4 ms·

If you set the nameservers but didn't claim the domain in Cloudflare, then anyone else could claim it and start serving on it. The only real verification that y

If you set the nameservers but didn't claim the domain in Cloudflare, then anyone else could claim it and start serving on it. The only real verification that you own the domain is that the nameservers are pointed to Cloudflare.

leoh 3y ago
That is a serious security issue, then. I could relatively easily check every domain on the net to find domains that use Cloudflare DNS, but do not actually point to any content as a vector to get a free domain. No? Doesn't Cloudflare require you add some kind of special DNS record or host some kind of special webpage to get things rolling?
- oldtownroad 3y ago
  https://developer.mozilla.org/en-US/docs/Web/Security/Subdomain_takeovers https://developer.mozilla.org/en-US/docs/Web/Security/Subdom...
- KomoD 3y ago
  > Doesn't Cloudflare require you add some kind of special DNS record or host some kind of special webpage to get things rolling? No.
- leoh 3y ago
  Also, doesn't Cloudflare require a specific pair of DNS name servers in order to assert that someone "owns" a domain?
  - BandButcher 3y ago
    Yes and no. Idk if they validate you own the domain, i think they just care that your nameservers point to theirs. I recently setup a couple sites in cloudflare and they just asked to set 2 different nameservers on the domain registrar (not namecheap, but spaceship.com). See here: https://developers.cloudflare.com/dns/zone-setups/full-setup/setup/ https://developers.cloudflare.com/dns/zone-setups/full-setup... I had also created my "worker pages" app/project in cloudflare before updating my nameservers in spaceship. But i do have namecheap domains as well and used firebase hosting (google) and they DID ask to have certain TXT records to be added to namecheap and validated before provisioning my ssl cert. I'm assuming every provider is different. But yea i would just undo the CF nameserver until you're ready to go live
  - explain 3y ago
    They do, but the nameserver pairs aren't unique and there aren't that many combinations (2500, apparently). It would be easy enough to automate the creation of accounts until you have an account for every nameserver pair, then start serving on unclaimed domains.
    - kentonv 3y ago
      If the nameservers are already pointing at Cloudflare when you try to set up an account, Cloudflare will ask you to set a different pair of nameservers. I learned this when I was transferring a whole bunch of domains over, and I noticed it kept asking me to use the same nameservers. So I started setting the nameservers in advance of trying to import the domain into Cloudflare, to save a little time. And then... Cloudflare started asking me to use different nameservers, and wouldn't serve content until I did. So even if you create 2500 accounts trying to claim the same domain, I suspect it will never give you the pair that's already configured, and therefore you won't be able to claim it. I also suspect it won't give any two accounts the same nameserver pair. (I'm a Cloudflare employee but my knowledge above is only based on my observations as a user; I don't work on this part of the system. I have no idea what actually happened to OP.)
      - leoh 3y ago
        Right. This would be my hypothesis. Something really bad happened here, imo, and I am really boggled as to why the heck it would happen. It's possible that if you create enough accounts, you'll get one where the pair of nameservers will coincidentally line-up with some domain's nameserver configuration.

leoh 3y ago

That is a serious security issue, then. I could relatively easily check every domain on the net to find domains that use Cloudflare DNS, but do not actually point to any content as a vector to get a free domain. No? Doesn't Cloudflare require you add some kind of special DNS record or host some kind of special webpage to get things rolling?

oldtownroad 3y ago
https://developer.mozilla.org/en-US/docs/Web/Security/Subdomain_takeovers https://developer.mozilla.org/en-US/docs/Web/Security/Subdom...
KomoD 3y ago
> Doesn't Cloudflare require you add some kind of special DNS record or host some kind of special webpage to get things rolling? No.
leoh 3y ago
Also, doesn't Cloudflare require a specific pair of DNS name servers in order to assert that someone "owns" a domain?
- BandButcher 3y ago
  Yes and no. Idk if they validate you own the domain, i think they just care that your nameservers point to theirs. I recently setup a couple sites in cloudflare and they just asked to set 2 different nameservers on the domain registrar (not namecheap, but spaceship.com). See here: https://developers.cloudflare.com/dns/zone-setups/full-setup/setup/ https://developers.cloudflare.com/dns/zone-setups/full-setup... I had also created my "worker pages" app/project in cloudflare before updating my nameservers in spaceship. But i do have namecheap domains as well and used firebase hosting (google) and they DID ask to have certain TXT records to be added to namecheap and validated before provisioning my ssl cert. I'm assuming every provider is different. But yea i would just undo the CF nameserver until you're ready to go live
- explain 3y ago
  They do, but the nameserver pairs aren't unique and there aren't that many combinations (2500, apparently). It would be easy enough to automate the creation of accounts until you have an account for every nameserver pair, then start serving on unclaimed domains.
  - kentonv 3y ago
    If the nameservers are already pointing at Cloudflare when you try to set up an account, Cloudflare will ask you to set a different pair of nameservers. I learned this when I was transferring a whole bunch of domains over, and I noticed it kept asking me to use the same nameservers. So I started setting the nameservers in advance of trying to import the domain into Cloudflare, to save a little time. And then... Cloudflare started asking me to use different nameservers, and wouldn't serve content until I did. So even if you create 2500 accounts trying to claim the same domain, I suspect it will never give you the pair that's already configured, and therefore you won't be able to claim it. I also suspect it won't give any two accounts the same nameserver pair. (I'm a Cloudflare employee but my knowledge above is only based on my observations as a user; I don't work on this part of the system. I have no idea what actually happened to OP.)
    - leoh 3y ago
      Right. This would be my hypothesis. Something really bad happened here, imo, and I am really boggled as to why the heck it would happen. It's possible that if you create enough accounts, you'll get one where the pair of nameservers will coincidentally line-up with some domain's nameserver configuration.