6 ms·

So GoDaddy is the registrar responsible for the ccTLD, but who is responsible for the 50+ second-level domains? Are those all under GoDaddy's control too? I me

So GoDaddy is the registrar responsible for the ccTLD, but who is responsible for the 50+ second-level domains? Are those all under GoDaddy's control too? I mean, I assume that most people registering a .US domain are not registering it at the top level. Do individual states have no control over how their second-level domains are administered and delegated? Furthermore, there are so many sub-sub-domains under all that. Any one of those could be vulnerable to someone entering unauthorized DNS information and getting a host within the domain without any need to register anything at all.

tuckerman 3y ago
States usually control a top level domain under .gov (e.g there is labor.ca.gov for California’s department of labor). .us on the other hand is freely available for anyone to use (and in my experience is usually quite cheap)
- Dwedit 3y ago
  States being part of .gov is relatively new. There was a very long period where .gov was exclusively for the federal government. The state governments were under the domain (abbreviation of state).us, and everything was a subdomain of that.
  - wavemode 3y ago
    yeah I still remember my grade school website's domain ended in ".k12.<state abbrev>.us" Seems ripe for abuse if such registrations aren't being securely controlled
    - NoZebra120vClip 3y ago
      But you don't get it. No registration is necessary. All an attacker needs is access to the authoritative DNS servers. They can get a delegation or insert their own resource records. Why go through a registry and give up a credit card and personal details?
      - anamexis 3y ago
        I think they're referring to <state>.us registrations
  - tuckerman 3y ago
    I think at this point it’s been allowed for over 20 years but I’m sure there is a mixture still. I was mostly trying to point out that registering under .us is pretty trivial. There is no need to try and sneak something into some states’s dns records, anyone can just go on any registrar and purchase something directly under .us
  - ciabattabread 3y ago
    New York City, a municipal government, used to have its website at www.ci.nyc.ny.us, now it’s at nyc.gov. But NYC still has a bunch of active websites hosted at *.nyc.ny.us.
    - kube-system 3y ago
      NYC also has a TLD of their own. e.g: https://www.archives.nyc/ https://www.archives.nyc/
      - davchana 3y ago
        That's privately controlled, not like .gov. But yes.
ArchOversight 3y ago
> I mean, I assume that most people registering a .US domain are not registering it at the top level. No, 99% of the people are registering at the top-level. It's not like .uk where there is second-level domains that each domain falls under.
- NoZebra120vClip 3y ago
  Well except for k12.xx.us, which used to be standard in every state. Some of these domains are still alive, so there are definitely third- and fourth-level domains available for hijacking and malicious injections.
  - loeg 3y ago
    They might exist, but it is a far cry from “most people registering a .US domain are not registering it at the top level,” which is mistaken.
  - kube-system 3y ago
    These namespaces are controlled differently. You can't just go to godaddy.com and register "phishingdomain.k12.ny.us"
    - NoZebra120vClip 3y ago
      Yes, that's exactly what I mean. The subdomains are administered by the autonomous IT departments and administrators who run their delegated, authoritative name servers. Therefore, they are rather more vulnerable than a centralized registry that has the resources to scrutinize every application for veracity.
      - kube-system 3y ago
        The article is about how GoDaddy doesn't even bother scrutinizing second level registrations. Nobody is bothering to hack local governments to set up phishing domains. It's a lot easier to navigate to godaddy.com with 5 dollars and a fake address to grab a second-level domain.
kube-system 3y ago
In 2002 the .us TLD started allowing others to register second-level domains as they wish, and those types of registrations became the majority that same year. Locality namespacing in .us is mostly a historical thing now. Some still exist, and their management is delegated to other managers other than GoDaddy.
davchana 3y ago
I did get my firstname.us yesterday (for legitimate purposes, maybe a blog post sometime in next decade). One can absolutely register.us at top level. Many institutions like school, counties, departments get countyname.us & then provide sub domains to others. Many in California has switched over to .gov by using .ca.gov at least at state government level.

tuckerman 3y ago

States usually control a top level domain under .gov (e.g there is labor.ca.gov for California’s department of labor). .us on the other hand is freely available for anyone to use (and in my experience is usually quite cheap)

Dwedit 3y ago
States being part of .gov is relatively new. There was a very long period where .gov was exclusively for the federal government. The state governments were under the domain (abbreviation of state).us, and everything was a subdomain of that.
- wavemode 3y ago
  yeah I still remember my grade school website's domain ended in ".k12.<state abbrev>.us" Seems ripe for abuse if such registrations aren't being securely controlled
  - NoZebra120vClip 3y ago
    But you don't get it. No registration is necessary. All an attacker needs is access to the authoritative DNS servers. They can get a delegation or insert their own resource records. Why go through a registry and give up a credit card and personal details?
    - anamexis 3y ago
      I think they're referring to <state>.us registrations
- tuckerman 3y ago
  I think at this point it’s been allowed for over 20 years but I’m sure there is a mixture still. I was mostly trying to point out that registering under .us is pretty trivial. There is no need to try and sneak something into some states’s dns records, anyone can just go on any registrar and purchase something directly under .us
- ciabattabread 3y ago
  New York City, a municipal government, used to have its website at www.ci.nyc.ny.us, now it’s at nyc.gov. But NYC still has a bunch of active websites hosted at *.nyc.ny.us.
  - kube-system 3y ago
    NYC also has a TLD of their own. e.g: https://www.archives.nyc/ https://www.archives.nyc/
    - davchana 3y ago
      That's privately controlled, not like .gov. But yes.

ArchOversight 3y ago

> I mean, I assume that most people registering a .US domain are not registering it at the top level. No, 99% of the people are registering at the top-level. It's not like .uk where there is second-level domains that each domain falls under.

NoZebra120vClip 3y ago
Well except for k12.xx.us, which used to be standard in every state. Some of these domains are still alive, so there are definitely third- and fourth-level domains available for hijacking and malicious injections.
- loeg 3y ago
  They might exist, but it is a far cry from “most people registering a .US domain are not registering it at the top level,” which is mistaken.
- kube-system 3y ago
  These namespaces are controlled differently. You can't just go to godaddy.com and register "phishingdomain.k12.ny.us"
  - NoZebra120vClip 3y ago
    Yes, that's exactly what I mean. The subdomains are administered by the autonomous IT departments and administrators who run their delegated, authoritative name servers. Therefore, they are rather more vulnerable than a centralized registry that has the resources to scrutinize every application for veracity.
    - kube-system 3y ago
      The article is about how GoDaddy doesn't even bother scrutinizing second level registrations. Nobody is bothering to hack local governments to set up phishing domains. It's a lot easier to navigate to godaddy.com with 5 dollars and a fake address to grab a second-level domain.

kube-system 3y ago

In 2002 the .us TLD started allowing others to register second-level domains as they wish, and those types of registrations became the majority that same year. Locality namespacing in .us is mostly a historical thing now. Some still exist, and their management is delegated to other managers other than GoDaddy.

davchana 3y ago

I did get my firstname.us yesterday (for legitimate purposes, maybe a blog post sometime in next decade). One can absolutely register.us at top level. Many institutions like school, counties, departments get countyname.us & then provide sub domains to others. Many in California has switched over to .gov by using .ca.gov at least at state government level.