4 ms·

From TFA: > There is a frequently updated list published on GitHub called “Can I take over DNS,” which has been documenting exploitability by DNS provider over

• kortilla 2y ago
  Because it’s not an attack. What am I missing here? This doesn’t feel any different than letting your domain expire.
  • throwaway48540 2y ago
    This definitely feels like an attack. One time I forgot to update my name servers after removing the domain from DigitalOcean and some spammer took it over. Another time I wanted to use DigitalOcean with my domain but I can't add it, because someone else has registered it.
    • xmprt 2y ago
      After removing the domain from DigitalOcean did you use the domain anywhere else? It just seems strange to me that you can forget about a domain after explicitly removing that domain from a third party provider.
      • throwaway48540 2y ago
        I have hundreds of domains. I was deleting them from DO by dozens. One slipped through the cracks.
  • nickcw 2y ago
    I think the DNS provider is missing some due diligence. What happens is Alice creates some DNS records for example.com which is registered elsewhere. Everything is fine. At some point (maybe Alice forgets to pay the bill) the DNS records expire. A bit later Bob makes an account at the same DNS provider and makes DNS records for example.com. This is possible because Alice's records have been deleted. Bob has now effectively taken over example.com The due diligence missing is that the provider could have kept a record that the DNS records were owned by Alice. They should have been asking questions (or doing additional validation) when Bob tried to create new ones for example.com.
    • CGamesPlay 2y ago
      My question is, after this point, can Alice reclaim her domain? Is there any way to automate verification of domain name ownership outside without DNS?
      • OccamsMirror 2y ago
        She just needs to change her nameservers at the registrar level.
      • OJFord 2y ago
        She hasn't lost the domain, she's lost the ability to control its DNS at the provider she's currently using (the nameservers she set). So as sibling says it's a case of changing the ns to some other provider, or else I suppose a support case to somehow prove you do own the domain, so please assign control back to your account.
        • jsheard 2y ago
          Well, if the email address you use at the registrar is under the domain the attacker now controls, they can hijack it and potentially escalate to taking over your registrar account as well. Hopefully you have 2FA set up and your registrar enforces it properly.
          • 3np 2y ago
            And, y'know, use a separate domain for admin email.
      • detourdog 2y ago
        DNS is the verification of ownership. Paying your bill and having a receipt is the verification.
        • detourdog 2y ago
          Thinking back more I realize that when I first registered my domain there was no money involved. I remember when ethical discussions of charging for domain names. The justification is that buying the domain name proved ownership. I suppose it was also meant to discourage people piping dict into the registration process. There was a land rush for nouns such as pets.com.
  • handsclean 2y ago
    The difference is whether it can be fixed. An expired domain is hard because we don’t actually know the attacker isn’t legitimate until they misuse the domain. In the case of hosting hijacking, though, the domain still has a legitimate owner, and the hosting provider is giving somebody else access without that owner’s permission. I’d blame the domain owner if they pointed their domain off at some malicious host, but the point here is that it’s hosting providers we consider trusted and legitimate that are doing this, and they can stop doing it, they’re just choosing not to.
• Terretta 2y ago
  GoDaddy and SquareSpace (now that Google's DNS shifted) are notable by not being listed.
  • jorams 2y ago
    That's probably because they won't host your DNS without having the domain registered with them.