33 ms·
Zoho CEO here. Our domain was abruptly blocked by our registrar this morning. Our NOC team and myself tried to get in touch with them and they tell us "Contact
by svembu1 8y ago
Zoho CEO here.
Our domain was abruptly blocked by our registrar this morning. Our NOC team and myself tried to get in touch with them and they tell us "Contact our legal". Even I could not get in touch with anyone beyond their phone operator. The domain was restored, but as DNS takes time to restore, we are still facing issues. They later claimed there were abuse complaints about Zoho.com emails (which is our personal email service with millions of free and paid users). We received a total of 3 complaints from them and two of them have been acted upon and one is under investigation.
Once we dig our way out of this, we will find ways make sure no one takes down our domain again this way.
- deleted 8y ago[deleted]
- KenanSulayman 8y agoYou should consider using Google Domains. There’s literally no company that’s more professional in this regard.
- deleted 8y ago[deleted]
- unstuckdev 8y agoGoogle is their direct competitor.
- scrollaway 8y agoI'm sure many of their employees can also use Android phones. Google is far too omnipresent to just ignore.
- sudhirj 8y agoThis isn't really a problem for companies the size of Google - while they may well refuse service to competitors or prohibit usage via terms of service, if they do allow a competitor on board there's no way they treat them any differently - there will be huge legal ramifications of they do.
- cn102vb 8y agoDo they have the well-known and celebrated Google customer service?
- svembu1 8y agoYes, all of these possibilities are under investigation. We have just recently secured ICANN approval to be a domain registrar. With our scale, this has become important now.
- forgot-my-pw 8y agoIt's kinda crazy that you have to become a domain registrar to circumvent problems like these in the future....
- manquer 8y agoIt is more likely Zoho is getting into/already in the business of selling domains and hosting as part of their portfolio and that's why they are becoming a registrar.
- RegicidalManiac 8y agoWell when Google bans you, you will simply find no recourse. Google is pretty shitty company when support is needed.
- devoply 8y agoGoogle is a company with a horrendous customer support history.
- gscott 8y agoFor most of history Google offers essentially no support. Recently Google has started making phone support available for Google Ads (AdWords) putting a contact number on their customer facing website.
- abtinf 8y agoCould you elaborate on your view that Google Domains is the most professional company for this kind of issue?
- kartman 8y agoAs a small start up when we ran into a similar problem while using google domains, they gave us a very hard time with bad support...something we could not afford then. I dont have a good alternative but wanted to mention this experience with google domains. Hope that helps.
- fitzroy 8y agoMaybe domains registered more recently work differently, but my Google domains use a random user account generated by Google for eNom (the provider they were contracting with at the time). That makes each domain it's own virtual customer (I couldn't just login to eNom or Google see a list of all my domains). I need to log into Google Domains as a separate account for each domain, and then that takes me to GSuite which links to eNom. Also, last I checked, unlocking a domain for transfer to another registrar required emailing Google/eNom. There's no interface for it. For a while the entire UI to choose to cancel a domain just disappeared as well. I would not recommend Google Domains.
- austhrow743 8y agoGoogle doesn't even use google domains.
- unixhero 8y agoI'd go with DYN.COM for all my domain and DNS needs for a million/billion(?) Dollar business such as this. No referral here, just advice.
- michaelbuckbee 8y agoThis should be higher up in the comments. DNS is a seldom thought of security / point of failure. Dyn's whole business model is basically: we won't turn you off until we talk to you.
- azinman2 8y agoDon’t forget https://en.m.wikipedia.org/wiki/2016_Dyn_cyberattack https://en.m.wikipedia.org/wiki/2016_Dyn_cyberattack
- alexforster 8y agoMirai was an extremely rare event. I understand businesses were impacted, but it's unfair to hold a three-year grudge against any Mirai victims who are otherwise responsible infrastructure operators.
- sitepodmatt 8y agoIronic isn't it. You ignored your paid subscriber in 2014, didn't respond to any @ tweets, your phone support went to voicemail, your forum threads were closed with no response. Karma is a bitch isn't it
- _asummers 8y agoI tried to become a customer a few years ago, but could not get access to their services despite two weeks of back and forth with support. I simply gave up and assumed it representative of what was to come later.
- chrissnell 8y agoI have no dog in this fight but this seems like a pretty serious allegation. Can you link to some of the tweets?
