9 ms·
Tell HN: Cloudflare prevents transfer-out of domains, sets to 'pendingdelete'
A recent post that has grained traction this afternoon is about a user who’s account was wrongfully terminated by Cloudflare due to false positives, and his inability to get in touch with support through normal channels. As per usual, the Cloudflare PR spin doctors(who monitor HN for any mention of the company name using a script) quickly turned up in the thread and had the users account restored before they got too much bad press for their mistake.
However, the worst part of this fiasco, was that this thread shed light on a far more terrifying issue regarding CloudFlare. The problem is that allegedly when they terminate your account you are unable to transfer-out your domain names. Allegedly, and perhaps far more insidiously, CloudFlare sets them to “pendingdelete” status. Meaning not only can you not transfer out your domain to another registrar, but the domain will expire after a short period of time and can therefore be sniped by an unscrupulous third party.
This post is a warning to the community: DO NOT transfer any domain name to CloudFlare that is valuable or important to you. Because at any time, your account can be terminated for no reason (“false positives”) and you will not be able to transfer your domain to another registrar. You will probably be unable to get them to reinstate your account so that you can transfer-out your domain through the normal support channels because they totally stonewall you("The suspension is permanent and we will not be making changes on our end."). You would either need take them to court to get your domain name(but by then your domain may already be permanently deleted/expired or sniped by a 3rd party) -OR- make a big stink on HN in order to summon someone with actual authority in the company who can remedy the situation.
Relevant thread: https://news.ycombinator.com/item?id=31573854
- sealeck 4y agoOr read the contract you sign with cloudflare as part of the buying agreement.
- tyingq 4y agoThe contract doesn't invalidate their obligations as a registrar. "All ICANN-accredited registrars are required to allow registrants to transfer domain names to another registrar."
- toomuchtodo 4y agoIf these occurrences are often enough, it puts Cloudflare’s registrar accreditation at risk with ICANN.
- robalfonso 4y agoThe key part of this is “upon request” if you delete their domain beforehand then it gets messy. There is an argument to be made that it shouldn’t have been deleted in the first place. Now as the registrant you have right to redeem the domain so you could recover via that route. So the domain CAN be saved.
- ceejayoz 4y agohttps://www.law.cornell.edu/wex/unconscionability https://www.law.cornell.edu/wex/unconscionability
- my69thaccount 4y agoAnd when you are done reading it, throw it in the trash. Like everything from cloudflare.
- KennyBlanken 4y agoIn the recent thread about arbitration, an attorney said something to the effect of: you cannot possibly hope to keep up with a corporation's army of lawyers, actuaries, and even psychologists writing those agreements. You may not have even originally agreed to said terms, and they were shoved at you in an update which you "can opt out of" by discontinuing your service.
- yjftsjthsd-h 4y ago... and then refuse to do business with them, obviously?
- rtsil 4y ago> but by then your domain may already be permanently deleted/expired or sniped by a 3rd party Or snapped by Cloudflare themselves. > Cloudflare may, at its discretion, elect to assume the registration and may hold it in its own account, delete it, or sell it to a third party. [1] [1] https://www.cloudflare.com/domain-registration-agreement/ https://www.cloudflare.com/domain-registration-agreement/
- gnu8 4y agoWhy wouldn't they pull that as soon as a startup customer becomes successful?
- Aeolun 4y agoThe inevitable fallout? I imagine those steps are something they hope to only ever invoke on clearly illegal enterprises.
- viraptor 4y agoWhy would they? Owning the domain doesn't mean they own a business. They would just kill their own source of income. (And any potential future income from that company)
- zerocrates 4y agoThat specific "we can do whatever" language is only for domains that you didn't renew on time. They have some separate terms that allow similar things, in specified categories of abuse and related stuff.
- cortesoft 4y agoWhy would they ever do that? That isn't going to standup in court, you can't just take over another company with a line in your TOS
- wging 4y agoWhile I don't want to fully defend Cloudflare's customer-hostile practices here, it's worth noting that the text you quote is only for if a domain expires: > In the event that Registrant fails to renew the domain name in a timely fashion, the registration will expire and Cloudflare may, at its discretion, elect to assume the registration and may hold it in its own account, delete it, or sell it to a third party. I mention this because without that context it looks even worse.
- brundolf 4y agoUgh, I just switched things over to Cloudflare a little while ago. But if this ever happened to me it would destroy my digital life, because like the OP all of my emails go through my custom domain. Time to look into Namecheap I guess.
