5 ms·

I can think of at least Cloudflare (somewhat), Linode, and Hurricane Electric off the top of my head. Anybody who operates a well-known ns1 type of resolver. It

I can think of at least Cloudflare (somewhat), Linode, and Hurricane Electric off the top of my head. Anybody who operates a well-known ns1 type of resolver. It's more a problem with zone hygiene than hosts, honestly.

deleted 10y ago
[deleted]
stestagg 10y ago
This seems like a great candidate for an ACME style protocol. I would totally support the ACME spec being expanded to cover this, and various other domain verification related issues
- corobo 10y ago
  Or just claim your domain if you point it at a DNS service..
ilogik 10y ago
Cloudflare does something similar to AWS. Each user gets different nameservers
- electroly 10y ago
  Is that true? The nameserver I was given by CloudFlare is "nelly.ns.cloudflare.com". From some cursory searches, it seems like a large number of domains have that same nameserver. AWS nameserver hostnames have all kinds of numbers in them that seem a lot more like they're generated per user.
  - jsmthrowaway 10y ago
    It's not true at all, no. I got "dan" on two or three different accounts.
  - dividuum 10y ago
    While you can generate unique hostnames of name servers per user you can't assign all of them unique IP addresses (at least in IPv4) as dns resolving doesn't have anything like vhosts (why should it?). So there will be overlap. Which is not a problem as long as the set of name servers for one users doesn't overlap the set of name servers for another user for a single domain. So you confirm that a set of name server belongs to a user by verifying that its domain record has those name servers configured. You then don't allow another user to control the same name servers for that domain as long as the domain record still points to them. New users can then freely create new name servers but the domain still uses the servers assigned to by the domain owner. What DO does is that it allows any user to control the name server for a domain if the previous owner gives up control of them. It should only do that, once the domain records start pointing anywhere else.

deleted 10y ago

[deleted]

stestagg 10y ago

This seems like a great candidate for an ACME style protocol. I would totally support the ACME spec being expanded to cover this, and various other domain verification related issues

corobo 10y ago
Or just claim your domain if you point it at a DNS service..

ilogik 10y ago

Cloudflare does something similar to AWS. Each user gets different nameservers

electroly 10y ago
Is that true? The nameserver I was given by CloudFlare is "nelly.ns.cloudflare.com". From some cursory searches, it seems like a large number of domains have that same nameserver. AWS nameserver hostnames have all kinds of numbers in them that seem a lot more like they're generated per user.
- jsmthrowaway 10y ago
  It's not true at all, no. I got "dan" on two or three different accounts.
- dividuum 10y ago
  While you can generate unique hostnames of name servers per user you can't assign all of them unique IP addresses (at least in IPv4) as dns resolving doesn't have anything like vhosts (why should it?). So there will be overlap. Which is not a problem as long as the set of name servers for one users doesn't overlap the set of name servers for another user for a single domain. So you confirm that a set of name server belongs to a user by verifying that its domain record has those name servers configured. You then don't allow another user to control the same name servers for that domain as long as the domain record still points to them. New users can then freely create new name servers but the domain still uses the servers assigned to by the domain owner. What DO does is that it allows any user to control the name server for a domain if the previous owner gives up control of them. It should only do that, once the domain records start pointing anywhere else.