4 ms·

So - there is a solution for this already that is widely adopted and perfect for this use case: https://www.godaddy.com/engineering/2019/04/25/domain-connect/

So - there is a solution for this already that is widely adopted and perfect for this use case: https://www.godaddy.com/engineering/2019/04/25/domain-connect/ https://www.godaddy.com/engineering/2019/04/25/domain-connec... Domain connect allows providers to request fine grained access to domain records, and for customers to allow/disallow those records, for a limited period of time. This not only addresses domain verification but also configuration of complex configurations like spf and max records. It works, and works well, and is supported by all the major domain providers.

starfox64_ 3y ago
I was very excited at discovering this protocol thinking it could solve a few pain points of our domain onboarding process. However the fact that you need to go to every domain provider to get your template manually approved makes this completely useless, what even is the point? This barely adds any security too since I can just use each provider's official API and create whatever records I want this way. It's really sad because the protocol is designed for auto discovery but then does a 180 by having this manual step.
- elliottinvent 3y ago
  If you’re doing more than domain verification, there are a couple of other options you might want to consider [1][2]. Both are run by really good guys that’ll answer any questions you’ve got. https://www.entri.com https://www.entri.com https://www.dnshelper https://www.dnshelper
  - elliottinvent 3y ago
    * https://www.dnshelper.com https://www.dnshelper.com
mynameisvlad 3y ago
> It works, and works well, and is supported by all the major domain providers. Source? The domainconnect.org website certificate is revoked (great sign for trusting it) but it's a standard created by GoDaddy two years ago. I can't imagine "all the major domain providers" all supporting it so quickly. IONOS, one of the providers, only lists four companies supporting this standard as a whole, DNS or service provider: https://www.ionos.com/help/domains/glossary-important-terms-and-topics-explained/domainconnect/ https://www.ionos.com/help/domains/glossary-important-terms-...
- elliottinvent 3y ago
  There is quite broad registrar support, some of the original people behind it at GoDaddy left for other projects and so I think the team have got some things to tidy up. It's been around much longer than a year though. > IONOS, one of the providers, only lists four companies supporting this standard as a whole, DNS or service provider The way Domain Connect works is that the registrars have to "onboard" templates for each service provider that wants to use the protocol. So the registrars get to choose whose templates they want to use. So this could just be a list of the providers IONOS have onboarded. A company doing interesting things with Domain Connect and in this space more broadly is worth a mention: Entri [1] 1. https://www.entri.com/ https://www.entri.com/
elliottinvent 3y ago
Thanks for mentioning this protocol – I've been a fan of Domain Connect [1] for many years and referenced it in one of my earlier comments [2]. Our Record Creator tool [3] integrates with Domain Connect, so if you want to setup a Domain Verification record for a domain with a registrar that's onboarded with Domain Connect, it will simplify the TXT record creation. > Domain connect allows providers to request fine grained access to domain records, and for customers to allow/disallow those records, for a limited period of time. From memory, the async flow enables this but I've not seen permission control available to customers in the way you describe. Can you point me at a screenshot or blog post? As far as I've seen, these parts of the protocol have not been implemented particularly well anywhere. I'd say this is partly because the Async flow is far more complicated than the more basic flow, which most registrars and service providers adopted. > This not only addresses domain verification but also configuration of complex configurations like spf and max records. In my view, simplifying the setup of SPF, MX, A, CNAME records is where Domain Connect really shines. As far as domain verification goes, I would argue that the two solutions are attacking a similar problem (friction for users creating DNS records) but in quite different ways: Domain Connect simplifies the creation of the DNS TXT records that all service providers currently ask you to create. In contrast, the Domain Verification protocol: - Allows you to setup and manage multiple records - Enables permission based access - Enables time-limited access - Most importantly, it reduces the amount of DNS records you have to create since the first one you setup can be used in onboarding with future service providers. - It's far simpler to implement, once email verification is taken care the actual Domain Verification check is five lines of code. > It works, and works well, and is supported by all the major domain providers. You're right that registrar adoption is quite high, which is because it was a GoDaddy and 1&1 (now IONOS) initiative but when I last checked it wasn't implemented at Google, Facebook and many of the others larger providers for domain verification (to be clear: neither is my solution!!!) 1. https://github.com/Domain-Connect/spec/blob/master/Domain%20Connect%20Spec%20Draft.adoc https://github.com/Domain-Connect/spec/blob/master/Domain%20... (http://www.domainconnect.org http://www.domainconnect.org currently failing with cert expiry) 2. https://news.ycombinator.com/item?id=35828772 https://news.ycombinator.com/item?id=35828772 3. https://domainverification.org/create-record https://domainverification.org/create-record