- hamandcheese 4y agoI highly recommend https://www.gandi.net/ https://www.gandi.net/
- RL_Quine 4y agoI recently learned that their whois privacy stuff just doesn't do what it says it does, and all the data was just straight up public. I would have suggested them before but no way in hell should anybody use them.
- smartbit 4y agoDo you have more details?
- RL_Quine 4y agoI registered a domain with whois privacy turned on, the details (phone number, address, name) simply aren't masked and are visible on public tools. I read through all of the documentation and there's no reason for that to have happened, it's not on an exception list and it's not falling afoul of any of their rules. Not a whole lot else to say there, something is really messed up.
- 46Bit 4y agoI previously had this problem - their privacy wasn't working on my .it domain. I talked to them and they fixed it quite quickly
- 4y ago
- pinum 4y agoAlways use a separate, dedicated registrar. Never register a domain with a company you have any other business with.
- teddyh 4y agoWord. I work at a registrar, and even I only use the company for domain name registration, nothing else. I mean, I trust the company, and have complete faith in the quality of the products; It’s just a bad idea to depend on company resources for anything in your personal life.
- mik3y 4y agoYikes if true. I moved several valued domains to Cloudflare registrar precisely because I assumed that they'd be better in "rare but extremely unpleasant" domain-loss scenarios, such as account takeover (by a third party) or account suspension/termination (by them). Contrast with Google domains, where I could never shake a worry that uploading the wrong music in a private YouTube clip could one day randomly cascade to my whole domains account being closed without recourse..
- javajosh 4y agoNamecheap. They do a good job.
- faangiq 4y agoNo. Namecheap sold out years ago.
- CameronNemo 4y agoAnd you can still use Cloudflare, Google, or Amazon for DNS if you so choose.
- stanislavb 4y agoI'd second this approach.
- mandatory 4y agoWould really recommend against them, had some random user report my domains and lost all the domains I had in Namecheap because of it. Their support basically ignored any evidence to the contrary and let my domains expire and be sniped by other buyers.
- javajosh 4y agoI think if you're going to make claims like this you should include supporting evidence.
- ipaddr 4y agoOver the years we've heard stories of bad registrars but never has one locked you out then set the status to pendingdelete and have terms that allow them to take the domain. Anyone who trusts them with a domain better hope for a slow news day on hn when you get flagged by mistake.
- temp8964 4y agoAnother thing I read in the comments under that thread is that there are people here trying to advocate CloudFlare to kick other customers out because disapproval of their politics. This sounds dangerous too. I think this has something to do with what CF did in the past.
- systemvoltage 4y agoCompanies need to stay the hell out of politics. Netflix learned that lesson. It might be tempting to go along with the Zeitgeist but 2 years later, things will flip and you’re going to be caught in the crossfire.
- Spunkie 4y agoCloudflares registrar service is quickly souring years of goodwill I had for the company. Domain ownership/control is basicly the keys to the kingdom for most businesses and cloudflare should recognize that responsibility and fucking shape up. Stop treating your registrar like its some side piece product you can use to lock people into your services.
- causality0 4y agodoctors(who monitor HN for any mention of the company name using a script) quickly turned up in the thread and had the users account restored before they got too much bad press for their mistake This is why it's an enormous red flag when I see anyone doing customer service in the HN comments. You may as well have a neon sign that says "we only give a shit about the customers who can make trouble for us". When I see a founder fixing someone's problem I can be dead certain that when I become the one with the problem I am SOL.
- TIPSIO 4y agoOkay, calling BS on the absurdity of this comment's framing... Have you ever called one of those big webhost with 24/7 support (GoDaddy, NameCheap, ScammyxyzabcdefghijkHost.com)? Their support will have that poor soul on a call for 8 hours and then upsold to 50 business services they didn't need where they were "freaked out" into buying. Cloudflare is trying to liberate domains (or at least technical folk) from all of that nonsense as an at-cost provider. You are not SOL with buying your domain at Cloudflare or using their services.
- lalopalota 4y agoI've called in for support with both GoDaddy and Namecheap. Both resolved my issues while on the phone, quickly, with no attempted upsells.
- mceachen 4y agoI do customer support where ever my users/customers are, so I have (several!) alerts for PhotoStructure. If someone reports a bug or asks a question, whether that be on my forum, my discord, my subreddit, some rando bbs, or HN, I try to jump in and resolve their concern. Not all companies are twirling their mustaches and cackle nefariously. I just want happy users.
