22 ms·
Zoho.com CEO says domain with 40M users suspended for abuse complaint
- noja 8y agoIncredible. Their registrar (TierraNet) has some explaining to do.
- deleted 8y ago[deleted]
- JohnTHaller 8y agoThe importance of using a reliable registrar can't be overstated. tierra.net looks like a small company, without 24hr support, and with an abandoned social media presence. Why would a company with 40M users use a tiny registrar to save 2 bucks on a domain name?
- svembu1 8y agoThis was not the company used. The domain registrar market has gone through consolidation and it ended up here. We have been moving domains and this is a cautionary tale for us.
- deleted 8y ago[deleted]
- nir_CABRON 8y agoIndia superpower by 2020
- toast0 8y agoThey probably registered the name very early in their corporate life. At some point, they had a real business, and a business critical domain name, but they didn't realize they needed to do something different. My CEO registered our business names at network solutions, sigh. Anyway, as a wakeup call -- if you have a business critical domain name, you need to find (and use) a registrar that has a registry lock procedure for the TLD you're in. A registry lock means the registry won't process changes from your registrar unless you authorize them, which makes it a lot harder to change things on purpose, or by an attacker. I imagine abuse takedowns could still go through though -- but there will at least be more people who know you care about your domain.
- fermienrico 8y agoI can understand if they're a cement company with a website. Zoho is in the business of email with @zoho.com emails. This is a huge oversight which makes me question their whole company and how things might be internally.
- snowwrestler 8y agoI've been very happy with MarkMonitor. They have good customer service, a good reputation, and best of all, they auto-renew domains and send an invoice. That means that the failure mode is "domain is renewed, I owe them a check." If your domains are riding on a credit card, you potentially have a failure mode of "card was declined, my domain did not renew, everything is down."
- barkingcat 8y agoand then someone steals the domain out from under you and you'll need to pay in bitcoins to get it back.
- sandGorgon 8y agoHow much does markmonitor cost ? There is no pricing anywhere.
- Karupan 8y agoI’m guessing that’s an indication that it’s prohibitively expensive for small organisations?
- chris 8y agoBack in 2014 they wanted a $10k/yr minimum.
- snowwrestler 8y agoMy invoices say $20/yr per .com; other TLDs are more expensive. Because we have a ton of domains we spend over $20k a year with them. I'm sure there is a minimum but I don't know what it is these days. I would not say MarkMonitor is a tool for startups. It's a tool for organizations that would lose a lot if they lost a domain. I bet Zoho wishes they could go back in time and spend $10k to avoid this problem they had.
- lucasjans 8y agoYou would be surprised how prevalent these problems are even with supposedly reputable registrars. A commonly recommend option here in HN was NameCheap. Earlier this year without any notice they modified our DNS servers completely taking down our SaaS product. Why? Some migration script run incorrectly. They offered me a random TLD for free for one year as compensation! I declined.
- ethanwillis 8y agoFor me Namecheap just dumped all of my personal account information to some random lawyer who wasn't even suing me, but someone else. And a lot of the information they released wasn't even within the date range specified in the subpoena!
- Tomte 8y agoDon't you think it's enough? You've told this story now five or six times in this single thread. Please stop.
- ethanwillis 8y agoWould you feel the same way if a company just dumped all your private information? I don't want someone who only reads a part of this thread to think that Namecheap is trust worthy when they are not.
- Tomte 8y agoI find that abusive.
- ethanwillis 8y agoYes making sure that people are aware that their personal information is at risk from a company that touts itself as a bastion of privacy. Very abusive. Sorry you feel that way? Downvote me and move along then. We'll let up/downvotes play out and the community can decide just like it's designed to.
