12

Say you purchase a domain on Namecheap, but want to host DNS on DigitalOcean.

DigitalOcean, says to simply tell your registrar to use DO's nameservers, then set up your DNS for that domain on DO. However, there doesn't seem to be any verification that the DO account that configures the DNS for that domain is actually the owner of the domain. It could very well be some 3rd party with no relation to the domain owner. Is this assumption correct?

In my mind, it wouldn't even have to be on purpose or malicious. If I register example.com and host DNS through DO, then let the domain expire but neglect to remove the DNS records, what happens when someone else registers the same domain later and decides that they too want to host DNS on DO?

This may very well apply to other hosts (Linode, AWS, etc.) though I'm unfamiliar with how they handle DNS at all.

Improve this question
1
  • I think the asker of this question is up to something... If I own example.com and forwarded the nameservers to ns*.digitalocean.com , then in theory anyone who's on Digital Ocean can add example.com as their domain name... Am I missing something? I'm doing this now and I'm concerned..
    – user60175
    Nov 4, 2014 at 19:18

2 Answers 2

Reset to default
11

If you think about how this scenario is set-up you can see that Digital Ocean aren't really in a position to need to verify the owner of the domain.

It's the domain registrar who will be pointing the DNS server records to Digital Oceans DNS servers and so it's up to them to validate that you have the authority to provide the IP addresses of those DNS servers.

For example if you set-up malicious DNS records on DO for example.com, how do you get the NS records for that domain to point to your malicious set-up? The answer being you'd need to convince the registrar to change the NS records for the domain.

Improve this answer
3
  • 1
    Fair enough. So, the best the registrar can do (in this case) is to simply assume that the domain owner has full control and trust over the nameservers' addresses they provide, and shucks to them if they don't? In the case of a shared third-party (non-registrar) DNS service, there's no existing protocol for ensuring that the account which sets DNS records is acting on behalf of the owners of that domain? It just seems like a glaring (even if not easy-to-exploit) hole in the use of third-party shared nameservers like those provided by DO.
    – devrelm
    Jan 31, 2014 at 1:25
  • well if you think about it it's your domain and you telling the registrar what the DNS server IP addresses are and you chosing the DNS provider to use, so it's reasonable for the Registrar to carry out the provided action. It's like if I tell the postman to leave a package somewhere if I'm not in, it's not his risk decision on whether that was a good place to leave it, he's just carrying out the instructions of the customer. In terms of the protocol for ensuring that the owner is the one setting up the record, yep that'd be the login details for the account with the registrar.
    – Rory McCune
    Jan 31, 2014 at 7:26
  • This doesn't explain to me how DigitalOcean handles a malicious DigitalOcean user could set up records for a domain I own prior to me trying to use that domain, myself. Scenario: I own exmaple.com, registered through registrar.com. Malicious Mary tells DigitalOcean that example.com should point to her app. I then spin up an app on DigitalOcean. I then log into registrar.com to point the name servers at DigitalOcean. I then wish to point example.com at my app, but Malicious Mary has already pointed it at her app. What do?
    – stevendesu
    Sep 21 at 16:22
7

To add to Rory McCune's answer, if you do run into a problem like that, you can probably file a support ticket, prove that you own the domain, and they'd contact the other user, or just delete the zone, so you could take it.

I once spotted an erroneous zone at another VPS provider and contacted them. They didn't explain what steps they took, but it was gone soon.

I suggest you set up the DNS service for a domain before switching the nameservers at your registrar, to verify that no one has set it up previously and to prevent someone else from causing problems for you in the minutes it takes you to finish configuring things. It's a bit paranoid to worry about, though.

Amazon Route 53 is a bit different. They run over 2000 different nameservers on different IPs (with names like ns-1377.awsdns-44.org). Hundreds of people could happily create identical zones without causing any sort of conflict.

Improve this answer
4
  • given Route53 have 4+2=6 different digits in nameservers name there should be a 1/1000000 probability of kind of impersonation when some random folks will be creating hosted zone for my domain and our nameservers coincide. Where am I wrong?
    – Dmytriy Voloshyn
    Nov 24, 2015 at 20:51
  • if someone maliciously created tons of zones for the domains which he doesn't own. When the owner tries to switching the nameservers to AWS route 53, will the registrar point domain to the malicious records?
    – Ryan Lyu
    Jan 14, 2020 at 10:22
  • @DmytriyVoloshyn Route 53 zones have 4 nameservers, chosen randomly-ish from 4 groups of ~509. If you point your domain at 4 Route 53 nameservers without creating a hosted zone, the chance that an attacker could repeatedly try and create a zone overlapping at least 1 is pretty good.
    – Matt Nordhoff
    Nov 25, 2020 at 22:15
  • @RyanLyu The registrar doesn't know what a "malicious" record is. It's the domain owner's responsibility to set the nameservers correctly. (You should create the Route 53 hosted zone first, then set the provided NS records at your registrar.)
    – Matt Nordhoff
    Nov 25, 2020 at 22:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .