21 ms·

Introducing Cloudflare Registrar

527 points by jgrahamc 8y ago

Ayesh 8y ago
This is awesome! Charging the exact same price as the registry wholesale price. NameSilo, as far as I know, comes very close to the registry pricing and offers DNSSEC, nameserver registration and other APIs with the registry. This could totally throw all registrars out of competition for the price of registry wholesale price. You just have to hope CloudFlare wouldn't overstep their role as a registrar if you only register the domain from them.
- nickjj 8y ago
  I currently use NameSilo. Don't forget they also offer free whois privacy for life. My only complaint with them is their DNS records are only updated once every 15 minutes. This makes doing automated API based DNS based LE challenges annoying because you need to sleep your script for 15 minutes to ensure the update got pushed. Also, I'm surprised Cloudflare omit talking about whois privacy in the blog post. Makes me wonder if they plan to sell that for some amount of money.
  - zackbloom 8y ago
    We actually didn't talk about WHOIS Privacy because it's becoming less and less of a relevant feature in the post-GDPR world. We do support it, free of charge. Cloudflare is also the largest authoritative DNS deployment in the world, and changes propagate in closer to 15 seconds than 15 minutes.
    - nickjj 8y ago
      Thanks for the confirmation. Sounds promising. Do you happen to also offer free email forwarding with registered domains?
      - zackbloom 8y ago
        I don't have the answer to that yet. On the one hand it's a bit far afield of what we normally do. On the other a lot of people seem to get it from their registrar and rely on it. The ideal situation would be if we could find a way to do email forwarding which wasn't just as good as what they do, but was exciting and meaningful. We'll keep thinking about it and let you know on our blog.
        nickjj 8y ago
        If you want to blow everyone away then I think you should start with giving free real inboxes for everyone (maybe with some sane limit, or a way to pay per month to increase it), and then introduce email forwarding in the future (because I'm sure some people will still want that feature even with real inboxes available). If you GA'd with: ~$8 .com addresses, N real inboxes, free whois guard and a top notch DNS record API. That's a compelling offer and I'd very likely switch from namesilo if that were the case. To be honest, anything less and I'd stay with namesilo because the 15 minute timer can be worked around by using my web host's name servers (digitalocean pushes updates in a few seconds). I couldn't live without either email forwarding or a real inbox.
        zackbloom 8y ago
        When you say real inboxes, are you thinking webmail of some sort? Don't most people prefer to use Google Apps or the like these days?
        JonKF 8y ago
        Most places and projects I've worked in the past 10 years or so have used GSuite or similar for inboxes, and Amazon SES or similar for programatically sending email. Those that didn't (shared-hosted websites on CPanel installations seemingly do still exist in 2018) had access to webmail in the hosting panel or as an installable application.
        8y ago
    - silverwind 8y ago
      Still got to factor in the minimum allowed TTL of 120 seconds, thought. I wish the API would allow less.
    - haboutnnah 8y ago
      Sorry to bother you, but do you offer changing nameservers after registration?
- homero 8y ago
  Porkbun is also wholesale except they add a few cents
  - WordSkill 8y ago
    Not wholesale, Porkbun are adding 10%.
ryanworl 8y ago
Are you planning on exposing a registration and domain search API that can be used to purchase domains and set them up with zones automatically?
- LakeAustin 8y ago
  Yes, we are planning on releasing those features.
r1ch 8y ago
This sounds great. Hopefully the TLD coverage is extensive, I dislike having my domains split across multiple registrars based on their supported extensions.
- LakeAustin 8y ago
  We want to help you consolidate those! Full list here for TLDs supported at launch, but we're busy working to add more before then. https://www.cloudflare.com/tld-policies/ https://www.cloudflare.com/tld-policies/
  - bpye 8y ago
    Hope you get .uk etc that Nominet are in charge of too, would be happy to use just one registrar.
  - WordSkill 8y ago
    I second the request for the .UK TLDs.
    - GordonS 8y ago
      Uh, uk just feels like a scam! I mean, what is the point, other than to extort existing .co.uk owners?
      - WordSkill 8y ago
        I presumed most existing co.uk owners simply moved to the far simpler, more memorable .uk TLD, ditching their old domains along the way. I know I did.
  - sofaofthedamned 8y ago
    Gah, you don't have .je domains. I have a charity one there which I have to use gandi.net for and it's driving me nuts...
    - 8y ago
Operyl 8y ago
What are the supported TLDs going to be? I.e. codes, app, ca? WHOIS protection?
- LakeAustin 8y ago
  We'll support 224 TLDs at launch! Full list here: https://www.cloudflare.com/tld-policies/ https://www.cloudflare.com/tld-policies/ And you'll be able to redact your personal information from Whois with us, too.
  - Ayesh 8y ago
    This is a pretty extensive TLD List, specially considering CloudFlare has to directly deal with the registries than being a reseller of some commercial registrar (like enom).
    - profmonocle 8y ago
      Most of them are from Donuts, who have a huge number of TLDs. In fact, looks like the only non-Donuts domains are com, net, org, and info, so only four registries. It's not surprising, dealing with all the various registries (especially for ccTLDs) is probably one of the harder things to scale when spinning up a new registrar. Even Amazon Route53 uses resellers for some TLDs.
  - kr4 8y ago
    Couldn't see .IN in the list
johnklos 8y ago
While Cloudflare appears to be doing things that are meant to help everyday people, I can't help but be suspicious. This is an organization that sticks with the "we don't host" bullshit line when web sites serve up Trojans which pretend to be Adobe Flash installers. While there's more subjectivity involved with dealing with hosting the content of spammers, there is zero subjectivity involved with clear and obvious phishing sites. First, anyone with the tiniest modicum of common sense can tell that these pretend Flash sites are absolutely not in the slightest way legitimate content. Second, providing services in any way, shape or form is, in fact, hosting. Providing DNS? It's hosting. Providing a cached version of the site? Hosting. So if they want to be in the business of pretending to be not-hosting, then they have to stop providing services that without which web sites would cease to function. Are they now going to claim that they're not providing meaningful services to domains registered through them, and therefore they should not be responsible for people who are doing illegal things? Probably.
- zackbloom 8y ago
  I appreciate that these decisions can seem easy, but broadly do you want a private company deciding what can be on the internet, or do you want that decision made by a judge with due process?
  - deleted 8y ago
    [deleted]
  - daxorid 8y ago
    Matt Prince already decided "what can be on the internet" when he banned Daily Stormer. As far as Cloudflare is concerned, that ship already sailed.
    - jjeaff 8y ago
      That's completely different really. They just stopped proxying their traffic. Daily Stormer could continue on, assuming they pay enough to handle the traffic. Turning off your domain name is a different story. You are sunk until you can regain control of it.
ocdtrekkie 8y ago
I think this is pretty great. Apparently a .com is going to run you only $8.03 right now. I already use Cloudflare for some things, and like to keep my web presence diversified, so I probably won't move my main domains to Cloudflare just to maintain "separation of powers", but there's definitely some "own the other TLDs of these"-type domains that I have which I may hand off to Cloudflare to save money.
r1ch 8y ago
Looks like there's a bug with the wait list, once you sign up don't visit the page again or it registers you again in a later wave! On further investigation it seems to be throwing 502 errors and then saying Wave 8, so maybe it's just a UI bug.
- zackbloom 8y ago
  We'll track it down, thanks r1ch!
c487bd62 8y ago
Awesome! I hope you don't mind me ranting a bit about custom domains > Custom Domain Protection for Cloudflare Registrar, available on the Enterprise Plan, protects your organization from domain hijacking with exclusively out-of-band verification of any changes to your Registrar account. This is what keeps me locked into Google and other services. I just can't trust my custom domain, if I'm targeted by any semi competent attacker it WILL be hijacked. That you're offering this service only makes my suspicions stronger. I want to use your services but that's a showstopper. It's not your fault, of course, all registrars face the same issues. You need so many different factors to make the process secure it's not even funny, and you said it yourself: "That, obviously, doesn't scale". A few years ago one of my customers domain was stolen by contacting the registrar support (one of the big ones, always recommended around here). They even had a scan of his passport. With so many data leaks, even from your own government, how do you even protect against these kind of things? His life for the next few months were living hell.
- zackbloom 8y ago
  I'm sorry to hear that, it sounds horrible. We had a very similar situation several years ago which led to the development of our original Registrar. All I can tell you is the 'custom' in Custom Domains refers to the idea that you can set whatever security policy you would like. That includes restricting who can change your domain to a list of people you can count on one hand who each have a personal relationship with you. If you want a policy which requires a photo of you with today's newspaper in it to change a domain, that's probably something which can be arranged. Just to clarify for readers, this is the Custom Domain plan, which is the Enterprise version of the Registrar we are launching today.
ksec 8y ago
I wouldn't have cared much about Domain Name Register just a week ago, but after what happen at Zoho, and all the horror story in the comments section from namecheap and others, Cloudflare Registar couldn't come at a better time. I really wish Cloudflare at least made $1 or $2 Gross Profits per domain. Who paids for Domain Register Support? I would much rather be a "customer" than I am not sure where they are making money from my Domain. P.S - If those were wholesale price, do other companies get heavy discount for signing up in bulks? How do other companies made money when they are selling it for $0.99 or $6.99
