6

I'm using duckdns as my free ddns provider. The domain is in the form domain.duckdns.org.

I believe it would be technically possible for them to copy the files my server hosts, redirect "my" domain to their own server and create an SSL certificate for it, since they really own the domain.

This way for example, I could connect to the website, the SSL certificate would be valid, I'd input login and password and they could connect to my ip, input the login and passwords themselves and access the data which should be encrypted. Is this correct?

Is there a good way to defend against it?

Improve this question
1
  • @dave_thompson_085 At the time of writing I did not get this suggestion. Thank you for the link, I've flagged my question as a duplicate.
    – TheHardew
    Jun 21, 2022 at 10:25

2 Answers 2

Reset to default
8

Is there a good way to defend against it?

Unfortunately, there is not much you can do. Even if you acquire your own domain, DNS hosting company (not registrar, but who maintains your DNS zones) can spoof CAA records, pass ACME validation where custom DNS entry is sufficient to prove domain ownership and enroll the certificate.

So either, you trust your DNS hosting provider or not. If you do -- assume that provider doesn't do illegal actions. If you do not -- switch to the provider you trust. And I would keep in mind that if DNS hosting illegal activity is confirmed and revealed to the public -- this can ruin their business, because clients will move out.

Improve this answer
6
  • Thank you, I decided to accept this answer, even if it was posted slightly later than the other one, since you also elaborated on what happens if I do own the domain.
    – TheHardew
    Jun 20, 2022 at 15:46
  • 1
    Can you somehow pin the CA for your DNS name using CAA?
    – Bergi
    Jun 21, 2022 at 2:04
  • 2
    At least you can use certificate transparency (CT) logs to check whether the DNS provider issued a rogue certificate for your domain.
    – Nayuki
    Jun 21, 2022 at 2:53
  • Possibly, a topic for another question (which might already have been asked and answered): how is it possible to become the DNS provider for your own domain? I guess, a public IP and a domain name are a requirement?
    – tpimh
    Jun 21, 2022 at 9:34
  • @CYB3R It's not particularly hard to host your own nameserver. It's fairly annoying though and you really want to have redundancy. I personally host backup nameservers for (some of) my domains myself but keep primaries with a provider since they are just much better at it. Their outages are rarer and shorter and in general they work a lot better than what I can achieve personally on my own hardware. I could in theory host a NS in the cloud or just on hosted HW but that seems a bit self defeating
    – DRF
    Jun 21, 2022 at 9:46
4

As you stated, they are the legitimate owner of the domain, and thus can get a valid certificate for it.

The first step is to use a domain name you control, as the model of trust used the most on the Internet is "Domain validated", that is used to emit certificates. Whoever control the name is assumed to be the legit owner.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .