23

I have one of those questions that rely on the rule sets for DNS lookup.

Let us say Person A owns the site https://www.example.com. A different person, Person B, not associated with A, attempts to register https://sub.example.com with the local registry. Will the registry allow this? Or is there an implicit understanding that these domain names are linked, and can't be obtained by third parties?

The reason I ask is that my university https://www.sydney.edu.au supposedly sent me a link in an email authored by [email protected] and this link directs me to https://canvas.sydney.edu.au/.

This looks bad to me. But maybe DNS rules only allow https://www.sydney.edu.au to have the associated domain https://canvas.sydney.edu.au.

Otherwise, if any person (e.g. a Bad Person) can register https://badsite.sydney.edu.au and DNS lets it go through... then there is a hole in the DNS world that is made for badness.

Improve this question
4
  • 10
    Strictly speaking you do not register sub-domains, you register the domain and if the registrar permits the registration then you can create DNS records for zero or more sub-domains which can point to resources on your own hosting, third party vendors, content delivery networks etc. It is these DNS records which allow clients (like a browser) to resolve the sub-domain to an IP address, not domain (or subdomain) registration. In a simplistic sense the domain registration provides a means to point the client to the DNS server you nominated for the domain (which need not be your registrar).
    – pwdst
    Sep 17, 2018 at 10:54
  • 8
    Most likely canvas.sydney.edu.au was setup by your university to point to an address owned/controlled by Instructure. This is a fairly common practice among service-providers, similar to how you can sign up for a blogging-service but use your own domain name you acquired elsewhere
    – eques
    Sep 17, 2018 at 14:37
  • 1
    The domain hierarchy does indeed express trust in the way you assumed: example.com is the parent of www.example.com and sub.example.com (and any.sub.example.com) and thus controls these domains or chooses to delegate control freely. The most authoritative entity is the rightmost segment of the domain. Thus, sydney.edu.au, who owns www.sydney.edu.au, also owns canvas.sydney.edu.au.
    – caw
    Sep 17, 2018 at 20:54
  • 1
    Although this isn't directly responsive to the question, it may be useful to know that "canvas" is a suite of learning management system software developed by a company named "Instructure". This explains the reason why you got an email from "Instructure" about a site at your university named "Canvas". I agree that it's a bad practice to use such obscure identifiers in emails during a time when we are trying to get people to pay better attention to signs of phishing
    – Mark Beadles
    Sep 19, 2018 at 15:38

5 Answers 5

Reset to default
29

Welcome to Security!

The case of educational/government intitutions is a particular case of subdomaining. Basically ICANN, who rules the Internet top names, delegated maangement of the .au TLD to Australian government (to make it simply simple). But since .edu and .gov (et similia) are owned by US for historical reasons, Australia, like some other countries, had no choice than to manage its own dedicated Educational subdomain under .au. Other examples are .gov.uk, .gov.it etc. that made similar choices.

If you use whois Linux tool you can find interesting information. I have summarized its output

:~> whois au
% IANA WHOIS server
% for more information on IANA, visit http://www.iana.org
% This query returned 1 object

domain:       AU

organisation: .au Domain Administration (auDA)
address:      Lv 17
address:      1 Collins St
address:      Melbourne VIC 3000
address:      Australia


:~> whois edu.au
Domain Name: EDU.AU
Registry Domain ID: D407400000002449554-AU
Registrar WHOIS Server: whois.auda.ltd
Registrar URL: http://www.afilias.com.au
Last Modified:
Registrar Name: Afilias Australia Pty Ltd

:~> whois sydney.edu.au
Domain Name: SYDNEY.EDU.AU
Registry Domain ID: D407400000000057080-AU
Registrar WHOIS Server: whois.auda.org.au
Registrar URL: https://www.domainname.edu.au
Last Modified: 2018-07-17T00:59:06Z
Registrar Name: EDUCATION SERVICES AUSTRALIA LIMITED

Each subject in the chain is responsible for allowing parties to register subdomains. For example, if your Science department wants to register a subdomain, they must inquire Education Services Australia.

Experiment: try to register usrlocalechelon.edu.au on GoDaddy: they are not allowed to sell you that

Experiment 2: https://www.domainname.edu.au/ offers me to register usrlocalechelon.edu.au for 41 AUD. Looks like too public in my opinion as you may claim yourself to be an educational institution in Australia if you can just pay for a .edu.au domain.

Comment: the site shows a "Eligibility details" step of registration, where probably I won't be able to register an Australian educational domain because I lack authority to register under eu. I haven't bothered trying to push the wizard forward.

Experiment 3 (which answers the security question)

https://www.domainname.edu.au/ does NOT allow me to register usrlocalechelon.sydney.edu.au because

Requires applicant to have national interests and resposibilities or be recognized and delivering services in more than one state or territory

Example domain search

Summarizing

You can never apply for your favourite sub-sub domain at a public registrar, because technical reasons require you to pass through the owner of the level-minus-one domain. DNS is hierarchical.

