As someone mentioned above, they publish a gpg key for sending this data. As for fake IDs, yes, it is certainly possible to create them. But when it is so muc

As someone mentioned above, they publish a gpg key for sending this data. As for fake IDs, yes, it is certainly possible to create them. But when it is so much easier to socially engineer your way into another service like Namecheap, it creates a disincentive for going after Gandi (and other similar hosts). No security measures can be foolproof, possibly short of sending someone to your home to take a DNS sample, but at least they're trying for a better solution.