- jjeaff 8y ago
  I don't think there is a bulk discount but prices vary by tld. Base rate for a .com is around $8 plus a small icann fee. If anyone is selling it for .99, they are simply eating the cost in order to earn a long term customer. In this case with cloudflare, I'm sure the point is, like their other products, to offer the free service as a gateway drug to their profitable enterprise products. They have an Enterprise registrar service that is pretty pricey.
- rk249 8y ago
  I though namecheap was one of the better ones around? I'm looking for a domain registrar. Could share the link with namecheap horror stories? Thanks
  - Bluestrike2 8y ago
    I think [0] is the article in question; just search the page for the namecheap comments. 0. https://news.ycombinator.com/item?id=18059792 https://news.ycombinator.com/item?id=18059792
    - zawerf 8y ago
      It seems like it was just a handful of users who posted their story multiple times. The users highclass, ethanwillis, kweks all had multiple comments only about namecheap on a thread that wasn't directly about namecheap. Can I get more horror stories to confirm those are real? It's unfortunate because namecheap used to have the exact opposite reputation: https://news.ycombinator.com/item?id=3396606 https://news.ycombinator.com/item?id=3396606
umbs 8y ago
Anyone here know if Cloudflare plans to let non-customers to transfer their domains to Cloudflare? Especially, if it's a personal domain? I purchased a domain from GoDaddy and host a blog. But they have been up selling and charging me needlessly. I imagine it's a headache for Cloudflare to support personal domains like GoDaddy does, but I really hope they do.
- jgrahamc 8y ago
  Yes. As soon as we are through the Early Access period.
- zackbloom 8y ago
  If you add your domain to Cloudflare now you'll get on the waitlist.
- scottydelta 8y ago
  domains.com is owned by Godaddy AFAIK and they charge you to transfer domains between those two services. I couldn't find a single mention of this fact anywhere on the internet. The only way to confirm is to go to 'Legal' link at the bottom of domains.com(WHOIS is set to private) and it takes you to a page with the domain www.secureserver.net which is owned by GoDaddy.
nodesocket 8y ago
I am excited about this announcement, and look forward to a registar who takes security seriously. > But why should registrars charge any markup over what the TLDs charge? That seemed as nutty to us as certificate authorities charging to run a bit of math. When we see a broken market on the Internet we like to do something about it. That is not a broken market, it's actually free-market economics and business. Charging a markup for a service litterally is how many companies operate. I don't have a problem with it, and because it's a free market it allows CloudFlare to disrupt it.
deleted 8y ago
[deleted]
jpswade 8y ago
Tucows made hover.com to try and solve this exact problem. How does this differ?
- WordSkill 8y ago
  Price: $8.03 vs $14.99
  - awill 8y ago
    All my domains are with Hover. Good customer support, reasonable UI, 2FA. I'm pretty happy with them. Sure, it's a little more expensive, but I actually like the no upsell, stable prices, no coupon codes etc.. Most importantly, there's a number to call. I've never had to call it in my 7 years with them, but I'm glad it's there for emergencies. A domain is so, so important, I don't see "we're a few bucks cheaper" as a selling point.
    - jhall1468 8y ago
      I mean, that's literally the same thing CF is doing here. No upsell, stable prices (at cost) and obviously no coupon codes.
      - awill 8y ago
        Yes. But will they have a number to call? Can they pay support staff if they're selling domains at cost.
JohannesH 8y ago
Do cloudflare want to be registrar for other foreign TLDs in the future? I would love to see them support TLDs such as .dk, .de, .it etc. That way both me and my clients could begin consolidating domain registration in one place, instead of using expensive and shitty domain registration management services. Harder ones, like Tonga (.to) or Greenland (.gl) would be nice to have as well, but I don't think it's feasible (or possible even) to integrate with all countries.
- jgrahamc 8y ago
  Yes, we do.
  - ddorian43 8y ago
    Hell, yeah. Get into hosting next. Destroy the whole internet. It's what the 'competition' deserves.
    - meguest 8y ago
      Is this sarcasm?
      - dogecoinbase 8y ago
        Presumably, but they have a poorly-articulated point -- Cloudflare has an incredible potential for (even unintentional) destructive effect based on their extreme consolidation and centralization of internet technologies. I think a terrific example of this is when they put a DNS server on 1.1.1.1 (in historically unused address space which was assigned to APNIC for research purposes), got a certificate for the IP address, then added that certificate to the Chrome HSTS preload list, meaning people who ended up on captive portals on 1.1.1.1 (and there are a _lot_ of them) couldn't access the internet, because instead of observing what people _actually_ do and paving the cowpaths, they took the point of view that acting against the standards was punishable, and the people being punished are nontechnical folks visiting hotels and airports who are using a modern browser (it has since been removed from the preload list, but if you're foolish enough to visit the site you'll still get HSTS-poisoned). An even better example, of course, is Cloudbleed, but I guess we've all agreed to pretend that never happened?
WordSkill 8y ago
I have used dozens of different registrars over the past two decades and found Fabulous.com to be by far the best on price and technology. Unfortunately, they now have no plans to support the new CDS and CDNSKEY protocols which would be handy for anyone managing a large number of domains. What Fabulous do have, however, is an "Executive Lock" feature, which is an optional additional layer of verification that the domain owner must go through before a domain can be transferred away from his account. They also support U2F, which allows the use of hardware tokens such as Yubikeys. Domain protection features such as these are vital if a registrar does not want to be swamped with jacking attempts and the PR disaster of actually losing domains. I am surprised that Cloudflare has not already followed the fine example of companies such as Dropbox, Github, and Google by supporting U2F. A quick search shows that Cloudflare customers have been publicly asking for this for at least 3 years. When they introduced TOTP 2.5 years ago, they stated that they would support U2F "shortly". In the context of being a domain registrar, supporting U2F would be even more useful, dramatically reducing the number of domain jacking attempts. Proper support would encourage customers to associate TWO hardware tokens with their account, each stored in a different location. Supporting only one, as AWS have recently done, leaves them wide open to social engineering, with impersonators claiming to have lost their one key.
- Boulth 8y ago
  Wow, it's hard to believe they don't support U2F yet. Even smaller providers such as OVH have U2F for a long time.
  - WordSkill 8y ago
    Yeah, very surprising. Perhaps companies lose the ability to get this stuff done as they grow larger. An even more shocking example is Transferwise, supposedly a cutting-edge star of the "fintech" scene. They use SMS-based codes, a wildly insecure form of OTP. Over a thousand employees and they cannot even implement some sort of app-based TOTP (such as Google Authenticator) to protect their clients' money.
    - maxgashkov 8y ago
ngrilly 8y ago
Do you support .io, .eu and .fr?
saagarjha 8y ago
Hmm, this might serve as a great alternative to Google Domains.
mariushn 8y ago
What about email hosting? Gandi includes 5 email accounts with every registration, while most other registrars charge for each account. Email is a basic need.
- strictnein 8y ago
  No. I hope they never offer email hosting. It's distracting, messy work that is already handled well by numerous other companies.
- technion 8y ago
  The POP and IMAP mail services most registrars throw in are services Internet users would be better off without.
- Ayesh 8y ago
  It is a basic need, but they are pretty distinct features. Registrars today sprinkle features such as email hosting, authoratice DNS hosting, email forwarding, SSL certificates (lol, I know), web site builders, etc for more profit. I really hope CloudFlare registrar will be a proper stripped down registrar. They offer you domains for the wholesale price, and it's too much to ask for email hosting.
  - mariushn 8y ago
    Ok, makes sense. I learned about https://opensrs.com/services/hosted-email/ https://opensrs.com/services/hosted-email/ from another thread.
- partiallypro 8y ago
  I wouldn't be surprised of they just offered you referrals to Google Apps and Outlook 365. Email is a mess, no one in their right mind would try to get into that business. I guarantee you there are thousands of email servers out there that some small providers want to kill off but can't because it's legacy and impossible to force customers off.
carapace 8y ago
I've been shy of purchasing a domain name for years ever since I did an availability search on a registrar's site only to discover that the domain had been "reserved" a few milliseconds before my search and would therefore cost more. It was so obviously shady that I just backed away and have been waiting ever since for some other naming system to become viable. Meanwhile, this announcement is a ray of sunshine from behind the Cloudflare. (Sorry for the pun! I coudn't resist.)
- Ayesh 8y ago
  CloudFlare doesn't say they wouldn't do the same (although I believe they won't). I don't really believe when people claim the registrars registered the domains themselves when they typed it in a search box. For example, it costs the registrars around $8 to register a .com, even for themselves. They make $1-2 profit from a purchase, and I would say spending $8 hoping the same user who searched it will be locked in is a risky gamble. Sure, one can out a real human to assess the domain searches and try to lock users in, but it's still a gamble.
  - carapace 8y ago
    It was years ago and I can't remember the details, but I remember I used some registrar's domain-name-availability widget and somehow the name had been "reserved" (not registered) in a way that meant they would change me more money, and I was somehow able to find some other thing that showed the reservation had happened right around the moment I searched. I'm sorry I can't give better details, but I remember clearly the sense of "Now that's pretty fishy..."
