3 ms·

Verification link sent to registrant's email address. Change not processed until verification occurs. This is generally the level of diligence (i.e. emailed ve

Verification link sent to registrant's email address. Change not processed until verification occurs. This is generally the level of diligence (i.e. emailed verification link) that registrars are held to. DNS providers should be held to the same when the requesting account isn't the same account that created the 'earlier' zone file for a given domain at the very same provider.

marcosdumay 2y ago
Lots and lots of people don't use their own emails on the DSN information. Maybe we should add a requirement that the zone register sends some notification on behalf of the DNS provider. That could work, at least on the TLD level.
- nickburns 2y ago
  Registrant contact information is maintained by the registrar. The failure of a Registered Name Holder[1] to furnish up-to-date contact information with its Registrar[2] may result in the forfeiture of rights[3] up to and including the suspension or cancellation of the registration itself.[4] Point being that, short of transfer Auth-Codes[5], a verification link sent to the registrant's email address by the DNS provider is the functional equivalent of nearly the most that a registrar may be required to do in order to contact and/or verify a registrant. [1] https://www.icann.org/resources/pages/ra-agreement-2009-05-21-en#1.8 https://www.icann.org/resources/pages/ra-agreement-2009-05-2... [2] https://www.icann.org/resources/pages/ra-agreement-2009-05-21-en#1.9 https://www.icann.org/resources/pages/ra-agreement-2009-05-2... [3] https://www.icann.org/resources/pages/benefits-2013-09-16-en https://www.icann.org/resources/pages/benefits-2013-09-16-en [4] https://www.icann.org/resources/pages/registration-data-accurate-2023-11-02-en https://www.icann.org/resources/pages/registration-data-accu... [5] https://www.icann.org/resources/pages/auth-2013-05-03-en https://www.icann.org/resources/pages/auth-2013-05-03-en
  - marcosdumay 2y ago
    The registar knows the person's email. But the DNS service often does not. So the only way the DNS service can get a notification to the domain owner is if it's forwarded by the registar.
    - nickburns 2y ago
      The registrant's email address is made part of the WHOIS directories, whether obfuscated by a privacy service or not. It's publicly accessible information in accordance with § 1.1(a)(i) and (a)(iv) of ICANN's stated Mission.[1] The DNS provider absolutely can send a notification to the registrant without having to 'go through' (meanining interact with) the registrar. Even a third-party privacy service merely exists as a notification broker. Any notification sent by the DNS provider would simply pass through onto the registrant directly. [1] https://www.icann.org/resources/pages/governance/bylaws-en/#article1 https://www.icann.org/resources/pages/governance/bylaws-en/#...
benlivengood 2y ago
I don't trust email to be secure enough for this; they may still be going out in plaintext. How do you automate DNS nameserver updates if you are migrating hundreds of domains?
- nickburns 2y ago
  Agreed. Two big challenges. But to be clear—we're talking here only about zone file management, not registration transfer (if that's what you mean by migration). In the case of a large-scale, multi-domain authoritative nameservers assignment change, only the DNS provider would be able to facilitate the process programmatically. And at that kind of scale (i.e. hundreds of domains), one would hope verification would not only be obtained through, but require some form of human-to-human contact coupled with thoroughly documented scope.

marcosdumay 2y ago

Lots and lots of people don't use their own emails on the DSN information. Maybe we should add a requirement that the zone register sends some notification on behalf of the DNS provider. That could work, at least on the TLD level.

nickburns 2y ago
Registrant contact information is maintained by the registrar. The failure of a Registered Name Holder[1] to furnish up-to-date contact information with its Registrar[2] may result in the forfeiture of rights[3] up to and including the suspension or cancellation of the registration itself.[4] Point being that, short of transfer Auth-Codes[5], a verification link sent to the registrant's email address by the DNS provider is the functional equivalent of nearly the most that a registrar may be required to do in order to contact and/or verify a registrant. [1] https://www.icann.org/resources/pages/ra-agreement-2009-05-21-en#1.8 https://www.icann.org/resources/pages/ra-agreement-2009-05-2... [2] https://www.icann.org/resources/pages/ra-agreement-2009-05-21-en#1.9 https://www.icann.org/resources/pages/ra-agreement-2009-05-2... [3] https://www.icann.org/resources/pages/benefits-2013-09-16-en https://www.icann.org/resources/pages/benefits-2013-09-16-en [4] https://www.icann.org/resources/pages/registration-data-accurate-2023-11-02-en https://www.icann.org/resources/pages/registration-data-accu... [5] https://www.icann.org/resources/pages/auth-2013-05-03-en https://www.icann.org/resources/pages/auth-2013-05-03-en
- marcosdumay 2y ago
  The registar knows the person's email. But the DNS service often does not. So the only way the DNS service can get a notification to the domain owner is if it's forwarded by the registar.
  - nickburns 2y ago
    The registrant's email address is made part of the WHOIS directories, whether obfuscated by a privacy service or not. It's publicly accessible information in accordance with § 1.1(a)(i) and (a)(iv) of ICANN's stated Mission.[1] The DNS provider absolutely can send a notification to the registrant without having to 'go through' (meanining interact with) the registrar. Even a third-party privacy service merely exists as a notification broker. Any notification sent by the DNS provider would simply pass through onto the registrant directly. [1] https://www.icann.org/resources/pages/governance/bylaws-en/#article1 https://www.icann.org/resources/pages/governance/bylaws-en/#...

benlivengood 2y ago

I don't trust email to be secure enough for this; they may still be going out in plaintext. How do you automate DNS nameserver updates if you are migrating hundreds of domains?

nickburns 2y ago
Agreed. Two big challenges. But to be clear—we're talking here only about zone file management, not registration transfer (if that's what you mean by migration). In the case of a large-scale, multi-domain authoritative nameservers assignment change, only the DNS provider would be able to facilitate the process programmatically. And at that kind of scale (i.e. hundreds of domains), one would hope verification would not only be obtained through, but require some form of human-to-human contact coupled with thoroughly documented scope.