- deleted 8y ago[deleted]
- teddyh 8y agoYou seem to imply that reliable ≠ small, and that small registrars are cheaper. In my experience, the opposite is true in both cases. Big registrars can’t afford any support costs since they prefer to squeeze the price down as far as possible, and therefore they prefer to simply lose or outright drop any customer in case of any and all problems. Conversely, small registrars may charge more, but have better (i.e. actually existing, and sometimes even dedicated and personal) support for when things go wrong, and have a vested interest in keeping you as a customer.
- ttul 8y agoThis is why you register your domain with MarkMonitor or Cloudflare. I cannot comprehend why they were so stupid to use a registrar that is not corporate oriented. This is just unreal.
- toast0 8y agoThe domain was registered in 2004; MarkMonitor was around then, but Cloudflare wasn't. I was involved in moving a domain to MarkMonitor in 2013; at that time, they had a rather steep minimum spend to get on their platform, and they barely wanted to talk to us.
- LeonM 8y agoYou can transfer a domain name to a different registrar.
- lucb1e 8y agoThat's a lot of strong words in a short comment for an honest mistake. I don't think this is called for with pretty much any unintentional error where we don't know the exact background.
- ttul 8y agoWhen you have 40M users, this is an inexcusable oversight. It points at Zoho having an incompetent CIO role. An experienced and appropriately paid CIO would most definitely have had this near the top of his or her list years ago.
- srgseg 8y agoDo you happen to know how much Cloudflare charges for this?
- svembu1 8y agoZoho CEO here. Our domain was abruptly blocked by our registrar this morning. Our NOC team and myself tried to get in touch with them and they tell us "Contact our legal". Even I could not get in touch with anyone beyond their phone operator. The domain was restored, but as DNS takes time to restore, we are still facing issues. They later claimed there were abuse complaints about Zoho.com emails (which is our personal email service with millions of free and paid users). We received a total of 3 complaints from them and two of them have been acted upon and one is under investigation. Once we dig our way out of this, we will find ways make sure no one takes down our domain again this way.
- deleted 8y ago[deleted]
- KenanSulayman 8y agoYou should consider using Google Domains. There’s literally no company that’s more professional in this regard.
- deleted 8y ago[deleted]
- unstuckdev 8y agoGoogle is their direct competitor.
- scrollaway 8y agoI'm sure many of their employees can also use Android phones. Google is far too omnipresent to just ignore.
- sudhirj 8y agoThis isn't really a problem for companies the size of Google - while they may well refuse service to competitors or prohibit usage via terms of service, if they do allow a competitor on board there's no way they treat them any differently - there will be huge legal ramifications of they do.
- ttul 8y agoThis is a fireable offence for the CEO. There is no excuse for this level of incompetence. Makes me question all sorts of things now about Zoho. What else is run like a shit show over there?
- jjeaff 8y agoHow many CEOs do you know that would have any clue who their domain registrar is? How many would know what a domain registrar is?
- souterrain 8y agoFor a SaaS company, a domain registrar is part of the critical supply chain; if it fails, it creates an existential crisis to the business. I think that warrants CEO visibility.
- sreenadh 8y agoOk, this is just a non-technical version of what @souterrain posted. If I am the CEO of a local supermarket or a butchery, I don't need to know my domain registrar as they are not a major factor to my business. My website being down for 1 week also might not make a big difference. My customers deal with my company face to face. But if I am a CEO of an "Internet company" and my customers deal with me via my "domain", I damn well ensure that I have a weekly quick call with the guy who could block my domain abruptly.
- svembu1 8y agoI am the CEO. Yes, this situation is unacceptable. Unfortunately domain registrars do have extreme power this way. It could happen to any domain.
- debacle 8y agoIt could happen to any domain of a company that use a registrar that nearly no one has ever heard of. Sorry, OP was a bit too hard on you, but I think you have quite a bit of egg on your face for this one.
- unstuckdev 8y agoA whole lot of people are learning about the hazards of centralization in email lately. First Google turns GMail into a slow-loading nightmare for weaker computers like mine, then they announced the closure of Inbox. Now 40 million people are without email because Zoho couldn't keep up with registrar consolidations (https://news.ycombinator.com/item?id=18060013 https://news.ycombinator.com/item?id=18060013). Zoho is fine as a service, but a domain suspension shouldn't cut tens of millions of people off from email.
