I have one of those questions that rely on the rule sets for DNS lookup.

Let us say Person A owns the site https://www.example.com. A different person, Person B, not associated with A, attempts to register https://sub.example.com with the local registry. Will the registry allow this? Or is there an implicit understanding that these domain names are linked, and can't be obtained by third parties?

The reason I ask is that my university https://www.sydney.edu.au supposedly sent me a link in an email authored by notifications@instructure.com and this link directs me to https://canvas.sydney.edu.au/.

This looks bad to me. But maybe DNS rules only allow https://www.sydney.edu.au to have the associated domain https://canvas.sydney.edu.au.

Otherwise, if any person (e.g. a Bad Person) can register https://badsite.sydney.edu.au and DNS lets it go through... then there is a hole in the DNS world that is made for badness.

  • 9
    Strictly speaking you do not register sub-domains, you register the domain and if the registrar permits the registration then you can create DNS records for zero or more sub-domains which can point to resources on your own hosting, third party vendors, content delivery networks etc. It is these DNS records which allow clients (like a browser) to resolve the sub-domain to an IP address, not domain (or subdomain) registration. In a simplistic sense the domain registration provides a means to point the client to the DNS server you nominated for the domain (which need not be your registrar). – pwdst Sep 17 at 10:54
  • 7
    Most likely canvas.sydney.edu.au was setup by your university to point to an address owned/controlled by Instructure. This is a fairly common practice among service-providers, similar to how you can sign up for a blogging-service but use your own domain name you acquired elsewhere – eques Sep 17 at 14:37
  • The domain hierarchy does indeed express trust in the way you assumed: example.com is the parent of www.example.com and sub.example.com (and any.sub.example.com) and thus controls these domains or chooses to delegate control freely. The most authoritative entity is the rightmost segment of the domain. Thus, sydney.edu.au, who owns www.sydney.edu.au, also owns canvas.sydney.edu.au. – caw Sep 17 at 20:54
  • Although this isn't directly responsive to the question, it may be useful to know that "canvas" is a suite of learning management system software developed by a company named "Instructure". This explains the reason why you got an email from "Instructure" about a site at your university named "Canvas". I agree that it's a bad practice to use such obscure identifiers in emails during a time when we are trying to get people to pay better attention to signs of phishing – Mark Beadles Sep 19 at 15:38
up vote 27 down vote accepted

Welcome to Security!

The case of educational/government intitutions is a particular case of subdomaining. Basically ICANN, who rules the Internet top names, delegated maangement of the .au TLD to Australian government (to make it simply simple). But since .edu and .gov (et similia) are owned by US for historical reasons, Australia, like some other countries, had no choice than to manage its own dedicated Educational subdomain under .au. Other examples are .gov.uk, .gov.it etc. that made similar choices.

If you use whois Linux tool you can find interesting information. I have summarized its output

:~> whois au
% IANA WHOIS server
% for more information on IANA, visit http://www.iana.org
% This query returned 1 object

domain:       AU

organisation: .au Domain Administration (auDA)
address:      Lv 17
address:      1 Collins St
address:      Melbourne VIC 3000
address:      Australia


:~> whois edu.au
Domain Name: EDU.AU
Registry Domain ID: D407400000002449554-AU
Registrar WHOIS Server: whois.auda.ltd
Registrar URL: http://www.afilias.com.au
Last Modified:
Registrar Name: Afilias Australia Pty Ltd

:~> whois sydney.edu.au
Domain Name: SYDNEY.EDU.AU
Registry Domain ID: D407400000000057080-AU
Registrar WHOIS Server: whois.auda.org.au
Registrar URL: https://www.domainname.edu.au
Last Modified: 2018-07-17T00:59:06Z
Registrar Name: EDUCATION SERVICES AUSTRALIA LIMITED

Each subject in the chain is responsible for allowing parties to register subdomains. For example, if your Science department wants to register a subdomain, they must inquire Education Services Australia.

Experiment: try to register usrlocalechelon.edu.au on GoDaddy: they are not allowed to sell you that

Experiment 2: https://www.domainname.edu.au/ offers me to register usrlocalechelon.edu.au for 41 AUD. Looks like too public in my opinion as you may claim yourself to be an educational institution in Australia if you can just pay for a .edu.au domain.

Comment: the site shows a "Eligibility details" step of registration, where probably I won't be able to register an Australian educational domain because I lack authority to register under eu. I haven't bothered trying to push the wizard forward.

Experiment 3 (which answers the security question)

https://www.domainname.edu.au/ does NOT allow me to register usrlocalechelon.sydney.edu.au because

Requires applicant to have national interests and resposibilities or be recognized and delivering services in more than one state or territory

Example domain search

Summarizing

You can never apply for your favourite sub-sub domain at a public registrar, because technical reasons require you to pass through the owner of the level-minus-one domain. DNS is hierarchical.

But if the organization owning your third or fourth level domain (like sydney.edu.au in the example) flaws in filtering domain applications, that is their own organizational problem and is not a flaw in the DNS system.

  • security.stackexchange.com/users/67189/usr-local-ΕΨΗΕΛΩΝ - thank you for this excellent answer. Appreciated. – Tony Barry Sep 17 at 10:31
  • 8
    In all likelihood, sydney.edu.au's DNS forward lookup zone is managed directly by University of Sydney's IT department and doesn't have any sort of web interface for requesting subdomains. They would just set up subdomains if/when needed for university reasons. – reirab Sep 17 at 10:52
  • 6
    ICANN does not manage the .au TLD, nor any other ccTLD. They don't even "manage" the gTLDs, although they do control the content of the root zone, and the gTLDs must comply with ICANN's policies in order to be listed there. – Alnitak Sep 17 at 13:10
  • I must work the phrase "push the wizard forward" into conversation at earliest opportunity. – AllInOne Sep 18 at 20:05

Short answer: No, third parties can't register a subdomain without authorization from the owner of the domain.