- causality0 4y agoMaking an HN submission about a customer service issue is nobody's first course of action. That happens when they believe a company has failed so notably that strangers need to be informed about it.
- deleted 4y ago[deleted]
- seanlane 4y agoFor those looking for registrar options, I've always had good experiences with porkbun.com. I don't have any affiliation with them, just a happy customer for several years now
- wb14123 4y agoAs mentioned in the original thread, this happened to me with Namecheap as well. I ended up just bought the domain from Cloudflare again. I think anyone could do it at that point.
- duskwuff 4y ago> CloudFlare sets them to “pendingdelete” status This isn't an action which a registrar is generally able to perform. Domains naturally transition to the pending delete status at the end of the redemption grace period (i.e. 1 to 2 months after the domain expires, and at least one month after the domain stops resolving).
- robalfonso 4y agoIt sounds like the domain was deleted. that is absolutely an action a registrar can take and you would have a pendingDelete status in addition to a redemptionPeriod status on the domain. If I had to guess they kill an account and delete any of its domains, which is absolutely the wrong way to go about handling that. The domain is already registered so you move it to a holding an account for further resolution. just because you terminated an account you shouldn’t be deleting a domain.
- kadoban 4y agoI strongly suspect that that's not an action a registrar is allowed to perform. Do you have any documentation on what would allow them to do that?
- duskwuff 4y agoIt's technically possible but very uncommon, and using it on an active registration will raise some eyebrows at the registry. I'd almost forgotten it was an option at all. https://datatracker.ietf.org/doc/html/rfc2832#section-4.3.3 https://datatracker.ietf.org/doc/html/rfc2832#section-4.3.3
- robalfonso 4y agoYou linked the wrong doc. You want domain delete https://datatracker.ietf.org/doc/html/rfc5731#section-3.2.2 https://datatracker.ietf.org/doc/html/rfc5731#section-3.2.2
- 4y ago
- rwiggins 4y agoFrankly, the whole "it's fraud-related so we can't tell you anything nor consider your appeal, because otherwise our adversaries(tm) might take advantage of it" has always seemed like a total sham to me. I've always read that as: "it is inconvenient for us to be accountable." Given how quickly OP's situation turned around, I can't help but wonder if an honest, straightforward explanation would sound absurd. Being forced to produce one might even trigger an agent to rethink an appeal, instead of just saying "Nope, it's fraud, goodbye" - sort of a rubber duck thing. One can dream, I guess. I know actually engaging with fraudsters is probably a huge time sink, but... I think that probably should just be the cost of doing business. It's definitely not acceptable to delete domain registrations of suspected fraudsters. With no warning.
- nijave 4y ago"We have a user hostile TOS and more lawyers than you do"
- temp8964 4y agoExactly. It’s basically we are a big corporation we pay for big lawyers so we can f you if we want to.
- josephcsible 4y agoTo really put into perspective how wrong that is, imagine if courts worked that way. "We've found you guilty and sentenced you to death. No, we're not telling you what you were accused of, let alone letting you defend yourself or appeal."
- unknownaccount 4y agoIm not writing this because I want to hurt Cloudflare. Im just explaining my interpretation of the events. Because I wonder about what if it happened to me? I'd be very upset if my domain was snuffed out and I couldnt even appeal. If you have all your businesses accounts and private person email centralized upon your domain, their little "false positive" mistake can utterly wreak havoc on your life. Domains can be the entirety of a person's assets worth tens-hunreds of millions $ USD. It's something they need to be absolutely certain of before they pull the trigger. This is digital assassination.
- josephcsible 4y agoI think it's time for fundamental pieces of Internet infrastructure like registrars to be classified and regulated as utilities. Make it as hard to steal someone's domain at it is to shut off their water.
- unknownaccount 4y agoI want to believe it's not true. If CF makes a post saying this didnt happen then I'll take this down. As of now, this theory leans on ancedotal evidence. I just want to know the true answer to the question: Have users been banned from their CloudFlare accounts over false-positives? and while their account is in this disabled state is it prevented from domain transfering-out?
- xtracto 4y agoDNS is something that would benefit from a real distributed solution . Whether blockchain or based on other sensible technologies, we shouldn't be at the will of unscrupulous companies. It should be 100% distributed like with .bit domains
- throwaway7865 4y agoWow. Thank you. Will move everything out of Cloudflare as soon as possible.