- Operyl 8y agoAssuming it's the same person, I couldn't find anything on Twitter: https://twitter.com/search?l=&q=zoho%20from%3Asitepodmatt&src=typd https://twitter.com/search?l=&q=zoho%20from%3Asitepodmatt&sr...
- daveFNbuck 8y agoI don't think Twitter search can go back that far.
- aidos 8y agoThat’s a little harsh. Having said that.... Zoho customer support is worse than useless. They’ll happily call you back only to tell you that they can’t help because it’s someone else you need to speak to. It’s a real shame because the Zoho product line is vast and with more focus it could be brilliant. But every part of it has little issues that will never get fixed because it feels like there’s nobody within the frontline staff seems to want to really understand. EDIT that all sounds more negative than I wanted it to. I think Zoho should charge people more and offer the service to go with it all while fixing the niggles that make their products feel flakey.
- senthilnayagam 8y agoSridhar Sir, having met you twice and argued with you, I am expecting a domain registrar coming from Zoho stable.
- tlamponi 8y agoJust FYI, I'm one of the maintainers of a mid-size forum regarding opensource virtualization/containers and thus spam is a daily occurrence. While the fight against it is rather dire and no end will ever be in sight, I'll nonetheless never stop (tool assisted) fighting. Anyway, @zoho.com addresses used by spammers started to pop up circa a month ago and increased rapidly in occurrence. As we use stopforumspam to report and track spammer info (and surely are not the single forum seeing those @zoho.com domains) you may got a few flags raised somewhere. Not sure what caused this sudden (from our POV) attraction of spammers using zoho, you may want to look into some defense against this. While a full solution may not be achievable it's often enough to be faster than other providers, aka the tiger defense ;-)
- krn 8y agoIt sounds like the spammers found a way to automatically create new @zoho.com email accounts, and the single way to stop them might be using a CAPTCHA service from the direct competitor, Google. At least that was the unfortunate case for the privacy focused German email provider Mailbox.org[1]: > We recently detected activities on our servers where bot nets were used to create hundreds of thousands of e-mail accounts for the sending of spam e-mail. Although we take this as a compliment – somebody out there must be convinced our infrastructure is up for the job – we needed to find a solution to stop this abuse of our service, of course. We subsequently deployed a number of different CAPTCHA systems to help our servers identify bots during registration. However, spammers were able to circumvent all these solutions shortly after they were put in place. [...] We therefore decided to use Google’s CAPTCHA for the time being, because out of the set of solutions we tried thus far, this one seems to work best. [1] https://userforum-en.mailbox.org/knowledge-base/article/google-captcha-in-registration-form https://userforum-en.mailbox.org/knowledge-base/article/goog...
- lwansbrough 8y agoI suppose due to the increasing risk of being broken by competing neural networks, recaptcha appears to be moving towards a model based on usage heuristics in v3. This is something that is more easily achievable by a small startup, so I hope to see competition for this type of solution if there isn't some already.
- iokanuon 8y agoIs zoho.eu also affected by this?
- gopi 8y agoSridhar, after this nightmare is over, move all your domains to MarkMonitor
- belorn 8y agoIf you have 40M users I suspect the annual cost from the registrar is very small part of the budget. Get a registrar where you don't have to deal with a phone operator. I work in this industry and it's a very clear separation between bulk registrars and those that maintain fewer but high value domain names. The latter usually give you a personal contact person to call and work proactively to deal with threats to companies' domain names and trade marks. I don't think I have ever heard of a domain being abruptly suspended by such a registrar. The cost is usually 5x-10x that of the cheapest registrars so there is naturally a balance to be struck, and as I work in this industry I might be a bit biased. However the damage when waiting on the TTL when registries update NS records sounds very substantial when they first suspend and later restore a domain name in what sound as a very reckless behavior.
- taf2 8y agoWhich register do you recommend?
- bqe 8y agoMarkMonitor is what Facebook, Google, Apple, Microsoft and other huge companies use. They don't take small accounts, though.
- Alupis 8y ago> Google Google is a registrar themselves... Do you mean they use someone else for their own domains?