- chooseaname 8y ago> A whole lot of people are learning about the hazards of centralization in email lately. What is the alternative?
- unstuckdev 8y agoI don't know, I'm not an email geek. Lots of smart people run their own email systems and report good delivery rates going by past threads here. Maybe they can work together on something more accessible.
- tomschlick 8y agohttps://mailinabox.email/ https://mailinabox.email/ has worked well for me in the past
- acct1771 8y agoIn case this is a serious question: federation, with servers kept running by stakeholders of whatever the email's needed for.
- svembu1 8y agoI agree this is unacceptable. We are figuring out ways to make this more resilient - we host third-party domain mails, and we could map those domains directly without involving our domain. That could be one solution. We have learned a serious lesson here.
- foo101 8y agoHonest question: What exactly does it mean for a registrar to block a domain? I believed so far that for my browser to successfully connect to a web server running on a domain or for a mail server to deliver email to a domain, there should only be valid A, AAAA, MX, and/or CNAME records in the DNS. Was it really a block at the registrar level or was it a block at the DNS level, i.e., the registrar also ran DNS service and their DNS service refused to return responses for zoho.com domains? At what layer or at which stage of the protocol can a registrar disrupt this and take a domain offline?
- daigoba66 8y agoThe registrar maintains the records that specify which nameservers, i.e. DNS servers, will resolve names for that domain. The registrar simply changes that record to point to nameservers that they operate, and with DNS entries that “take it offline”.
- avens19 8y agoI assume the registrar was also the nameserver in this case
- chrsstrm 8y agoAm I seeing things or is dig really telling me their NS records pointed to vtitan.com? Who the hell is vtitan? Route53 with AWS would run them what, $100 a month for their level of traffic?
- huac 8y ago> vTitan, an international company with offices in California, Singapore and Tamil Nadu, is engaged in the development, manufacture, distribution and sales of a broad range of medical devices and consumables used in global healthcare markets. what in the world?
- unstuckdev 8y agoZoho appears to have funded it along with a few other companies. Unfortunately, the Indian news page that reported on the launch is even worse than news sites in the US with popups, pop-ins, pop-overs, pop-rocks, etc, so I can't in good conscience link it here.
- ddingus 8y agoDirect IP? Got a major sales push today, looking for a bandaid.
- ai_ia 8y agoThis is pretty bad service from Tierra registrar. I am taking this as a cautionary tale for everyone. Domain registrar have way too much power. A back up domain in case things go south, should be a must.
- deleted 8y ago[deleted]
- lifty 8y agoI really hope https://handshake.org https://handshake.org will catch on. It has the potential to solve a few very hard problems (PKI and online identity) without fundamental changes to the way the Internet works.
- TekMol 8y agoSo as a domain owner you are completely at the mercy of your registrar? What is considered a reliable registrar in Europe?
- kevingrahl 8y agoFor private or business use? Privately I’m pretty happy with Namecheap, they never failed to provide the support I needed in a friendly and precise manner. For business purposes with high value domains MarkMonitor seems to be the industry leader.
- TekMol 8y agoBoth seem to be US companies. What levarage do you have over them if they screw you? I would say none. Suing a company overseas is pretty much impossible.
- kevingrahl 8y agoAh I see, beg your pardon, I misunderstood your question. If you’re looking for domain registrars located in Europe I can only suggest one as I don’t have much experience dealing with others. Epag [1] has always been nice to deal with. [1] - https://www.epag.de/en/ https://www.epag.de/en/
- kweks 8y agoI love namecheap - customer for over 10 years - but a recent incident has me rethinking my patronage. We recently received a "lawyer DDOS" - where a law firm sent multiple letters claiming /alleged/ trademark infringement. Without proof of identity, proof of subpoena, judge's order - whatever - namecheap rolled over on their WHOIS protection. There was no dialog, no email from legal, nothing. I was dismayed to see that someone can literally send one email, get your personal info, and impact your company. Very disappointed in namecheap.