dsnuh 8y ago
Will there be an API for the registrar service?
- zackbloom 8y ago
  Yes.
- sahaskatta 8y ago
  I've used OPEN SRS with a good experience in the past. https://opensrs.com/integration/api/ https://opensrs.com/integration/api/
edent 8y ago
Interesting. Wonder if they'll support punycode domains - either for internationalisation or for emoji. I tried to get a .中国 domain, bet fell afoul of the "unique" restrictions that my reseller encountered.
- kijeda 8y ago
  .中国 is the country-code top-level domain for China, and has its own set of country-specific rules that they have devised. Emoji is illegal according to the IETF IDN specification. Some naive clients allow it (i.e. don't follow the standard) but ICANN rules prohibit registries allowing registration of labels that are disallowed by the standard.
  - dcbadacd 8y ago
    If you convert unicode to punycode it's fine? So displaying punycode TLD as unicode is fine as well? If all previous has been true then unicode being displayed as unicode can't be wrong.
  - edent 8y ago
    There are some domains which allow Punycode converted emoji. See https://xn--i-7iq.ws/ https://xn--i-7iq.ws/
convery 8y ago
While I'm sure few of us would have controversial domains, let's remember that Cloudflare have removed the DNS records of sites that they didn't like in the past[0]. [0] - https://blog.cloudflare.com/why-we-terminated-daily-stormer/ https://blog.cloudflare.com/why-we-terminated-daily-stormer/
- Meekro 8y ago
  Very true, but the risk of using them should be weighed against the risk of not using them. Don't forget that pretty much all other registrars were much more eager than Cloudflare to shut down Daily Stormer, and expose you to Zoho-type risk that Cloudflare claims to mitigate.
  - aestetix 8y ago
    Except that Cloudflare terminated Daily Stormer after allowing terrorist groups to operate under the guise of "free speech": https://www.firstpost.com/tech/news-analysis/cloudflare-and-limestone-networks-have-been-securing-terror-group-jaish-e-mohammads-websites-3700375.html https://www.firstpost.com/tech/news-analysis/cloudflare-and-...
    - aestetix 8y ago
      Can anyone explain why they downvoted me instead of just downvoting?
      - Shank 8y ago
        I didn’t, but I can provide some advice since I see this type of comment and nobody really gets advice on this kind of thing. Your comment wasn’t inflammatory — it was factual. However, it only contained a fact, and in that fact, the wording sounded like you were being not only factual, but perhaps a little too stuck to your guns. Controversial comments on HN are generally appreciated as long as they have both commentary and supporting evidence. The commentary part is key. Many of us have read HN for years and are very well aware of these events. Thus, posting about them isn’t news to us — it’s just noise. A new take on it or an interpretation from you is always welcome, but just “spreading the news,” is somewhat the antithesis of Hacker News in the comments.
andreygrehov 8y ago
Security wise, are you on par with MarkMonitor?
- zackbloom 8y ago
  Our Custom Domain Protection is even more secure than MarkMonitor, but the overhead of doing that also makes it almost as expensive. Our at-cost standard domain service includes as much security as we can build into it without a large human component being required (2fa, etc.).
  - r1ch 8y ago
    I've been trying to find a registrar with more-than-normal security without much luck. I want a registrar that will stand up to a sophisticated social engineering attack using leaked documents and personal information etc. The big names like MarkMonitor start at like $50k, mid-range ones like CSC leave me with an uneasy feeling given they do so many things with a clunky web UI and over email. I don't really even know any other options in this space. One option that could scale well with the standard service is allowing customers to upload photo ID / business registration etc and locking down the account so that customer support can never touch anything. Should the customer lose their password / 2FA etc, then they would need to physically go to an office location for ID verification (and a $xxx inconvenience fee). I've had some limited success implementing this system with conventional registrars but I would be more comfortable if it were an actual product offering.
- WordSkill 8y ago
  MarkMonitor supports UF2, Cloudflare does not. U2F allows you to secure your account with hardware tokens, such as Yubikeys. Cloudflare does support "soft 2FA", which is two-factor authentication using apps, which is good, but could be vulnerable if a remote hacker gets hold of your 2FA secret by, for instance, compromising your password manager. If you are keeping it only in the app but lose or break your phone, you will have to go through a verification process to regain access to your account. This process is, itself, a huge target for hackers. For protecting domains that are important to your business - and, indeed, protecting your Cloudflare settings - nothing beats having two hardware tokens associated with your account, each located in a separate, secure location. They are inexpensive, do not need to be recharged, are almost impossible to break, are easily hidden and, if you lose one, you can use the other until your replacement arrives.
jwr 8y ago
I don't care much about the price, but if Cloudflare can operate a domain registrar that doesn't suck, it will be enough for me to move. All domain registrars I tried universally sucked, some less than others, but still.
forapurpose 8y ago
The registration cost for domains is trivial (for most common TLDs): $8/year or $35/year - how much is $27/year worth to you and your company? The primary cost for domains is potential downtime. How much does a day of downtime cost you and your company? I don't want to think about it either. The next most significant cost is labor - your time and your business' delays when dealing with the registrar over service and support issues. Both of these problems are solved with available, responsive, highly effective support. If it goes down, you want to reach someone right away who has the skill to quickly solve the problem and who is empowered to do whatever is necessary to bring it back up. And for lesser issues, quality support means you spend less time solving problems, which not only saves you time and frustration but reduces delays for your work that depends on the problem, and for other people depending on you and people depending on those people. It's the difference between spending days trying to communicate with someone who turns out not to understand the technology anyway, and then you have to figure out a solution yourself and coax them into implementing it, and communicating with someone who answers immediately and says 'I got it', explains the tech to you - and you don't bother to remember it because they already know it. I don't see support, the most important capability of a registrar (besides basic competence) IMHO, mentioned in Cloudflare's announcement. What is the support story? EDIT: Added exposition
- zackbloom 8y ago
  We provide email support to all of our customers. I believe free customers see a response within 8 hours on average (we have teams in SF, Austin, London, and Singapore, to cover every timezone). That 8 hours can become as little as 30 minutes for customers who also subscribe to our Pro or Business plans, or use our Custom Domain Security product.
  - forapurpose 8y ago
    Thanks for the update. For comparison, I pay ~$35/year and get skilled, empowered, responsive phone support within maybe five minutes of calling. I've never needed them to pull off a miracle so I don't know how truly empowered they are.
devtique 8y ago
One of the most pleasant Service switches I’ve made is switching from the Dark UX pattern infested Go Daddy, to the cleaner and more minimal Google Domains. It’s a little more expensive at $12 .com domains but it’s worth it to avoid wading through the sleazy up sell tactics of Go Daddy.
auslander 8y ago
AWS is a Registrar. You create account to use only this and nothing else.
SnowingXIV 8y ago
I have a number of domains with Namecheap and these comments are worrying me. Thinking about moving over but is there an easy way to port all records? Some of domains have multiple txt and mx records associated with them and a bunch of other values that would be a pain to manually rezone.
deleted 8y ago
[deleted]
cpncrunch 8y ago
I would never use Cloudflare. They hide spammers and refuse to do anything about them. The same mass spammer will register site after site for months, sending snowshoe spam, and cloudflare refuses to do anything. At one point this was taking up about 80% of our incoming spam, and most of it was getting through spam filters due to the snowshoeing. You could see the same registration info for hundreds of domains over months, all sending spam, but cloudflare doesn't give a shit. The only solution I found was to put a 15 minute delay on all incoming email from a cloudflare domain, then do a second check of the blacklists. This solved the problem, as the sending ips (not cloudflare) tended to get blacklisted within 15 minutes. In my mind if you're hiding people's websites behind your "cloud", you have a responsibility to kick off the spammers.
- wisepass 8y ago
  Cloudflare only layers http https traffic. Mail it's exposed, no layer by cloudflare.
  - cpncrunch 8y ago
    I'm familiar with that. I'm referring to the hosting of the domains in the From line of the emails, which is what cloudflare is hiding. They're helping the spamvertised domains hide.
- johnklos 8y ago
  How do you have your MTA check if a domain is hosted through Cloudflare, and what blacklists do you use? I think I'd like to do this, too.
  - cpncrunch 8y ago
    Code here: https://pastebin.com/tgS58k6Q https://pastebin.com/tgS58k6Q
    - jlgaddis 8y ago
      Why use a homebrew Perl script for this when Postfix (and likely most other MTAs) has features available that can do this for you? Want to block all mail from any domain name that's hosted by Cloudflare? That's simple enough (and doesn't require taking a shower afterwards, unlike when writing Perl). Just grab the plain-text version of the file that contains the list of Cloudflare's IP address ranges [0], create a CIDR table [1] containing those ranges (followed by a "REJECT"), and add an instance of "check_sender_a_access" to your "smtpd_sender_restrictions" [2]. (Bonus points for taking a couple of minutes to write a shell script that runs once per day from cron, grabs the latest version of this text file, adds " REJECT" to the end of each line for you, and triggers a reload of Postfix if there were any changes to the IP ranges that it needs to know about.) [0]: https://www.cloudflare.com/ips-v4 https://www.cloudflare.com/ips-v4 [1]: http://www.postfix.org/cidr_table.5.html http://www.postfix.org/cidr_table.5.html [2]: http://www.postfix.org/postconf.5.html#smtpd_sender_restrictions http://www.postfix.org/postconf.5.html#smtpd_sender_restrict...