But if the organization owning your third or fourth level domain (like sydney.edu.au in the example) flaws in filtering domain applications, that is their own organizational problem and is not a flaw in the DNS system.

Improve this answer
4
  • security.stackexchange.com/users/67189/usr-local-ΕΨΗΕΛΩΝ - thank you for this excellent answer. Appreciated.
    – Tony Barry
    Sep 17, 2018 at 10:31
  • 8
    In all likelihood, sydney.edu.au's DNS forward lookup zone is managed directly by University of Sydney's IT department and doesn't have any sort of web interface for requesting subdomains. They would just set up subdomains if/when needed for university reasons.
    – reirab
    Sep 17, 2018 at 10:52
  • 7
    ICANN does not manage the .au TLD, nor any other ccTLD. They don't even "manage" the gTLDs, although they do control the content of the root zone, and the gTLDs must comply with ICANN's policies in order to be listed there.
    – Alnitak
    Sep 17, 2018 at 13:10
  • I must work the phrase "push the wizard forward" into conversation at earliest opportunity.
    – AllInOne
    Sep 18, 2018 at 20:05
31

Short answer: No, third parties can't register a subdomain without authorization from the owner of the domain.

DNS is a hierarchical system, ordered from right to left in the hostname. Whoever has a given domain name registered controls the authoritative name servers for that domain. This means that all queries (that aren't answered from cache) for that domain or one of its subdomains will be directed to that organization's DNS servers, giving them full control over all subdomains. They can, of course, choose to delegate this control to someone else if they wish.

For example, if I were to register reirab.com, if someone queries subdomain.reirab.com (and no cache is involved,) what would happen is this:

Their DNS server would first ask the root servers for the first domain from the right, i.e. com. They would be returned a DNS NS record telling them the authoritative name server for com.

Their DNS server would then submit a request to the com authoritative name server that it discovered from the previous request for reirab.com. It would again get an NS record response telling it the authoritative nameserver for reirab.com.

Their DNS server would now submit a request to reirab.com's authoritative name server for subdomain.reirab.com. Since I would own reirab.com, I would have full control over this authoritative name server. It would either be a server that I myself own or one that is hosted by a third party on my behalf. The only subdomains that could possibly be returned (authoritatively) for this domain are the ones I myself have created records for on that authoritative name server. The only way for someone else to register a subdomain of reirab.com would then be for them to ask me to set it up for them, since I own the authoritative name server for reirab.com and all requests for its subdomains would be funneled through my server.

If I did want to delegate control of some subdomain to someone else, I would do it exactly the same way my registrar delegated control of reirab.com to me: with an NS record. By adding an NS record for subdomain.reirab.com to reirab.com's authoritative name server, I can authoritatively direct requests for subdomain.reirab.com and any of its subdomains to the name server listed in that NS record, which would be controlled by the organization to whom I delegated control of that subdomain. I could revoke this delegation at any time by removing or altering that NS record.

By the way, 'www' is not treated specially by DNS. It's just another host name in its domain's authoritative DNS server. It's only by convention that we put the host (A or AAAA) record for that organization's web server there. The A record for www.exampledomain.com and somethingelse.exampledomain.com both most likely lie on the same server: exampledomain.com's DNS server.

Note: This answer has intentionally simplified things a bit for the case of someone requesting a DNS record from the Internet. If a request for a domain comes from within the domain's organization, the request will likely be resolved directly by the organization's name servers without going up the chain to root-servers.net, the TLD's name servers, etc. In this case, a host name could potentially even resolve to something different than what it would resolve to from the Internet, if the organization so chooses.

Improve this answer
3
  • About www: In the old days it was common to set up mail.example.com, ftp.example.com, maybe gopher.example.com, and www.example.com. Since then all of these (and the DNS server) would reside in the same server, the url example.com (without www) would be honored. Unfortunately, many sites these days are configured not to serve example.com without the www prefix, which I always found annoying.
    – Martin Argerami
    Sep 18, 2018 at 5:03
  • 1
    @MartinArgerami It's still pretty common for mail servers to use something like mail.example.com, smtp.example.com, etc., but, yeah, ftp. and gopher. have fallen largely into disuse (for obvious reasons.) A lot of organizations configure the A record for their domain's root to point to the same address(es) as www. and then configure the web server to listen for both and just have one redirect to the other. That's the way I typically set up domains that have websites.
    – reirab
    Sep 18, 2018 at 5:48
  • 1
    The point is also that CNAME are useful, and you can put a CNAME on www but not at the apex. Hence you have more flexibility in that regard if your website is named www.example.com instead of example.com. At the beginning the name also identified a specific machine, but that is long gone with mass virtual hosting in the web world.
    – Patrick Mevzek
    Jan 4, 2019 at 21:13
19

The DNS registrars only care about the registration of the primary domain, i.e. example.com. They don't care about any sub-domains like www.example.com or www.math.example.com and similar. These are in full control of the organisation which owns the primary domain, which also might decide to delegate control over these domains or some of these domains to other parties.