starfox64_ 3y ago

I was very excited at discovering this protocol thinking it could solve a few pain points of our domain onboarding process. However the fact that you need to go to every domain provider to get your template manually approved makes this completely useless, what even is the point? This barely adds any security too since I can just use each provider's official API and create whatever records I want this way. It's really sad because the protocol is designed for auto discovery but then does a 180 by having this manual step.

elliottinvent 3y ago
If you’re doing more than domain verification, there are a couple of other options you might want to consider [1][2]. Both are run by really good guys that’ll answer any questions you’ve got. https://www.entri.com https://www.entri.com https://www.dnshelper https://www.dnshelper
- elliottinvent 3y ago
  * https://www.dnshelper.com https://www.dnshelper.com

mynameisvlad 3y ago

> It works, and works well, and is supported by all the major domain providers. Source? The domainconnect.org website certificate is revoked (great sign for trusting it) but it's a standard created by GoDaddy two years ago. I can't imagine "all the major domain providers" all supporting it so quickly. IONOS, one of the providers, only lists four companies supporting this standard as a whole, DNS or service provider: https://www.ionos.com/help/domains/glossary-important-terms-and-topics-explained/domainconnect/ https://www.ionos.com/help/domains/glossary-important-terms-...

elliottinvent 3y ago
There is quite broad registrar support, some of the original people behind it at GoDaddy left for other projects and so I think the team have got some things to tidy up. It's been around much longer than a year though. > IONOS, one of the providers, only lists four companies supporting this standard as a whole, DNS or service provider The way Domain Connect works is that the registrars have to "onboard" templates for each service provider that wants to use the protocol. So the registrars get to choose whose templates they want to use. So this could just be a list of the providers IONOS have onboarded. A company doing interesting things with Domain Connect and in this space more broadly is worth a mention: Entri [1] 1. https://www.entri.com/ https://www.entri.com/

elliottinvent 3y ago

Thanks for mentioning this protocol – I've been a fan of Domain Connect [1] for many years and referenced it in one of my earlier comments [2]. Our Record Creator tool [3] integrates with Domain Connect, so if you want to setup a Domain Verification record for a domain with a registrar that's onboarded with Domain Connect, it will simplify the TXT record creation. > Domain connect allows providers to request fine grained access to domain records, and for customers to allow/disallow those records, for a limited period of time. From memory, the async flow enables this but I've not seen permission control available to customers in the way you describe. Can you point me at a screenshot or blog post? As far as I've seen, these parts of the protocol have not been implemented particularly well anywhere. I'd say this is partly because the Async flow is far more complicated than the more basic flow, which most registrars and service providers adopted. > This not only addresses domain verification but also configuration of complex configurations like spf and max records. In my view, simplifying the setup of SPF, MX, A, CNAME records is where Domain Connect really shines. As far as domain verification goes, I would argue that the two solutions are attacking a similar problem (friction for users creating DNS records) but in quite different ways: Domain Connect simplifies the creation of the DNS TXT records that all service providers currently ask you to create. In contrast, the Domain Verification protocol: - Allows you to setup and manage multiple records - Enables permission based access - Enables time-limited access - Most importantly, it reduces the amount of DNS records you have to create since the first one you setup can be used in onboarding with future service providers. - It's far simpler to implement, once email verification is taken care the actual Domain Verification check is five lines of code. > It works, and works well, and is supported by all the major domain providers. You're right that registrar adoption is quite high, which is because it was a GoDaddy and 1&1 (now IONOS) initiative but when I last checked it wasn't implemented at Google, Facebook and many of the others larger providers for domain verification (to be clear: neither is my solution!!!) 1. https://github.com/Domain-Connect/spec/blob/master/Domain%20Connect%20Spec%20Draft.adoc https://github.com/Domain-Connect/spec/blob/master/Domain%20... (http://www.domainconnect.org http://www.domainconnect.org currently failing with cert expiry) 2. https://news.ycombinator.com/item?id=35828772 https://news.ycombinator.com/item?id=35828772 3. https://domainverification.org/create-record https://domainverification.org/create-record