fooey 8y ago
I really wish I could find a good solution for generic wildcard forwarding of email my registrar provides I'd move everything to CloudFlare instantly if I could find a way to get *@mydomain.com for all mess of domains without having to run my own email server or pay a bunch of money per domain.
- coenhyde 8y ago
  You could probably use Mailgun with a routing rule to map *@yourdomain.com to a single email address.
  - zuck9 8y ago
    Is that free? Some domain registrars offer wildcard domain forwarding for free.
- floatboth 8y ago
  https://www.migadu.com https://www.migadu.com has a free plan, and you can set up forwards… maybe you can do that with them
icantdrive55 8y ago
1. Why are they doing this? Is it to create goodwill? It it an advertisement for their servers? I honestly think they know the tech party is about to end, and they want to keep the persistent gold miners, along with their dreams. And yes, when my Google domains are up, I will go to them with my wallet--if their honest price is the same. The real price of a .com domain is finally out, and it's a little over 8 bucks. Privacy should be included.
_JamesA_ 8y ago
This is great. I have used Namecheap as a registrar and Cloudflare as DNS for many years. I just registered for Early Access and was placed in Wave 1 estimated for Mid-October. I happily donated to Girls Who Code anyway.
- partiallypro 8y ago
  I am a customer of Namecheap and Cloudflare too, and though I'm a happy Cloudflare customer, Namecheap has given me no reason to leave. That being said, the company I work for I think I will begin transferring over to Cloudflare as a registrar, simply because we have hundreds of sites already on Cloudflare's NS, and moving them over to Cloudflare is much easier to sell than moving them over to Namecheap, which is something I had pitched but could never justify.
oxplot 8y ago
Still no U2F? C'mon CF, how hard can it be for an org the size of yours.
_jomo 8y ago
I wonder why nobody has mentioned Njalla [0] yet. >We want to keep things simple and we're not trying to compete on price but security. We will never be the cheapest domain name registration service but we'll always be the most privacy centered one You sign up with email or XMPP+OTR, they send mails PGP signed + encrypted (using info from key server or the key you uploaded), they have app based (TOTP) 2FA and they accept various cryptocurrencies. There's no bullshit and so far the support has been quite good. Their DNS (currently) supports: A, AAAA, CAA, CNAME, MX, NS, PTR, SRV, SSHFP, TXT (also "Dynamic" and "Redirect") It's run by some of the Pirate Bay founders and they're still making fun of legal threats. ;) 0: https://njal.la https://njal.la
- dogecoinbase 8y ago
  I like and use Njalla, but you should be aware of what you're getting into: > When you purchase a domain name through Njalla, we own it for you. However, the agreement between us grants you full usage rights to the domain. It's not at all unlikely that they will eventually be shut down very hard. Please do not use them (or, as long as I'm here, any ccTLD, but that's another story) for any serious/long-term purpose.
  - _jomo 8y ago
    Who would shut them down? Is this something the ICANN prohibits? Is ICANN even involved here, as Njalla is (to my knowledge) not an ICANN-accredited registrar? They simply buy the domains from an actual registrar and let you use them.
    - Operyl 8y ago
      I think in the context of that, they were thinking about governments.
      - _jomo 8y ago
        I don't know why buying something and then leasing it to someone else would be an illegal thing to do. I guess they made sure it's not illegal in Nevis, at least.
jtl999 8y ago
Very interesting. I sure hope that when they go live that don't force people to use Cloudflare's nameservers. As I've mentioned before I use Uniregistry and I'm quite happy with them, but at the end of the day, how do you trust your domain register when uncertain things that often have no written policy happen (someone impersonating you to hijack your domains, someone filing bogus abuse/UDRP notices to get your personal information despite using a WHOIS privacy service, etc.) I'd be curious what other users think of the second part.
interfixus 8y ago
For the last ten years+ I've done all my domain-stuff through Dynadot, and all that time I have been mystified that these guys aren't far better known than they appear to be. Prices are decent, comprehensible, and stable. UX is okay. Not spectacular, but absolute useable. Great flexibility with whois records. I have needed support once in those ten years, and that was my own bloody fault for having forgotten which birthday I signed up with. Even so, help was prompt, polite, and efficient. Looked in at the competition from time to time - NameCheap, GoDaddy, whoever - just to see what I might be missing out on. The experience was always sobering and ugly to look at, and every time, I ended up dragging my new domain over to Dynadot.
bad_user 8y ago
Is Cloudflare profitable? I like their service, but given all the freebies that don't generate revenue, I can't help but wonder if they are going to be around for another 5 years before transferring my domains to them.
- krn 8y ago
  > Is Cloudflare profitable? CloudFlare has been profitable since 2014[1]: > CloudFlare has raised more than $72 million in funding, with a $50 million round in 2012, valuing the company at $1 billion. That last slug of equity is still in the bank, says Prince; the company says it just had its first cash-flow-positive quarter with revenue, estimated to be around $40 million by year-end, growing 450% year over year. [1] https://www.forbes.com/sites/kashmirhill/2014/07/30/cloudflare-protection/ https://www.forbes.com/sites/kashmirhill/2014/07/30/cloudfla...
- alecco 8y ago
  It's a way to get more customers for their profitable services.
dannyw 8y ago
How does CloudFlare cover payment processing fees?
- WordSkill 8y ago
  As a big company, they pay their processor(s) far less than you or I pay Stripe or Ayden. For the marketing dynamite of being the only $8.03 "at-cost" registrar, they are going to take a payment processing hit of around ten to fifteen cents per domain. They could shift that cost to the price, but then they would lose those invaluable bragging rights. The point is not that customers save a few cents, but the absolute transparency of paying exactly the registry cost + the ICANN tax. The simple math of $7.85 + 18 cents implicitly suggests that you are dealing with an utterly fair company: not a penny more, not a penny less. $8.03 will gain the attention of the big companies they want to attract in a way that $8.13, $8.18 or $8.20 never could. In this context, $8.03 is actually a far more powerful price than $8. There are plenty of other costs associated with running a registrar, not just payment processing fees, but the whole thing is intended as a loss-leader to attract new users and coax their existing, non-paying users into a paying relationship. From there, with a credit card on file, it becomes far easier to sell them higher-margin services. It will also deepen their relationship with their existing paying users, making it a lot harder for competitors (present or future) to lure them away. When you consider the cost of customer acquisition through normal marketing channels, positioning themselves as the only "at-cost" registrar is a stroke of genius. Reminiscent of Apple disrupting the phone business, Cloudflare have chosen to disrupt a particularly messy, flaky industry that no customer loves. If they manage to pull this off at the $8.03 price, it will catapult Cloudflare to a whole new level.
  - dannyw 8y ago
    This is actually incredible from a standpoint that most people and businesses have a very limited number of domains, making margins of say $2 a year on 5 domains moot.
    - WordSkill 8y ago
      Yeah, it is not about the $10 that the 5-domain company might save, it is about trust, about Cloudflare positioning itself as a fair dealer that is not out to nickel and dime you. Of course, once that relationship has been established, Cloudflare is in prime position to eventually make hundreds or thousands of dollars per year from that company.
floatboth 8y ago
> “I love my domain registrar.” Has anyone ever said this? Yes, pretty much every Hover customer? (Most people don't even care about this, but) they were late with DNSSEC support though, and I transferred to Google Domains because of that, using a VPN because it wasn't officially available in my country. After a couple years, Google Domains told me to GTFO, went back to Hover and now they did have DNSSEC support :)
Molomby 8y ago
This sounds great but i’m surprised more people aren’t recommending AWS as a modern “upsell free” alternative? Their prices are good, can be secured with TFA, solid APIs, etc. That specific part of the management console isn’t amazing but it’s powerful and if you’re using it a lot you should probably automate, right?
znpy 8y ago
Meh. I am mainly using italian company Tophost to register my domains, and domains usually cost cost 5.99€+ vat. And they're still making profit from that. So I kinda call bs on this "no added fees". OTOH, I have to say that Tophost is not the prettiest or the coolest, but so far I had no real issue and the price is low. However, it's nice to see another player joining the game. Regarding the $0.99 domain... Didn't it sound alarming that you pay a domain so little?
- icebraining 8y ago
  From Tophost: "solo 1 euro in più per .com". So it's 6.99€ ~= $8.10; seven cents more than Cloudflare. In any case, the Verisign fee is not hard to confirm; it would be weird for them to lie about it: https://investor.verisign.com/news-releases/news-release-details/verisign-announces-increase-comnet-domain-name-fees-0 https://investor.verisign.com/news-releases/news-release-det...
  - znpy 8y ago
    Indeed, only seven cents more: do you really think Tophost and similar (including Coudflare) are living off those seven cents per domain?
    - icebraining 8y ago
      I think they are living off upsales. I mean, CL already has free plans. Why would an at-cost plan be unbelievable?