- Thaxll 8y agoGoogle uses markmonitor: Domain Name: GOOGLE.COM Registry Domain ID: 2138514_DOMAIN_COM-VRSN Registrar WHOIS Server: whois.markmonitor.com Registrar URL: http://www.markmonitor.com Updated Date: 2018-02-21T18:36:40Z Creation Date: 1997-09-15T04:00:00Z Registry Expiry Date: 2020-09-14T04:00:00Z Registrar: MarkMonitor Inc. Registrar IANA ID: 292 Registrar Abuse Contact Email: abusecomplaints@markmonitor.com
- edm0nd 8y agoTransfer your domain to a major registrar. Tierra.net looks like some bs cheap registrar and doesn't have any social media updates on their accounts since 2017. I'd recommend Namecheap.
- wolco 8y agosocial media updates is not the best marker of current business activity.
- chiefalchemist 8y agoPerhaps. But surely they've run into some sort of technical issue from time to time. Isn't posting such to Twitter a reasonable expectation? I mean, if they don't want to proactively communicate with customers, maybe they have a culture where they don't want to hear from customers at all? Hello Google ;)
- indigodaddy 8y agoEven a solid company like Namecheap wouldn't actually be appropriate for a large, enterprise corporation such as Zoho.
- kbd 8y agoWhy not?
- thomasfortes 8y agoProbably because you want enterprise grade support, a real person that you can call and will help you solve your problems without having to deal with low level support before.
- FabioFleitas 8y agoWhat would you recommend?
- 8y ago
- nodesocket 8y agoI highly recommend AWS Route53 domains paired with their DNS service. Pay for the AWS support plan so you can call. I suspect Zoho is a multi-million dollar company at this point, should not be using a discount registar.
- pmlnr 8y agoThis was registrar level, not nameserver level.
- Androider 8y agoAWS Route 53 provides full registrar services for a while now.
- lbriner 8y agoThey use Gandi iirc, they are not a registrar themselves.
- Androider 8y agoSure they are, if you register a .com the registrar is "Amazon Registrar, Inc." since 2016 or so (https://www.icann.org/registrar-reports/accredited-list.html https://www.icann.org/registrar-reports/accredited-list.html). For some other TLDs, they might outsource it.
- ttul 8y ago$400M PA reportedly...
- Svexax 8y agoIf you’re providing email service, you should be actively monitoring public blacklists, not waiting for your registrar or hosting company to notify you. Even if your domain isn’t banned, your users’ emails may be bounced by other servers. That you don’t seem to know any of this means you aren’t employing the right people.
- icebraining 8y agoI'm pretty sure you're over inferring stuff from that post. It's not credible that 20+ years old company serving email for millions of users wouldn't know the most basic stuff about running an email server, don't you think?
- Svexax 8y agoAnd yet here we are.
- deleted 8y ago[deleted]
- Kim_Bruning 8y agoI think it's pretty good that you came to ycombinator yourself! I wish you the best of luck once you catch up with the CEO of Tierranet (or perhaps you already have!)
- ttul 8y agoI'm sure that Zoho has many talented engineers, but to manage abuse on the scale of 40M users you might benefit from engaging with one of the firms that specializes in this area.
- ted0 8y agoTed from Namecheap here. I shot you an email. We'd be happy to help you out and ensure that your domain is locked down.
- kweks 8y agoHi Ted. This event seems to have been triggered from abuse complaints - and involved the registrar not reaching out to the client in question. Curiously enough, I had a very similar incident with Namecheap last week: an unsubstantiated email (without subpoena, judge's order, or even validation of who actually sent the email) - was sent to namecheap abuse /alleging/ (correct, no proof) trademark infringement. Namecheap rolled over and provided all information to the third party - and didn't bother to inform me of the incident. The only way I found out was a menacing legal letter using the address that I have on file at namecheap. If Namecheap doesn't respect due process (ie, requiring legal documents to turn over customer information) or customer privacy (Hi, we have just had to turn over information) - on a 10+ year customer, I'm not sure that you're in a better position than Terra. Severely disappointed with you guys.
- ted0 8y agoI obviously can't comment on this without any further information but I have to say that this sounds quite unusual. We have very strict policies regarding due process: https://www.namecheap.com/legal/general/court-order-and-subpoena-policy.aspx https://www.namecheap.com/legal/general/court-order-and-subp... Can you shoot me an email? ted [at] namecheap.com
- kweks 8y agoEmail sent. I'd love to be mistaken on this. As re-iterated in the email, the email + address used in subsequent C&Ds were to a personal address only used in NC.
