11

Say you purchase a domain on Namecheap, but want to host DNS on DigitalOcean.

DigitalOcean, says to simply tell your registrar to use DO's nameservers, then set up your DNS for that domain on DO. However, there doesn't seem to be any verification that the DO account that configures the DNS for that domain is actually the owner of the domain. It could very well be some 3rd party with no relation to the domain owner. Is this assumption correct?

In my mind, it wouldn't even have to be on purpose or malicious. If I register example.com and host DNS through DO, then let the domain expire but neglect to remove the DNS records, what happens when someone else registers the same domain later and decides that they too want to host DNS on DO?

This may very well apply to other hosts (Linode, AWS, etc.) though I'm unfamiliar with how they handle DNS at all.

  • I think the asker of this question is up to something... If I own example.com and forwarded the nameservers to ns*.digitalocean.com , then in theory anyone who's on Digital Ocean can add example.com as their domain name... Am I missing something? I'm doing this now and I'm concerned.. – user60175 Nov 4 '14 at 19:18
8

If you think about how this scenario is set-up you can see that Digital Ocean aren't really in a position to need to verify the owner of the domain.

It's the domain registrar who will be pointing the DNS server records to Digital Oceans DNS servers and so it's up to them to validate that you have the authority to provide the IP addresses of those DNS servers.

For example if you set-up malicious DNS records on DO for example.com, how do you get the NS records for that domain to point to your malicious set-up? The answer being you'd need to convince the registrar to change the NS records for the domain.

  • 1
    Fair enough. So, the best the registrar can do (in this case) is to simply assume that the domain owner has full control and trust over the nameservers' addresses they provide, and shucks to them if they don't? In the case of a shared third-party (non-registrar) DNS service, there's no existing protocol for ensuring that the account which sets DNS records is acting on behalf of the owners of that domain? It just seems like a glaring (even if not easy-to-exploit) hole in the use of third-party shared nameservers like those provided by DO. – devrelm Jan 31 '14 at 1:25
  • well if you think about it it's your domain and you telling the registrar what the DNS server IP addresses are and you chosing the DNS provider to use, so it's reasonable for the Registrar to carry out the provided action. It's like if I tell the postman to leave a package somewhere if I'm not in, it's not his risk decision on whether that was a good place to leave it, he's just carrying out the instructions of the customer. In terms of the protocol for ensuring that the owner is the one setting up the record, yep that'd be the login details for the account with the registrar. – Rory McCune Jan 31 '14 at 7:26
4

To add to Rory McCune's answer, if you do run into a problem like that, you can probably file a support ticket, prove that you own the domain, and they'd contact the other user, or just delete the zone, so you could take it.

I once spotted an erroneous zone at another VPS provider and contacted them. They didn't explain what steps they took, but it was gone soon.

I suggest you set up the DNS service for a domain before switching the nameservers at your registrar, to verify that no one has set it up previously and to prevent someone else from causing problems for you in the minutes it takes you to finish configuring things. It's a bit paranoid to worry about, though.

Amazon Route 53 is a bit different. They run 2048 different nameservers on different IPs (with names like ns-1377.awsdns-44.org). Hundreds of people could happily create identical zones without causing any sort of conflict.

  • given Route53 have 4+2=6 different digits in nameservers name there should be a 1/1000000 probability of kind of impersonation when some random folks will be creating hosted zone for my domain and our nameservers coincide. Where am I wrong? – Dmytriy Voloshyn Nov 24 '15 at 20:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.