- tinus_hn 4y agoWhy would you even want a party like Cloudflare be holding your domain names? What is the advantage of that?
- oxplot 4y agoFor one, it’s super cheap and if you use other CF services, it’s convenient.
- andyjohnson0 4y agoThis, and the linked thread, is very concerning. I hope that Cloudflare's growth doesn't mean its going down the same route as Google in having hairtrigger automated systems with little or no human oversight or review. I have important personal domains hosted with CF's registrar. I'm now wondering if I need a fallback plan. I hope that @jgc is reading these threads and giving them some attention.
- xxdesmus 4y agoHello, I’m the Head of Trust & Safety at Cloudflare. I wanted to clarify our processes, which were described inaccurately in this Hacker News post. As part of our standard fraud review process, domains determined to be malicious registrations/transfers may be deleted. In those cases, we typically take steps to notify the account holder so that they can contest the determination if appropriate. Cloudflare allows transfers of domains out of Cloudflare’s registrar immediately, unless there are indications of potentially malicious or fraudulent activity. Cloudflare follows the standard industry practice followed by virtually all domain registrars of blocking the transfer out of domains deleted for what appears to be potentially malicious purposes.
- gdfgjhs 4y agoCan you do a post-mortem on what happened there?
- donmcronald 4y ago> Cloudflare follows the standard industry practice followed by virtually all domain registrars of blocking the transfer out of domains deleted for what appears to be potentially malicious purposes. The problem here is the entire process is opaque. Obviously your process can have false positives, so why should anyone trust the "standard industry practice" is being followed for domain deletion? Plus, IMHO "standard industry practice" is a term that gets dragged out to describe subjective policies and measures that can't be quantified or explained easily. > In those cases, we typically take steps to notify the account holder so that they can contest the determination if appropriate. The thing that's problematic here is "typically". Maybe that's just wording to indicate that it's not always possible, but you always make an attempt (?). If so, say that. For me, the frustrating part is that I don't know the rules, so I can't adequately evaluate the risk of being banned. I can't have a contingency plan either because there are no guarantees. If the OP's story is even close to accurate, I think it's safe to say anything can get you banned due to a false positive and that scares me. Even if you feel like you can't make the detection systems transparent, which I can understand, it would make a big difference if people could understand what the process is after an account is flagged. Why should I invest in development that targets Cloudflare's platform if I can be banned on a whim without any communication? Why doesn't my side of the deal get any guarantees? I don't agree with instant blocking of any accounts, even the free ones, but I can understand the free accounts likely create challenges I can't even begin to hypothesize about. That said, I don't think you're seeing the other side when it comes to instant blocking of services. I've dealt in the small business space a lot and the difficulty there is that a tiny, low priority issue for you, like blocking a small account, can be hugely detrimental to a small business. I've dealt with some small family run businesses where they own short domains that would be instantly squatted on upon deletion and the cost of recovering them would be significant in relation to their annual income. Personally, I'd like to have some clear rules and guarantees surrounding account termination. Let me set one or more emergency contacts for my account and give me a clear timeline for attempts to reach out to those contacts before taking action on my account. And I'm not talking about some legalese buried on page 20 of the ToS. Put it in the control panel next to my contacts. If you can't give me any guarantees on a free account, that's fine, just say so up front and tell me what I need to do or pay to get to the point where my service won't be terminated by a robot. I was really, really disappointed to see the OPs situation because I totally bought the mantra of Cloudflare wanting to make the internet a better place and I don't think you're doing that by being another "also ran" in the context of treating your users like they're disposable. Maybe I was just being naïve and overly optimistic because big tech treats everyone so badly that I wanted to believe there was truly someone out their trying to be on the side of the average user / developer. The most disappointing part is that I think Cloudflare's strategy of targeting underserved markets has the potential to pay off more than people realize. I tried out Pages/Functions with a SvelteKit project (+ adapter) a while ago and it's the first time in years that I've actually been excited about something technology related because I can see the potential it has to give small developers a platform to capture the low end of underserved markets without having to worry about massive cost overruns or the complexity of managing infrastructure where time spent comes at the cost of forgoing something else. I have a project I'd like to start building this year and I've been contemplating trying to do everything on Cloudflare. Now I'm thinking I should re-evaluate that idea and build it on DigitalOcean or AWS and use Cloudflare as an intelligent cache that's disposable if needed. Why should I trust Cloudflare any more than I trust the other big tech companies where everyone is at risk of being banned by a robot in an instant?