- automated_toast 8y agoI am also on namecheap and this freaks me out. can you provide more info?
- WC3w6pXxgGd 8y agoThis is terrible.
- glglwty 8y agoIs there a blockchain for DNS?
- yjftsjthsd-h 8y agoI believe OpenNIC was something like that.
- hsk0823 8y agoLike namecoin? or https://handshake.org https://handshake.org
- teilo 8y agoRunning their DNS on a 2-bit registrar is exactly the kind of thing I have come to expect from Zoho. I am forced to use this company for a handful of services at my company. If I started to tell you the idiocy I've had to put up with from these guys, I'd never stop ranting. I'll save it for DevRant.
- svembu1 8y agoThe domain was registered over 22 years ago, and it kept moving through registrars who were acquired. We do have a solid record of reliable services, and have kept growing in spite of never taking a dime in outside capital.
- brianmurphy 8y agoTo me this is even worse than choosing a bad registrar once by mistake. You keep choosing companies who can't stay in business and let your domain float around like it didn't matter. The second or third buy-out of your name registration should have been an alert to switch to a top tier company for stability. On the internet, your domain name is literally the crux of your services. Thank you for sharing your story. It should serve as a warning to others who may need to audit their infrastructure.
- walrus01 8y agoThis is a hard lesson for people that no matter how resilient your authoritative DNS infrastructure is, for your own nameservers (plus route53 or similar), your domain registrar is absolutely a single point of failure. If you have something with 40M customers I'd highly recommend going with the same domain registrars used by some of the Fortune 100 companies. Seizing a domain at the registrar level, by court order, is also how the US government implements "seizure" of domains, if you've ever seen a torrent index site that has suddenly been replaced with a big scary FBI page (examples: https://www.google.com/search?q=this+domain+has+been+seized+fbi&num=100&client=firefox-b-1&source=lnms&tbm=isch&sa=X&ved=0ahUKEwizv5jHutTdAhW8IjQIHaefBf0Q_AUIDigB&biw=1788&bih=1227&dpr=0.9 https://www.google.com/search?q=this+domain+has+been+seized+... )
- themihai 8y agoI believe DNS/domain name is really a problem that could be better served using a blockchain technology. The registers can't be trusted
- jamieweb 8y agoNamecoin is a good example of this - decentralised domain registrations using the .bit TLD.
- themihai 8y agoNamecoin is cool but I think there are still big issues to be fixed, like renewals/pricing to avoid one person getting all the good domain/sane names.
- jamieweb 8y agoYeah you're right - Namecoin has a massive squatting problem. It costs only pennies to register a name which doesn't help. One possible solution is a proof of work for name registrations, similar to the Onion Name System [1]. There is a short talk by Jesse Victors that explains it nicely [2]. [1] https://github.com/Jesse-V/OnioNS-HS https://github.com/Jesse-V/OnioNS-HS [2] https://youtu.be/zZzOVKPcIMg https://youtu.be/zZzOVKPcIMg
- rustcharm 8y agoAha! I was wondering when someone would say this!
- gibsonf1 8y agoWow, Zoho is down a second time today now with a 400 Bad Request...
- jtl999 8y agoI hope they move to a proper domain register after this... The lack of decent options of domain registers for technical people that don't need their hand held and have decent security, while not being $$$$ enterprise options is depressing... I use Uniregistry which has TOTP support and what seems to be a competent team, and a friend swears by AWS's Route53 domain registration, but more choices with actual good policies and aren't just a reseller would be welcome.
- mesozoic 8y ago40M users doesn't really give a good idea of how significant 3 complaints are. Still it sounds like some additional screening and protection against phishing needs to be implemented on Zoho's side.