- fredsted 8y agoDoesn't seem very strict at all: "Upon the receipt of a valid criminal subpoena, unless the circumstances or subpoena warrant otherwise, Namecheap may promptly notify the customer whose information is sought via email or U.S. mail" Two things seem unclear: 1) The phrase "unless the circumstances or subpoena warrant otherwise" 2) The use of "may" in "may promptly notify the customer". Why is that not "shall" or "must"?
- namebase 8y agoHandshake.org is trying to solve this problem for good by decentralizing DNS at the root TLD level. I'd look into this if you want to make sure no one takes down your domain ever again. Disclosure: we're building a registrar on top of Handshake. We can also help you claim "zoho" on Handshake for free if you're interested.
- deleted 8y ago[deleted]
- wp381640 8y agoZoho has 40M users and apparently $350M in revenue. Why are you using a consumer grade domain registrar[0]? The gold standard for any enterprise is MarkMonitor. You can pick any other enterprise level service which would mean you don't resort to lowering yourself to begging on Twitter to find a contact at a pivotal service provider This has damaged you beyond DNS propagation, I don't know how anybody in tech is going to take you seriously again without some serious action [0] https://www.tierra.net/ https://www.tierra.net/
- quintin 8y agoCut them some slack.
- wp381640 8y agobased on everything i've experienced and heard about Zoho i'd say this incident is a symptom of issues rather than a cause
- fermienrico 8y agoYep, this incident shows deeper problems. As an outsider, I now question their security team, their devops, their entire company and internal policies. This is a huge oversight.
- eeeeeeeeeeeee 8y agoI was thinking the same. I hadn't even heard of Tierra until this post. Seems insane that Zoho would cheap out on a registrar.
- navinsylvester 8y agoWe(Gridmarkets) use multiple Zoho services and are a very satisfied customer. Would like to say we understand and stand by you as you sort this issue out. > Once we dig our way out of this, we will find ways make sure no one takes down our domain again this way. Would look forward to an official email with regard to what steps were taken to mitigate this going forward.
- Endy 8y agoZoho user since 2006. Thank you for responding to this quickly. I saw this just a little while ago; I use Zoho Writer and Show for presentations and team-based doc editing and I have for the last decade. If Zoho goes down, I'd be very much lost. Thanks for providing a great service for this many years and I hope it keeps going for many more.
- chris 8y agoThis happened to us (Weebly) years ago when we had godaddy as our registrar. I highly suggest you transfer your domain to someone competent like Safenames or MarkMonitor.
- huhtenberg 8y agoThe hell are you complaining about unreachable contacts when your own abuse@ address is dead - Arrival-Date: Thu, 30 Aug 2018 00:00:00 +0200 (CEST) Final-Recipient: rfc822; abuse@zohocorp.com Original-Recipient: rfc822;abuse@zohocorp.com Action: failed Status: 4.7.1 Remote-MTA: dns; mx2.zohocorp.com Diagnostic-Code: smtp; 451 4.7.1 Greylisted, try again after some time This is from our MTA after 5 (FIVE) days of trying to deliver you a spam report, with all delivery attempts originating from the same IP. And that's without getting into why you have a filter on your abuse@ address to begin with.
- lathiat 8y agoIf I had to guess they're probably rejecting the message further because it likely contains the spam itself. This is a key error in their handling of their abuse@ address, it needs to be expected to receive spam.
- onli 8y agoBut if the diagnostic code were correct and it were just a grey listing, that would be okay, wouldn't it? Just clashes with the mentioned five days.
- rajasekar_sv 8y agoDear User, Thank you for bringing this up. It was due to our greylist setting for *@zohocorp.com domain, we have now excluded the greylist for abuse addresses. Please resend your complaint to our abuse address. Regards, Zoho Account and Abuse Monitoring Desk.
- rajasekar_sv 8y agoFurther you can report to us using https://www.zoho.com/report-abuse/ https://www.zoho.com/report-abuse/
- guru4consulting 8y agobtw, I just noticed that Zoho.com domain TLS certificate expires next year. Hope you have automatic checks for the timely renewal.. I have been a fan of Zoho and hope you make a comeback.
- ca98am79 8y agochange registrars ASAP! Also, this is why I think DNS should be decentralized.