Note that a primary domain is not necessarily the domain.toplevel but it is domain.publicsuffix where publicsuffix can be things like com but also co.uk. For more information about these see publicsuffix.org.

Improve this answer
8
  • Agreed, but note that registrars can exist at any level. .COM is a TLD, managed by VeriSign, which has a set of registrars. UK.COM is a SLD, registered by a registrar with VeriSign, but UK.COM is itself open to registrations from the registry Centralnic which accredited its own set of registrars to register domain names under UK.COM. All answers mix two different things: the tree nature of the DNS and the NS records that implement zone cut and signal technical boundaries, and the way each level is managed administratively and open or not to further delegations.
    – Patrick Mevzek
    Jan 4, 2019 at 21:05
  • Things are also more complicated because each dot does not necessarily mean a change of delegation. For example gouv.fr is not a delegated zone, it is still managed by the same entity that manages fr. So you can have both foobar.gouv.fr and zorglub.gouv.fr and it both cases you will need to ask the .fr registry to get them (technically, because in practive gouv.fr is reserved for the French government entities). It just shows that not each dot is a delegation.
    – Patrick Mevzek
    Jan 4, 2019 at 21:16
  • @PatrickMevzek: The examples you give are all covered by the public suffix list I've explicitly mentioned in my answer.
    – Steffen Ullrich
    Jan 4, 2019 at 21:30
  • I was commenting on "The DNS registrars only care about the registration of the primary domain" which seems to me misleading, but it all depends on what "primary" means in this case. I was trying to show that you can have registrars for uk.com as you have registrars (but different sets) for com. The PSL lists many things, both suffixes that do not exist anymore, that are closed to registrations or that are used internally by some organization only. This again blurs the important distinction I have tried to make between the way the DNS works technically and administratively.
    – Patrick Mevzek
    Jan 4, 2019 at 21:33
  • @PatrickMevzek: "but it all depends on what "primary" means in this case" - what "primary" means is explained in my second paragraph which points to the public suffix list. At the end the question is what you can get from a public registrar, and this is a primary domain and not some subdomain of a primary domain and not something higher in the hierarchy than a primary domain.
    – Steffen Ullrich
    Jan 4, 2019 at 21:35
2

Will the registry allow this? Or is there an implicit understanding that these domain names are linked, and can't be obtained by third parties?

There is no technical reason they couldn't do this, yet*. DNS records are centrally managed by name servers and records can and do point any which way. The basic text nature of dns records pretty much requires it to be so liberal. In fact, this is why spoofing and man in the middle control of dns servers are a problem.

That said, there are rules that domain name registries follow through contractual obligations. Breaking these rules, i.e. allowing others to register sub-domains on a given domain without permission of the "owner" (leasee) of the domain, would be risking a very lucrative contract with the top level domain holder or ICANN. So the implicit understanding that makes it hard to obtain a subdomain on someone else's domain is simply the financial self-interest of the registrar.

To combat this, other techniques like ssl signing of sites, trusted root certificates, or DNSSEC (DNS security extensions) are important. *DNSSEC is the current plan to fight the vulnerabilities in DNS resolution, through end to end encryption and validation of DNS requests.

Improve this answer
3
  • Also if someone breaks the rules and registers an inappropriate domain, it will only be recognised by the connections that use that DNS server, not the world at large. So it would not work reliably unless you could control your target's network environment.
    – Miral
    Sep 19, 2018 at 6:08
  • I don't think DNSSEC provides end to end encryption? I believe DNSSEC is for signing only?
    – Lie Ryan
    Sep 19, 2018 at 9:54
  • @LieRyan DNSSEC does not encrypt DNS records but attach signatures to them (and deals with keys propagation). If you want DNS encryption you need DoT or DoH that is DNS over TLS and DNS over HTTPS. The transport (UDP/TCP/HTTPS/TLS) and the content (pure DNS or DNS + DNSSEC records) are orthogonal and each thing provide different features (which means DNSSEC is not a replacement for DoH/DoT and same for the opposite).
    – Patrick Mevzek
    Jan 4, 2019 at 21:03
0

I own a domain, let's say "xyz.eu" . This was registered to DNS by a provider, and I pay them an annual fee (€7 for the name and €10 for the cheapest hosting).

With a simple webtool at my hosting provider I can create whatever subdomains I like. Some are predefined: www.xyz.eu, smtp, mail, imap . I don't need permission from anyone and I don't pay anything extra for subdomains. Nobody else can create subdomains under my domain, only through me. The same goes for mailboxes, like [email protected] , only I can create them.

Most data is hosted by my provider, up to 10 GB. With the help of DDNS and some configuration at the provider I can also make a subdomain point to a server in my home, e.g. home.xyz.eu . This server is just a 32 GB flash drive plugged into the router, it could serve large media files.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .