Services Act single point of contact (Article 11):**
  `dsa-spoc@ns.host` (also reachable via the abuse contact above)
- **India IT (Intermediary Guidelines and Digital Media Ethics Code) Rules,
  2021 — Grievance Officer:** _named officer and contact details to be
  published at_ `https://ns.host/legal/grievance` _within 30 days of
  go-live, with acknowledgement within 24 hours and resolution within
  15 days as required by Rule 3(2)._
- **Law-enforcement and regulator inquiries:** `legal@ns.host`

These contacts may be updated from time to time without amendment of
this Agreement.

## 15. Entire Agreement

This Agreement constitutes the entire agreement between Customer and
nshost with respect to the Service and supersedes any prior agreements,
understandings, or communications.

---

_End of Version 1._