1

Let's say I registered a domain on Namecheap and want DigitalOcean to be my host. This can be achieved by first setting the nameservers to DigitalOcean in Namecheap's backend:

Namecheap backend

Second, we add some NS records in DigitalOcean's interface:

DigitalOcean backend

My question: assuming an attacker knows I've set my nameservers to DigitalOcean, what's to stop them from adding my domain to their DigitalOcean account, thus directing users to their servers instead of mine? That is, how does DigitalOcean know that I own my domain, and not someone else?

Note: I've seen this question, but I don't think the accepted answer full addresses how an attacker who know's I've set my nameservers to DO would be thwarted.

|improve this question
  • I'm not sure this is a security question. This looks more like a hosting question. – schroeder♦ Jan 20 '16 at 22:50
  • Isn't it a matter of security if someone could direct unsuspecting victims to the wrong servers? – Marcus McLean Jan 20 '16 at 22:52
  • That's a security impact of a configuration, yes, but the configuration itself is another matter. – schroeder♦ Jan 20 '16 at 22:53
  • Either way, I'm interested in how this configuration is actually secure. – Marcus McLean Jan 20 '16 at 22:55
  • 1
    I feel that this is absolutely security related, as an attacker could manage to hijack a site (by DNS-poisoning the authoritative DNS server for the domain) the way that the OP describes. – mti2935 Jan 21 '16 at 1:31
2

This question, and this exact scenario, actually came up on Serverfault a few months ago. See https://serverfault.com/questions/744147/can-someone-using-the-same-dns-server-as-me-hijack-my-domains

|improve this answer
1

While I am not sure exactly how DigitalOcean handles it, as their code is proprietary, if I were to design a similar system I would only allow the domain to be in the system exactly one time. If someone did try to register it again I would not allow it. However, if the domain is really theirs, they could contact support and prove it. After proving it to support, the old records would be removed and replaced with the appropriate one.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.