- anonymous5133 8y agoI've had similar issues when operating my business. The bottom line is your company is only as strong as your vendors. If you pick weak vendors then your business is harmed as a result. If you find that you have a weak vendor then you must dump that vendor immediately and replace them with someone who is a strong vendor. Period.
- sreenadh 8y agoCouple of things about Zoho that I don't understand. - Why use the same domain for the free service, which is usually more prone to abuse? - Zohocorp.com is hosted on GoDaddy. Why not move all your domains to a single company so that they value your business more and give you a better level of customer service? I hope once this is all over, Zoho just shares their feedback and some advices that will help small businesses.
- donmcronald 8y agoI’ll add another. Why do they use the same domain for both MX records? Why not use mx.zoho.com, mx.zoho.net so that if one domain gets busted at the registry level the backup MX still works?
- Symbiote 8y agoPerhaps a reliable CCTLD for the alternative, so it's not under the US government. I noticed Amazon use a UK domain for one of the four Route 53 nameservers they specify.
- sandGorgon 8y agoWhat is the startup friendly markmonitor alternative here ? I don't see pricing information at a lot of these services ...so I'm guessing they are $$$$$$. Anything which startups can use and is $$ ?
- TheMagicHorsey 8y agoI really don't understand why any enterprise service would use these kinds of bargain bin registrars. Is using a reputable registrar with professional, enterprise-grade service not worth it given the scale of someone like Zoho? Optimizing to save a tiny amount on your registrar while you have millions pouring in from customers seems like a really poor decision. I really believe in running a lean business, but running lean means cutting the fat, not cutting out your muscles and tendons and running with a naked skeleton that is fragile.
- casper345 8y agoZOHO went down and hundreds of thousands of business went down...feel like this should be a bigger warning of how dependent we are to handful of companies?
- Animats 8y agoWell, of course. Look what business Zoho is in.[1] "Email marketing software that drives sales. Create, send, and track email campaigns that help you build a strong customer base." They don't have 40 million users. They have 40 million targets. Of course they don't get many complaints. If you search for "zoho opt out", you get sent to a page with a HTTP 400 error.[2] [1] https://www.zoho.com/campaigns https://www.zoho.com/campaigns [2] https://help.zoho.com/portal/kb/articles/what-does-email-opt-out-field-mean-while-creating-contact https://help.zoho.com/portal/kb/articles/what-does-email-opt...
- lewisjoe 8y ago[2] Works fine for me. Also, Zoho is among the most trustworthy companies list of mine. They don't do funny business with AI and targeted Ads with your data. You try, you pay and you use the software. Traditional, no-nonsense business model. I respect both Apple & Zoho for doing this. Just because Apple has a platform to run ads (The App Store), it doesn't mean Apple is in the advertising business.
- anumita 8y agoHi, The "email opt out" [2] link is fixed now.
- Animats 8y agoNo, it's not. Nothing in "help.zoho.com" seems to work. 400 Bad Request in Firefox. curl: curl https://help.zoho.com <html> <head><title>400 Bad Request</title></head> <body bgcolor="white"> <center><h1>400 Bad Request</h1></center> </body> </html>
- zorkw4rg 8y agoIts not like Zoho is known for their high availability anyways, their domain not being reachable is just par for the course. Also since it said "suspended for abuse complaint", I would almost immediately assume the Zoho just didn't properly handle abuse claims and its their fault. Needless to say I have a incredibly low opinion about their "service" based on having used their mail product for almost a year (switched to google afterward).
- sbr464 8y agoI feel that once you’ve passed a certain size you should move the domain to a more professional service, no matter the cost. MarkMonitor etc.
- ksec 8y agoReading through the thread, people have similar problems with namecheap, name.com. So if you cant afford something enterprise like MarkMonitor, and you don't want something super cheap $9.99 per year. What sort of good quality middle ground choices do we have?