527 points by jgrahamc 8y ago

This is awesome! Charging the exact same price as the registry wholesale price. NameSilo, as far as I know, comes very close to the registry pricing and offers DNSSEC, nameserver registration and other APIs with the registry. This could totally throw all registrars out of competition for the price of registry wholesale price. You just have to hope CloudFlare wouldn't overstep their role as a registrar if you only register the domain from them.

nickjj 8y ago
I currently use NameSilo. Don't forget they also offer free whois privacy for life. My only complaint with them is their DNS records are only updated once every 15 minutes. This makes doing automated API based DNS based LE challenges annoying because you need to sleep your script for 15 minutes to ensure the update got pushed. Also, I'm surprised Cloudflare omit talking about whois privacy in the blog post. Makes me wonder if they plan to sell that for some amount of money.
- zackbloom 8y ago
  We actually didn't talk about WHOIS Privacy because it's becoming less and less of a relevant feature in the post-GDPR world. We do support it, free of charge. Cloudflare is also the largest authoritative DNS deployment in the world, and changes propagate in closer to 15 seconds than 15 minutes.
  - nickjj 8y ago
    Thanks for the confirmation. Sounds promising. Do you happen to also offer free email forwarding with registered domains?
    - zackbloom 8y ago
      I don't have the answer to that yet. On the one hand it's a bit far afield of what we normally do. On the other a lot of people seem to get it from their registrar and rely on it. The ideal situation would be if we could find a way to do email forwarding which wasn't just as good as what they do, but was exciting and meaningful. We'll keep thinking about it and let you know on our blog.
      - nickjj 8y ago
        If you want to blow everyone away then I think you should start with giving free real inboxes for everyone (maybe with some sane limit, or a way to pay per month to increase it), and then introduce email forwarding in the future (because I'm sure some people will still want that feature even with real inboxes available). If you GA'd with: ~$8 .com addresses, N real inboxes, free whois guard and a top notch DNS record API. That's a compelling offer and I'd very likely switch from namesilo if that were the case. To be honest, anything less and I'd stay with namesilo because the 15 minute timer can be worked around by using my web host's name servers (digitalocean pushes updates in a few seconds). I couldn't live without either email forwarding or a real inbox.
        zackbloom 8y ago
        When you say real inboxes, are you thinking webmail of some sort? Don't most people prefer to use Google Apps or the like these days?
        JonKF 8y ago
        Most places and projects I've worked in the past 10 years or so have used GSuite or similar for inboxes, and Amazon SES or similar for programatically sending email. Those that didn't (shared-hosted websites on CPanel installations seemingly do still exist in 2018) had access to webmail in the hosting panel or as an installable application.
        8y ago
  - silverwind 8y ago
    Still got to factor in the minimum allowed TTL of 120 seconds, thought. I wish the API would allow less.
  - haboutnnah 8y ago
    Sorry to bother you, but do you offer changing nameservers after registration?
homero 8y ago
Porkbun is also wholesale except they add a few cents
- WordSkill 8y ago
  Not wholesale, Porkbun are adding 10%.

ryanworl 8y ago

Are you planning on exposing a registration and domain search API that can be used to purchase domains and set them up with zones automatically?

LakeAustin 8y ago
Yes, we are planning on releasing those features.

r1ch 8y ago

This sounds great. Hopefully the TLD coverage is extensive, I dislike having my domains split across multiple registrars based on their supported extensions.

LakeAustin 8y ago
We want to help you consolidate those! Full list here for TLDs supported at launch, but we're busy working to add more before then. https://www.cloudflare.com/tld-policies/ https://www.cloudflare.com/tld-policies/
- bpye 8y ago
  Hope you get .uk etc that Nominet are in charge of too, would be happy to use just one registrar.
- WordSkill 8y ago
  I second the request for the .UK TLDs.
  - GordonS 8y ago
    Uh, uk just feels like a scam! I mean, what is the point, other than to extort existing .co.uk owners?
    - WordSkill 8y ago
      I presumed most existing co.uk owners simply moved to the far simpler, more memorable .uk TLD, ditching their old domains along the way. I know I did.
- sofaofthedamned 8y ago
  Gah, you don't have .je domains. I have a charity one there which I have to use gandi.net for and it's driving me nuts...
  - 8y ago

Operyl 8y ago

What are the supported TLDs going to be? I.e. codes, app, ca? WHOIS protection?

LakeAustin 8y ago
We'll support 224 TLDs at launch! Full list here: https://www.cloudflare.com/tld-policies/ https://www.cloudflare.com/tld-policies/ And you'll be able to redact your personal information from Whois with us, too.
- Ayesh 8y ago
  This is a pretty extensive TLD List, specially considering CloudFlare has to directly deal with the registries than being a reseller of some commercial registrar (like enom).
  - profmonocle 8y ago
    Most of them are from Donuts, who have a huge number of TLDs. In fact, looks like the only non-Donuts domains are com, net, org, and info, so only four registries. It's not surprising, dealing with all the various registries (especially for ccTLDs) is probably one of the harder things to scale when spinning up a new registrar. Even Amazon Route53 uses resellers for some TLDs.
- kr4 8y ago
  Couldn't see .IN in the list

johnklos 8y ago

While Cloudflare appears to be doing things that are meant to help everyday people, I can't help but be suspicious. This is an organization that sticks with the "we don't host" bullshit line when web sites serve up Trojans which pretend to be Adobe Flash installers. While there's more subjectivity involved with dealing with hosting the content of spammers, there is zero subjectivity involved with clear and obvious phishing sites. First, anyone with the tiniest modicum of common sense can tell that these pretend Flash sites are absolutely not in the slightest way legitimate content. Second, providing services in any way, shape or form is, in fact, hosting. Providing DNS? It's hosting. Providing a cached version of the site? Hosting. So if they want to be in the business of pretending to be not-hosting, then they have to stop providing services that without which web sites would cease to function. Are they now going to claim that they're not providing meaningful services to domains registered through them, and therefore they should not be responsible for people who are doing illegal things? Probably.

zackbloom 8y ago
I appreciate that these decisions can seem easy, but broadly do you want a private company deciding what can be on the internet, or do you want that decision made by a judge with due process?
- deleted 8y ago
  [deleted]
- daxorid 8y ago
  Matt Prince already decided "what can be on the internet" when he banned Daily Stormer. As far as Cloudflare is concerned, that ship already sailed.
  - jjeaff 8y ago
    That's completely different really. They just stopped proxying their traffic. Daily Stormer could continue on, assuming they pay enough to handle the traffic. Turning off your domain name is a different story. You are sunk until you can regain control of it.

ocdtrekkie 8y ago

I think this is pretty great. Apparently a .com is going to run you only $8.03 right now. I already use Cloudflare for some things, and like to keep my web presence diversified, so I probably won't move my main domains to Cloudflare just to maintain "separation of powers", but there's definitely some "own the other TLDs of these"-type domains that I have which I may hand off to Cloudflare to save money.

r1ch 8y ago

Looks like there's a bug with the wait list, once you sign up don't visit the page again or it registers you again in a later wave! On further investigation it seems to be throwing 502 errors and then saying Wave 8, so maybe it's just a UI bug.

zackbloom 8y ago
We'll track it down, thanks r1ch!

c487bd62 8y ago

Awesome! I hope you don't mind me ranting a bit about custom domains > Custom Domain Protection for Cloudflare Registrar, available on the Enterprise Plan, protects your organization from domain hijacking with exclusively out-of-band verification of any changes to your Registrar account. This is what keeps me locked into Google and other services. I just can't trust my custom domain, if I'm targeted by any semi competent attacker it WILL be hijacked. That you're offering this service only makes my suspicions stronger. I want to use your services but that's a showstopper. It's not your fault, of course, all registrars face the same issues. You need so many different factors to make the process secure it's not even funny, and you said it yourself: "That, obviously, doesn't scale". A few years ago one of my customers domain was stolen by contacting the registrar support (one of the big ones, always recommended around here). They even had a scan of his passport. With so many data leaks, even from your own government, how do you even protect against these kind of things? His life for the next few months were living hell.

zackbloom 8y ago
I'm sorry to hear that, it sounds horrible. We had a very similar situation several years ago which led to the development of our original Registrar. All I can tell you is the 'custom' in Custom Domains refers to the idea that you can set whatever security policy you would like. That includes restricting who can change your domain to a list of people you can count on one hand who each have a personal relationship with you. If you want a policy which requires a photo of you with today's newspaper in it to change a domain, that's probably something which can be arranged. Just to clarify for readers, this is the Custom Domain plan, which is the Enterprise version of the Registrar we are launching today.

