Example: I own the domain example.com.

Instead of using the nameservers set up by default by the registrar, I set up my own nameservers on my own machines with bind9. Let's say that at the beginning, before becoming more experienced with bind9, a few things are misconfigured for a few months. For example allow-transfer settings are not properly configured. (By the way, is it related to DomainStatus: clientTransferProhibited visible in WHOIS or not?)

In this context, can a malicious user gain permanent ownership on the domain?

Or is the ownership of a domain done at a totally different 'layer', and no misconfiguration of a nameserver can be used to take ownership on a domain?


Domain names are registered to your user account on the registrar website. So the only way to get permanent access to a given registered domain is to either:

  • take ownership of the user account (stealing credentials)
  • transferring the domain to another account

Now that second part is usually locked when you create your domain, and you need to take active steps from your registrar account to allow such transfer to happen. allow-transfert is an option to enable DNS server to work with a primary/secondaries setup, not to transfer ownership.

In the end, should the nameserver be compromise, you always can revert the configuration on the registrar to use their own DNS or a new one you've just configured. Of course, if someone has access to your own NS, they can do malicious things with your domain name, such as redirecting users to their own websites.

  • Thank you @M'vy. So, in general, even a very-badly configured nameserver can never compromise the permanent ownership of the domain? At the end I can always revert to the default registrar NS? Is that correct? – g6kxjv1ozn Mar 25 at 11:53
  • More specifically: are there no setting (such as allow-transfer) on the nameserver that would send the information to the TLD registry "Transfer the ownership of the domain permanently"? – g6kxjv1ozn Mar 25 at 11:54
  • That is my understanding yes, but don't rely just on my own answer, get some documentation for yourself as well (especially your registrar's documentation, as these policy can vary between registrars) – M'vy Mar 25 at 11:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.