5 ms·
It's important to remember that "just" DNS records are anything but "just" safe. Keep in mind that when you do this, you grant a third-party organization the ab
by floatingatoll 9y ago
It's important to remember that "just" DNS records are anything but "just" safe. Keep in mind that when you do this, you grant a third-party organization the ability to 'vouch' to anyone that they 'own' your domain or a URL at it, as long as the 'vouch' test supports http:// http:// or https:// https:// URLs.
This is the case for all web-hosting everywhere on the Internet. I host all of my domains through third-party providers, knowing and accepting the above-described risk. I consider it so low likelihood and of only medium impact if something ever occurs. The value is immense, the time spent is small, and the tradeoff worth it.
Imagine if someone phoned up your IT department and asked them to fix the MX record due to a mail server outage. Would you notice if your Received headers added a hop you weren't familiar with before? How long would they be able to record your company's email before someone noticed?
So I encourage taking DNS with absolute seriousness, and careful consideration of changes, and never simply assigning "just" 2 records to anyone, ever. Given 2 records, someone can do a lot more damage than any website hack ever could.
ps. "IN TYPE15" or thereabouts is another way to state "IN MX", to further convey why it can be very dangerous to follow instructions. Most admins would pause at an MX change, but most wouldn't think twice about a custom "TYPE15" record 'not supported by BIND yet', given sufficient verbiage.
- Illniyar 9y agoKeep in mind that this is an A record (and a TXT one) not an MX record, the only thing they can do with it is change the content of the site (which is what you want them to do). Tough I've known extremely incompetent IT support, I think even they would be suspicious of someone proving his identity by making a "this is me" html page.
- eli 9y agoAnd potentially get a valid ssl certificate for your domain.
- megous 9y agoAnd do HPKP for a while and throw away the key.
- stevekemp 9y agoEmail will fall back on an A-record if there is no MX record present...
- gramakri 9y agoNever heard of this behavior before but you appear to be right - https://stackoverflow.com/questions/1666807/email-validation-mx-lookup https://stackoverflow.com/questions/1666807/email-validation.... TIL
- floatingatoll 9y agoThis is a validation method supported by the major SSL certificate issuers, used primarily when approving a request by a third party (e.g. Akamai). They email you a hash, you put it in a webpage at a URL they specify, they approve the third party issuance. The point is not whether or not this domain parking thing uses two DNS records that do or do not include MX. The point is that, given a social engineering opportunity (“free domain parking with JUST 2 records”), an attacker can do extraordinary things.