ksec 8y ago

I wouldn't have cared much about Domain Name Register just a week ago, but after what happen at Zoho, and all the horror story in the comments section from namecheap and others, Cloudflare Registar couldn't come at a better time. I really wish Cloudflare at least made $1 or $2 Gross Profits per domain. Who paids for Domain Register Support? I would much rather be a "customer" than I am not sure where they are making money from my Domain. P.S - If those were wholesale price, do other companies get heavy discount for signing up in bulks? How do other companies made money when they are selling it for $0.99 or $6.99

jjeaff 8y ago
I don't think there is a bulk discount but prices vary by tld. Base rate for a .com is around $8 plus a small icann fee. If anyone is selling it for .99, they are simply eating the cost in order to earn a long term customer. In this case with cloudflare, I'm sure the point is, like their other products, to offer the free service as a gateway drug to their profitable enterprise products. They have an Enterprise registrar service that is pretty pricey.
rk249 8y ago
I though namecheap was one of the better ones around? I'm looking for a domain registrar. Could share the link with namecheap horror stories? Thanks
- Bluestrike2 8y ago
  I think [0] is the article in question; just search the page for the namecheap comments. 0. https://news.ycombinator.com/item?id=18059792 https://news.ycombinator.com/item?id=18059792
  - zawerf 8y ago
    It seems like it was just a handful of users who posted their story multiple times. The users highclass, ethanwillis, kweks all had multiple comments only about namecheap on a thread that wasn't directly about namecheap. Can I get more horror stories to confirm those are real? It's unfortunate because namecheap used to have the exact opposite reputation: https://news.ycombinator.com/item?id=3396606 https://news.ycombinator.com/item?id=3396606

umbs 8y ago

Anyone here know if Cloudflare plans to let non-customers to transfer their domains to Cloudflare? Especially, if it's a personal domain? I purchased a domain from GoDaddy and host a blog. But they have been up selling and charging me needlessly. I imagine it's a headache for Cloudflare to support personal domains like GoDaddy does, but I really hope they do.

jgrahamc 8y ago
Yes. As soon as we are through the Early Access period.
zackbloom 8y ago
If you add your domain to Cloudflare now you'll get on the waitlist.
scottydelta 8y ago
domains.com is owned by Godaddy AFAIK and they charge you to transfer domains between those two services. I couldn't find a single mention of this fact anywhere on the internet. The only way to confirm is to go to 'Legal' link at the bottom of domains.com(WHOIS is set to private) and it takes you to a page with the domain www.secureserver.net which is owned by GoDaddy.

nodesocket 8y ago

I am excited about this announcement, and look forward to a registar who takes security seriously. > But why should registrars charge any markup over what the TLDs charge? That seemed as nutty to us as certificate authorities charging to run a bit of math. When we see a broken market on the Internet we like to do something about it. That is not a broken market, it's actually free-market economics and business. Charging a markup for a service litterally is how many companies operate. I don't have a problem with it, and because it's a free market it allows CloudFlare to disrupt it.

deleted 8y ago

[deleted]

jpswade 8y ago

Tucows made hover.com to try and solve this exact problem. How does this differ?

WordSkill 8y ago
Price: $8.03 vs $14.99
- awill 8y ago
  All my domains are with Hover. Good customer support, reasonable UI, 2FA. I'm pretty happy with them. Sure, it's a little more expensive, but I actually like the no upsell, stable prices, no coupon codes etc.. Most importantly, there's a number to call. I've never had to call it in my 7 years with them, but I'm glad it's there for emergencies. A domain is so, so important, I don't see "we're a few bucks cheaper" as a selling point.
  - jhall1468 8y ago
    I mean, that's literally the same thing CF is doing here. No upsell, stable prices (at cost) and obviously no coupon codes.
    - awill 8y ago
      Yes. But will they have a number to call? Can they pay support staff if they're selling domains at cost.

JohannesH 8y ago

Do cloudflare want to be registrar for other foreign TLDs in the future? I would love to see them support TLDs such as .dk, .de, .it etc. That way both me and my clients could begin consolidating domain registration in one place, instead of using expensive and shitty domain registration management services. Harder ones, like Tonga (.to) or Greenland (.gl) would be nice to have as well, but I don't think it's feasible (or possible even) to integrate with all countries.

jgrahamc 8y ago
Yes, we do.
- ddorian43 8y ago
  Hell, yeah. Get into hosting next. Destroy the whole internet. It's what the 'competition' deserves.
  - meguest 8y ago
    Is this sarcasm?
    - dogecoinbase 8y ago
      Presumably, but they have a poorly-articulated point -- Cloudflare has an incredible potential for (even unintentional) destructive effect based on their extreme consolidation and centralization of internet technologies. I think a terrific example of this is when they put a DNS server on 1.1.1.1 (in historically unused address space which was assigned to APNIC for research purposes), got a certificate for the IP address, then added that certificate to the Chrome HSTS preload list, meaning people who ended up on captive portals on 1.1.1.1 (and there are a _lot_ of them) couldn't access the internet, because instead of observing what people _actually_ do and paving the cowpaths, they took the point of view that acting against the standards was punishable, and the people being punished are nontechnical folks visiting hotels and airports who are using a modern browser (it has since been removed from the preload list, but if you're foolish enough to visit the site you'll still get HSTS-poisoned). An even better example, of course, is Cloudbleed, but I guess we've all agreed to pretend that never happened?

WordSkill 8y ago

I have used dozens of different registrars over the past two decades and found Fabulous.com to be by far the best on price and technology. Unfortunately, they now have no plans to support the new CDS and CDNSKEY protocols which would be handy for anyone managing a large number of domains. What Fabulous do have, however, is an "Executive Lock" feature, which is an optional additional layer of verification that the domain owner must go through before a domain can be transferred away from his account. They also support U2F, which allows the use of hardware tokens such as Yubikeys. Domain protection features such as these are vital if a registrar does not want to be swamped with jacking attempts and the PR disaster of actually losing domains. I am surprised that Cloudflare has not already followed the fine example of companies such as Dropbox, Github, and Google by supporting U2F. A quick search shows that Cloudflare customers have been publicly asking for this for at least 3 years. When they introduced TOTP 2.5 years ago, they stated that they would support U2F "shortly". In the context of being a domain registrar, supporting U2F would be even more useful, dramatically reducing the number of domain jacking attempts. Proper support would encourage customers to associate TWO hardware tokens with their account, each stored in a different location. Supporting only one, as AWS have recently done, leaves them wide open to social engineering, with impersonators claiming to have lost their one key.

Boulth 8y ago
Wow, it's hard to believe they don't support U2F yet. Even smaller providers such as OVH have U2F for a long time.
- WordSkill 8y ago
  Yeah, very surprising. Perhaps companies lose the ability to get this stuff done as they grow larger. An even more shocking example is Transferwise, supposedly a cutting-edge star of the "fintech" scene. They use SMS-based codes, a wildly insecure form of OTP. Over a thousand employees and they cannot even implement some sort of app-based TOTP (such as Google Authenticator) to protect their clients' money.
  - maxgashkov 8y ago

ngrilly 8y ago

Do you support .io, .eu and .fr?

saagarjha 8y ago

Hmm, this might serve as a great alternative to Google Domains.

mariushn 8y ago

What about email hosting? Gandi includes 5 email accounts with every registration, while most other registrars charge for each account. Email is a basic need.

strictnein 8y ago
No. I hope they never offer email hosting. It's distracting, messy work that is already handled well by numerous other companies.
technion 8y ago
The POP and IMAP mail services most registrars throw in are services Internet users would be better off without.
Ayesh 8y ago
It is a basic need, but they are pretty distinct features. Registrars today sprinkle features such as email hosting, authoratice DNS hosting, email forwarding, SSL certificates (lol, I know), web site builders, etc for more profit. I really hope CloudFlare registrar will be a proper stripped down registrar. They offer you domains for the wholesale price, and it's too much to ask for email hosting.
- mariushn 8y ago
  Ok, makes sense. I learned about https://opensrs.com/services/hosted-email/ https://opensrs.com/services/hosted-email/ from another thread.
partiallypro 8y ago
I wouldn't be surprised of they just offered you referrals to Google Apps and Outlook 365. Email is a mess, no one in their right mind would try to get into that business. I guarantee you there are thousands of email servers out there that some small providers want to kill off but can't because it's legacy and impossible to force customers off.

carapace 8y ago

I've been shy of purchasing a domain name for years ever since I did an availability search on a registrar's site only to discover that the domain had been "reserved" a few milliseconds before my search and would therefore cost more. It was so obviously shady that I just backed away and have been waiting ever since for some other naming system to become viable. Meanwhile, this announcement is a ray of sunshine from behind the Cloudflare. (Sorry for the pun! I coudn't resist.)