DNS is a hierarchical system, ordered from right to left in the hostname. Whoever has a given domain name registered controls the authoritative name servers for that domain. This means that all queries (that aren't answered from cache) for that domain or one of its subdomains will be directed to that organization's DNS servers, giving them full control over all subdomains. They can, of course, choose to delegate this control to someone else if they wish.

For example, if I were to register reirab.com, if someone queries subdomain.reirab.com (and no cache is involved,) what would happen is this:

Their DNS server would first ask the root servers for the first domain from the right, i.e. com. They would be returned a DNS NS record telling them the authoritative name server for com.

Their DNS server would then submit a request to the com authoritative name server that it discovered from the previous request for reirab.com. It would again get an NS record response telling it the authoritative nameserver for reirab.com.

Their DNS server would now submit a request to reirab.com's authoritative name server for subdomain.reirab.com. Since I would own reirab.com, I would have full control over this authoritative name server. It would either be a server that I myself own or one that is hosted by a third party on my behalf. The only subdomains that could possibly be returned (authoritatively) for this domain are the ones I myself have created records for on that authoritative name server. The only way for someone else to register a subdomain of reirab.com would then be for them to ask me to set it up for them, since I own the authoritative name server for reirab.com and all requests for its subdomains would be funneled through my server.

If I did want to delegate control of some subdomain to someone else, I would do it exactly the same way my registrar delegated control of reirab.com to me: with an NS record. By adding an NS record for subdomain.reirab.com to reirab.com's authoritative name server, I can authoritatively direct requests for subdomain.reirab.com and any of its subdomains to the name server listed in that NS record, which would be controlled by the organization to whom I delegated control of that subdomain. I could revoke this delegation at any time by removing or altering that NS record.

By the way, 'www' is not treated specially by DNS. It's just another host name in its domain's authoritative DNS server. It's only by convention that we put the host (A or AAAA) record for that organization's web server there. The A record for www.exampledomain.com and somethingelse.exampledomain.com both most likely lie on the same server: exampledomain.com's DNS server.


Note: This answer has intentionally simplified things a bit for the case of someone requesting a DNS record from the Internet. If a request for a domain comes from within the domain's organization, the request will likely be resolved directly by the organization's name servers without going up the chain to root-servers.net, the TLD's name servers, etc. In this case, a host name could potentially even resolve to something different than what it would resolve to from the Internet, if the organization so chooses.

  • About www: In the old days it was common to set up mail.example.com, ftp.example.com, maybe gopher.example.com, and www.example.com. Since then all of these (and the DNS server) would reside in the same server, the url example.com (without www) would be honored. Unfortunately, many sites these days are configured not to serve example.com without the www prefix, which I always found annoying. – Martin Argerami Sep 18 at 5:03
  • 1
    @MartinArgerami It's still pretty common for mail servers to use something like mail.example.com, smtp.example.com, etc., but, yeah, ftp. and gopher. have fallen largely into disuse (for obvious reasons.) A lot of organizations configure the A record for their domain's root to point to the same address(es) as www. and then configure the web server to listen for both and just have one redirect to the other. That's the way I typically set up domains that have websites. – reirab Sep 18 at 5:48

The DNS registrars only care about the registration of the primary domain, i.e. example.com. They don't care about any sub-domains like www.example.com or www.math.example.com and similar. These are in full control of the organisation which owns the primary domain, which also might decide to delegate control over these domains or some of these domains to other parties.

Note that a primary domain is not necessarily the domain.toplevel but it is domain.publicsuffix where publicsuffix can be things like com but also co.uk. For more information about these see publicsuffix.org.

Will the registry allow this? Or is there an implicit understanding that these domain names are linked, and can't be obtained by third parties?

There is no technical reason they couldn't do this, yet*. DNS records are centrally managed by name servers and records can and do point any which way. The basic text nature of dns records pretty much requires it to be so liberal. In fact, this is why spoofing and man in the middle control of dns servers are a problem.

That said, there are rules that domain name registries follow through contractual obligations. Breaking these rules, i.e. allowing others to register sub-domains on a given domain without permission of the "owner" (leasee) of the domain, would be risking a very lucrative contract with the top level domain holder or ICANN. So the implicit understanding that makes it hard to obtain a subdomain on someone else's domain is simply the financial self-interest of the registrar.

To combat this, other techniques like ssl signing of sites, trusted root certificates, or DNSSEC (DNS security extensions) are important. *DNSSEC is the current plan to fight the vulnerabilities in DNS resolution, through end to end encryption and validation of DNS requests.

  • Also if someone breaks the rules and registers an inappropriate domain, it will only be recognised by the connections that use that DNS server, not the world at large. So it would not work reliably unless you could control your target's network environment. – Miral Sep 19 at 6:08
  • I don't think DNSSEC provides end to end encryption? I believe DNSSEC is for signing only? – Lie Ryan Sep 19 at 9:54

I own a domain, let's say "xyz.eu" . This was registered to DNS by a provider, and I pay them an annual fee (€7 for the name and €10 for the cheapest hosting).

With a simple webtool at my hosting provider I can create whatever subdomains I like. Some are predefined: www.xyz.eu, smtp, mail, imap . I don't need permission from anyone and I don't pay anything extra for subdomains. Nobody else can create subdomains under my domain, only through me. The same goes for mailboxes, like name@xyz.eu , only I can create them.

Most data is hosted by my provider, up to 10 GB. With the help of DDNS and some configuration at the provider I can also make a subdomain point to a server in my home, e.g. home.xyz.eu . This server is just a 32 GB flash drive plugged into the router, it could serve large media files.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.