Ayesh 8y ago
CloudFlare doesn't say they wouldn't do the same (although I believe they won't). I don't really believe when people claim the registrars registered the domains themselves when they typed it in a search box. For example, it costs the registrars around $8 to register a .com, even for themselves. They make $1-2 profit from a purchase, and I would say spending $8 hoping the same user who searched it will be locked in is a risky gamble. Sure, one can out a real human to assess the domain searches and try to lock users in, but it's still a gamble.
- carapace 8y ago
  It was years ago and I can't remember the details, but I remember I used some registrar's domain-name-availability widget and somehow the name had been "reserved" (not registered) in a way that meant they would change me more money, and I was somehow able to find some other thing that showed the reservation had happened right around the moment I searched. I'm sorry I can't give better details, but I remember clearly the sense of "Now that's pretty fishy..."

dsnuh 8y ago

Will there be an API for the registrar service?

zackbloom 8y ago
Yes.
sahaskatta 8y ago
I've used OPEN SRS with a good experience in the past. https://opensrs.com/integration/api/ https://opensrs.com/integration/api/

edent 8y ago

Interesting. Wonder if they'll support punycode domains - either for internationalisation or for emoji. I tried to get a .中国 domain, bet fell afoul of the "unique" restrictions that my reseller encountered.

kijeda 8y ago
.中国 is the country-code top-level domain for China, and has its own set of country-specific rules that they have devised. Emoji is illegal according to the IETF IDN specification. Some naive clients allow it (i.e. don't follow the standard) but ICANN rules prohibit registries allowing registration of labels that are disallowed by the standard.
- dcbadacd 8y ago
  If you convert unicode to punycode it's fine? So displaying punycode TLD as unicode is fine as well? If all previous has been true then unicode being displayed as unicode can't be wrong.
- edent 8y ago
  There are some domains which allow Punycode converted emoji. See https://xn--i-7iq.ws/ https://xn--i-7iq.ws/

convery 8y ago

While I'm sure few of us would have controversial domains, let's remember that Cloudflare have removed the DNS records of sites that they didn't like in the past[0]. [0] - https://blog.cloudflare.com/why-we-terminated-daily-stormer/ https://blog.cloudflare.com/why-we-terminated-daily-stormer/

Meekro 8y ago
Very true, but the risk of using them should be weighed against the risk of not using them. Don't forget that pretty much all other registrars were much more eager than Cloudflare to shut down Daily Stormer, and expose you to Zoho-type risk that Cloudflare claims to mitigate.
- aestetix 8y ago
  Except that Cloudflare terminated Daily Stormer after allowing terrorist groups to operate under the guise of "free speech": https://www.firstpost.com/tech/news-analysis/cloudflare-and-limestone-networks-have-been-securing-terror-group-jaish-e-mohammads-websites-3700375.html https://www.firstpost.com/tech/news-analysis/cloudflare-and-...
  - aestetix 8y ago
    Can anyone explain why they downvoted me instead of just downvoting?
    - Shank 8y ago
      I didn’t, but I can provide some advice since I see this type of comment and nobody really gets advice on this kind of thing. Your comment wasn’t inflammatory — it was factual. However, it only contained a fact, and in that fact, the wording sounded like you were being not only factual, but perhaps a little too stuck to your guns. Controversial comments on HN are generally appreciated as long as they have both commentary and supporting evidence. The commentary part is key. Many of us have read HN for years and are very well aware of these events. Thus, posting about them isn’t news to us — it’s just noise. A new take on it or an interpretation from you is always welcome, but just “spreading the news,” is somewhat the antithesis of Hacker News in the comments.

andreygrehov 8y ago

Security wise, are you on par with MarkMonitor?

zackbloom 8y ago
Our Custom Domain Protection is even more secure than MarkMonitor, but the overhead of doing that also makes it almost as expensive. Our at-cost standard domain service includes as much security as we can build into it without a large human component being required (2fa, etc.).
- r1ch 8y ago
  I've been trying to find a registrar with more-than-normal security without much luck. I want a registrar that will stand up to a sophisticated social engineering attack using leaked documents and personal information etc. The big names like MarkMonitor start at like $50k, mid-range ones like CSC leave me with an uneasy feeling given they do so many things with a clunky web UI and over email. I don't really even know any other options in this space. One option that could scale well with the standard service is allowing customers to upload photo ID / business registration etc and locking down the account so that customer support can never touch anything. Should the customer lose their password / 2FA etc, then they would need to physically go to an office location for ID verification (and a $xxx inconvenience fee). I've had some limited success implementing this system with conventional registrars but I would be more comfortable if it were an actual product offering.
WordSkill 8y ago
MarkMonitor supports UF2, Cloudflare does not. U2F allows you to secure your account with hardware tokens, such as Yubikeys. Cloudflare does support "soft 2FA", which is two-factor authentication using apps, which is good, but could be vulnerable if a remote hacker gets hold of your 2FA secret by, for instance, compromising your password manager. If you are keeping it only in the app but lose or break your phone, you will have to go through a verification process to regain access to your account. This process is, itself, a huge target for hackers. For protecting domains that are important to your business - and, indeed, protecting your Cloudflare settings - nothing beats having two hardware tokens associated with your account, each located in a separate, secure location. They are inexpensive, do not need to be recharged, are almost impossible to break, are easily hidden and, if you lose one, you can use the other until your replacement arrives.

jwr 8y ago

I don't care much about the price, but if Cloudflare can operate a domain registrar that doesn't suck, it will be enough for me to move. All domain registrars I tried universally sucked, some less than others, but still.

forapurpose 8y ago

The registration cost for domains is trivial (for most common TLDs): $8/year or $35/year - how much is $27/year worth to you and your company? The primary cost for domains is potential downtime. How much does a day of downtime cost you and your company? I don't want to think about it either. The next most significant cost is labor - your time and your business' delays when dealing with the registrar over service and support issues. Both of these problems are solved with available, responsive, highly effective support. If it goes down, you want to reach someone right away who has the skill to quickly solve the problem and who is empowered to do whatever is necessary to bring it back up. And for lesser issues, quality support means you spend less time solving problems, which not only saves you time and frustration but reduces delays for your work that depends on the problem, and for other people depending on you and people depending on those people. It's the difference between spending days trying to communicate with someone who turns out not to understand the technology anyway, and then you have to figure out a solution yourself and coax them into implementing it, and communicating with someone who answers immediately and says 'I got it', explains the tech to you - and you don't bother to remember it because they already know it. I don't see support, the most important capability of a registrar (besides basic competence) IMHO, mentioned in Cloudflare's announcement. What is the support story? EDIT: Added exposition

zackbloom 8y ago
We provide email support to all of our customers. I believe free customers see a response within 8 hours on average (we have teams in SF, Austin, London, and Singapore, to cover every timezone). That 8 hours can become as little as 30 minutes for customers who also subscribe to our Pro or Business plans, or use our Custom Domain Security product.
- forapurpose 8y ago
  Thanks for the update. For comparison, I pay ~$35/year and get skilled, empowered, responsive phone support within maybe five minutes of calling. I've never needed them to pull off a miracle so I don't know how truly empowered they are.

devtique 8y ago

One of the most pleasant Service switches I’ve made is switching from the Dark UX pattern infested Go Daddy, to the cleaner and more minimal Google Domains. It’s a little more expensive at $12 .com domains but it’s worth it to avoid wading through the sleazy up sell tactics of Go Daddy.

auslander 8y ago

AWS is a Registrar. You create account to use only this and nothing else.

SnowingXIV 8y ago

I have a number of domains with Namecheap and these comments are worrying me. Thinking about moving over but is there an easy way to port all records? Some of domains have multiple txt and mx records associated with them and a bunch of other values that would be a pain to manually rezone.

deleted 8y ago

[deleted]

cpncrunch 8y ago

I would never use Cloudflare. They hide spammers and refuse to do anything about them. The same mass spammer will register site after site for months, sending snowshoe spam, and cloudflare refuses to do anything. At one point this was taking up about 80% of our incoming spam, and most of it was getting through spam filters due to the snowshoeing. You could see the same registration info for hundreds of domains over months, all sending spam, but cloudflare doesn't give a shit. The only solution I found was to put a 15 minute delay on all incoming email from a cloudflare domain, then do a second check of the blacklists. This solved the problem, as the sending ips (not cloudflare) tended to get blacklisted within 15 minutes. In my mind if you're hiding people's websites behind your "cloud", you have a responsibility to kick off the spammers.

wisepass 8y ago
Cloudflare only layers http https traffic. Mail it's exposed, no layer by cloudflare.
- cpncrunch 8y ago
  I'm familiar with that. I'm referring to the hosting of the domains in the From line of the emails, which is what cloudflare is hiding. They're helping the spamvertised domains hide.
johnklos 8y ago
How do you have your MTA check if a domain is hosted through Cloudflare, and what blacklists do you use? I think I'd like to do this, too.
- cpncrunch 8y ago
  Code here: https://pastebin.com/tgS58k6Q https://pastebin.com/tgS58k6Q
  - jlgaddis 8y ago
    Why use a homebrew Perl script for this when Postfix (and likely most other MTAs) has features available that can do this for you? Want to block all mail from any domain name that's hosted by Cloudflare? That's simple enough (and doesn't require taking a shower afterwards, unlike when writing Perl). Just grab the plain-text version of the file that contains the list of Cloudflare's IP address ranges [0], create a CIDR table [1] containing those ranges (followed by a "REJECT"), and add an instance of "check_sender_a_access" to your "smtpd_sender_restrictions" [2]. (Bonus points for taking a couple of minutes to write a shell script that runs once per day from cron, grabs the latest version of this text file, adds " REJECT" to the end of each line for you, and triggers a reload of Postfix if there were any changes to the IP ranges that it needs to know about.) [0]: https://www.cloudflare.com/ips-v4 https://www.cloudflare.com/ips-v4 [1]: http://www.postfix.org/cidr_table.5.html http://www.postfix.org/cidr_table.5.html [2]: http://www.postfix.org/postconf.5.html#smtpd_sender_restrictions http://www.postfix.org/postconf.5.html#smtpd_sender_restrict...

fooey 8y ago

I really wish I could find a good solution for generic wildcard forwarding of email my registrar provides I'd move everything to CloudFlare instantly if I could find a way to get *@mydomain.com for all mess of domains without having to run my own email server or pay a bunch of money per domain.

coenhyde 8y ago
You could probably use Mailgun with a routing rule to map *@yourdomain.com to a single email address.
- zuck9 8y ago
  Is that free? Some domain registrars offer wildcard domain forwarding for free.
floatboth 8y ago
https://www.migadu.com https://www.migadu.com has a free plan, and you can set up forwards… maybe you can do that with them

icantdrive55 8y ago

1. Why are they doing this? Is it to create goodwill? It it an advertisement for their servers? I honestly think they know the tech party is about to end, and they want to keep the persistent gold miners, along with their dreams. And yes, when my Google domains are up, I will go to them with my wallet--if their honest price is the same. The real price of a .com domain is finally out, and it's a little over 8 bucks. Privacy should be included.

_JamesA_ 8y ago

This is great. I have used Namecheap as a registrar and Cloudflare as DNS for many years. I just registered for Early Access and was placed in Wave 1 estimated for Mid-October. I happily donated to Girls Who Code anyway.

partiallypro 8y ago
I am a customer of Namecheap and Cloudflare too, and though I'm a happy Cloudflare customer, Namecheap has given me no reason to leave. That being said, the company I work for I think I will begin transferring over to Cloudflare as a registrar, simply because we have hundreds of sites already on Cloudflare's NS, and moving them over to Cloudflare is much easier to sell than moving them over to Namecheap, which is something I had pitched but could never justify.

oxplot 8y ago

Still no U2F? C'mon CF, how hard can it be for an org the size of yours.

_jomo 8y ago

I wonder why nobody has mentioned Njalla [0] yet. >We want to keep things simple and we're not trying to compete on price but security. We will never be the cheapest domain name registration service but we'll always be the most privacy centered one You sign up with email or XMPP+OTR, they send mails PGP signed + encrypted (using info from key server or the key you uploaded), they have app based (TOTP) 2FA and they accept various cryptocurrencies. There's no bullshit and so far the support has been quite good. Their DNS (currently) supports: A, AAAA, CAA, CNAME, MX, NS, PTR, SRV, SSHFP, TXT (also "Dynamic" and "Redirect") It's run by some of the Pirate Bay founders and they're still making fun of legal threats. ;) 0: https://njal.la https://njal.la

dogecoinbase 8y ago
I like and use Njalla, but you should be aware of what you're getting into: > When you purchase a domain name through Njalla, we own it for you. However, the agreement between us grants you full usage rights to the domain. It's not at all unlikely that they will eventually be shut down very hard. Please do not use them (or, as long as I'm here, any ccTLD, but that's another story) for any serious/long-term purpose.
- _jomo 8y ago
  Who would shut them down? Is this something the ICANN prohibits? Is ICANN even involved here, as Njalla is (to my knowledge) not an ICANN-accredited registrar? They simply buy the domains from an actual registrar and let you use them.
  - Operyl 8y ago
    I think in the context of that, they were thinking about governments.
    - _jomo 8y ago
      I don't know why buying something and then leasing it to someone else would be an illegal thing to do. I guess they made sure it's not illegal in Nevis, at least.

jtl999 8y ago

Very interesting. I sure hope that when they go live that don't force people to use Cloudflare's nameservers. As I've mentioned before I use Uniregistry and I'm quite happy with them, but at the end of the day, how do you trust your domain register when uncertain things that often have no written policy happen (someone impersonating you to hijack your domains, someone filing bogus abuse/UDRP notices to get your personal information despite using a WHOIS privacy service, etc.) I'd be curious what other users think of the second part.

interfixus 8y ago

For the last ten years+ I've done all my domain-stuff through Dynadot, and all that time I have been mystified that these guys aren't far better known than they appear to be. Prices are decent, comprehensible, and stable. UX is okay. Not spectacular, but absolute useable. Great flexibility with whois records. I have needed support once in those ten years, and that was my own bloody fault for having forgotten which birthday I signed up with. Even so, help was prompt, polite, and efficient. Looked in at the competition from time to time - NameCheap, GoDaddy, whoever - just to see what I might be missing out on. The experience was always sobering and ugly to look at, and every time, I ended up dragging my new domain over to Dynadot.

bad_user 8y ago

Is Cloudflare profitable? I like their service, but given all the freebies that don't generate revenue, I can't help but wonder if they are going to be around for another 5 years before transferring my domains to them.

krn 8y ago
> Is Cloudflare profitable? CloudFlare has been profitable since 2014[1]: > CloudFlare has raised more than $72 million in funding, with a $50 million round in 2012, valuing the company at $1 billion. That last slug of equity is still in the bank, says Prince; the company says it just had its first cash-flow-positive quarter with revenue, estimated to be around $40 million by year-end, growing 450% year over year. [1] https://www.forbes.com/sites/kashmirhill/2014/07/30/cloudflare-protection/ https://www.forbes.com/sites/kashmirhill/2014/07/30/cloudfla...
alecco 8y ago
It's a way to get more customers for their profitable services.

dannyw 8y ago

How does CloudFlare cover payment processing fees?

WordSkill 8y ago
As a big company, they pay their processor(s) far less than you or I pay Stripe or Ayden. For the marketing dynamite of being the only $8.03 "at-cost" registrar, they are going to take a payment processing hit of around ten to fifteen cents per domain. They could shift that cost to the price, but then they would lose those invaluable bragging rights. The point is not that customers save a few cents, but the absolute transparency of paying exactly the registry cost + the ICANN tax. The simple math of $7.85 + 18 cents implicitly suggests that you are dealing with an utterly fair company: not a penny more, not a penny less. $8.03 will gain the attention of the big companies they want to attract in a way that $8.13, $8.18 or $8.20 never could. In this context, $8.03 is actually a far more powerful price than $8. There are plenty of other costs associated with running a registrar, not just payment processing fees, but the whole thing is intended as a loss-leader to attract new users and coax their existing, non-paying users into a paying relationship. From there, with a credit card on file, it becomes far easier to sell them higher-margin services. It will also deepen their relationship with their existing paying users, making it a lot harder for competitors (present or future) to lure them away. When you consider the cost of customer acquisition through normal marketing channels, positioning themselves as the only "at-cost" registrar is a stroke of genius. Reminiscent of Apple disrupting the phone business, Cloudflare have chosen to disrupt a particularly messy, flaky industry that no customer loves. If they manage to pull this off at the $8.03 price, it will catapult Cloudflare to a whole new level.
- dannyw 8y ago
  This is actually incredible from a standpoint that most people and businesses have a very limited number of domains, making margins of say $2 a year on 5 domains moot.
  - WordSkill 8y ago
    Yeah, it is not about the $10 that the 5-domain company might save, it is about trust, about Cloudflare positioning itself as a fair dealer that is not out to nickel and dime you. Of course, once that relationship has been established, Cloudflare is in prime position to eventually make hundreds or thousands of dollars per year from that company.

floatboth 8y ago

> “I love my domain registrar.” Has anyone ever said this? Yes, pretty much every Hover customer? (Most people don't even care about this, but) they were late with DNSSEC support though, and I transferred to Google Domains because of that, using a VPN because it wasn't officially available in my country. After a couple years, Google Domains told me to GTFO, went back to Hover and now they did have DNSSEC support :)

Molomby 8y ago

This sounds great but i’m surprised more people aren’t recommending AWS as a modern “upsell free” alternative? Their prices are good, can be secured with TFA, solid APIs, etc. That specific part of the management console isn’t amazing but it’s powerful and if you’re using it a lot you should probably automate, right?

znpy 8y ago

Meh. I am mainly using italian company Tophost to register my domains, and domains usually cost cost 5.99€+ vat. And they're still making profit from that. So I kinda call bs on this "no added fees". OTOH, I have to say that Tophost is not the prettiest or the coolest, but so far I had no real issue and the price is low. However, it's nice to see another player joining the game. Regarding the $0.99 domain... Didn't it sound alarming that you pay a domain so little?

icebraining 8y ago
From Tophost: "solo 1 euro in più per .com". So it's 6.99€ ~= $8.10; seven cents more than Cloudflare. In any case, the Verisign fee is not hard to confirm; it would be weird for them to lie about it: https://investor.verisign.com/news-releases/news-release-details/verisign-announces-increase-comnet-domain-name-fees-0 https://investor.verisign.com/news-releases/news-release-det...
- znpy 8y ago
  Indeed, only seven cents more: do you really think Tophost and similar (including Coudflare) are living off those seven cents per domain?
  - icebraining 8y ago
    I think they are living off upsales. I mean, CL already has free plans. Why would an at-cost plan be unbelievable?