Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zoho.com CEO says domain with 40M users suspended for abuse complaint

twitter.com

Post reply on HN
Print view View original

41–50 of 279 posts

Re: Zoho.com CEO says domain with 40M users suspended for abuse complaint

#41

Post by daigoba66 »

foo101 wrote: post #25

Honest question: What exactly does it mean for a registrar to block a domain? I believed so far that for my browser to successfully connect to a web server running on a domain or for a mail server to deliver email to a domain, there should only be valid A, AAAA, MX, and/or CNAME records in the DNS. Was it really a block at the registrar level or was it a block at the DNS level, i.e., the registrar also ran DNS servic…

The registrar maintains the records that specify which nameservers, i.e. DNS servers, will resolve names for that domain. The registrar simply changes that record to point to nameservers that they operate, and with DNS entries that “take it offline”.

Re: Zoho.com CEO says domain with 40M users suspended for abuse complaint

#42

Post by souterrain »

jjeaff wrote: post #18
ttul wrote: post #8

This is a fireable offence for the CEO. There is no excuse for this level of incompetence. Makes me question all sorts of things now about Zoho. What else is run like a shit show over there?

How many CEOs do you know that would have any clue who their domain registrar is? How many would know what a domain registrar is?

For a SaaS company, a domain registrar is part of the critical supply chain; if it fails, it creates an existential crisis to the business.

I think that warrants CEO visibility.

Re: Zoho.com CEO says domain with 40M users suspended for abuse complaint

#43

Post by avens19 »

foo101 wrote: post #25

Honest question: What exactly does it mean for a registrar to block a domain? I believed so far that for my browser to successfully connect to a web server running on a domain or for a mail server to deliver email to a domain, there should only be valid A, AAAA, MX, and/or CNAME records in the DNS. Was it really a block at the registrar level or was it a block at the DNS level, i.e., the registrar also ran DNS servic…

I assume the registrar was also the nameserver in this case

Re: Zoho.com CEO says domain with 40M users suspended for abuse complaint

#45

Post by tlamponi »

svembu1 wrote: post #5

Zoho CEO here. Our domain was abruptly blocked by our registrar this morning. Our NOC team and myself tried to get in touch with them and they tell us "Contact our legal". Even I could not get in touch with anyone beyond their phone operator. The domain was restored, but as DNS takes time to restore, we are still facing issues. They later claimed there were abuse complaints about Zoho.com emails (which is our persona…

Just FYI, I'm one of the maintainers of a mid-size forum regarding opensource virtualization/containers and thus spam is a daily occurrence.

While the fight against it is rather dire and no end will ever be in sight, I'll nonetheless never stop (tool assisted) fighting.

Anyway, @zoho.com addresses used by spammers started to pop up circa a month ago and increased rapidly in occurrence. As we use stopforumspam to report and track spammer info (and surely are not the single forum seeing those @zoho.com domains) you may got a few flags raised somewhere.

Not sure what caused this sudden (from our POV) attraction of spammers using zoho, you may want to look into some defense against this. While a full solution may not be achievable it's often enough to be faster than other providers, aka the tiger defense ;-)

Re: Zoho.com CEO says domain with 40M users suspended for abuse complaint

#46

Post by toast0 »

foo101 wrote: post #25

Honest question: What exactly does it mean for a registrar to block a domain? I believed so far that for my browser to successfully connect to a web server running on a domain or for a mail server to deliver email to a domain, there should only be valid A, AAAA, MX, and/or CNAME records in the DNS. Was it really a block at the registrar level or was it a block at the DNS level, i.e., the registrar also ran DNS servic…

I'm not seeing a block at the moment. I did find a whois history page that claims their NS records in January, 2018 are the same as what I'm seeing now:

    ns1.vtitan.com
    pdns90.ultradns.net
    pdns90.ultradns.com
    dns1.p03.nsone.net
    dns2.p03.nsone.net
    nds3.p03.nsone.net
Those don't appear to be connected to the registrar (tierra.net); most likely the NS records were removed or replaced with servers that direct all queries to a parking page for abusive domains. The TLD servers for com. return a 2 day TTL for all glue records, and their SOA record indicates a 1 day negative TTL.

(Of course, some caching resolvers ignore TTLs :( )

Re: Zoho.com CEO says domain with 40M users suspended for abuse complaint

#47

Post by dsp1234 »

foo101 wrote: post #25

Honest question: What exactly does it mean for a registrar to block a domain? I believed so far that for my browser to successfully connect to a web server running on a domain or for a mail server to deliver email to a domain, there should only be valid A, AAAA, MX, and/or CNAME records in the DNS. Was it really a block at the registrar level or was it a block at the DNS level, i.e., the registrar also ran DNS servic…

There are several layers where a registrar has control over DNS resolution.

Terms:

ICANN: The organization responsible for coordinating the maintenance of the domain name system (among other things).

Registrar: A company authorized to update ICANN database on behalf of registrants. Google, GoDadddy, Enom, etc are registrars

Registrants: An entity that wants to register a domain name. In this case, Zoho is a registrant, but it could also be an individual. This is your role if you 'own' a domain.

Authoritative Name Server: A domain name server that is considered authoritative for a specific domain.

Stuff registrars can do (among other things):

1.) They can update the ICANN database to disable a domain completely[1]

2.) They can replace your authoritative name servers with their own or someone else's (ex: botnet domains being reassigned to a security company for dismantling via court order)[2]

3.) If the authoritative name servers for a domain are owned by the registrar, then the registrar can merely change the DNS entries themselves to point to something other than the domain owner's wishes.

[0] - https://en.wikipedia.org/wiki/ICANN

[1] - https://www.icann.org/resources/pages/epp-status-codes-2014-...

[2] - https://www.icann.org/en/system/files/files/guidance-domain-...

Re: Zoho.com CEO says domain with 40M users suspended for abuse complaint

#48

Post by _asummers »

sitepodmatt wrote: post #37
svembu1 wrote: post #5

Zoho CEO here. Our domain was abruptly blocked by our registrar this morning. Our NOC team and myself tried to get in touch with them and they tell us "Contact our legal". Even I could not get in touch with anyone beyond their phone operator. The domain was restored, but as DNS takes time to restore, we are still facing issues. They later claimed there were abuse complaints about Zoho.com emails (which is our persona…

Ironic isn't it. You ignored your paid subscriber in 2014, didn't respond to any @ tweets, your phone support went to voicemail, your forum threads were closed with no response. Karma is a bitch isn't it

I tried to become a customer a few years ago, but could not get access to their services despite two weeks of back and forth with support. I simply gave up and assumed it representative of what was to come later.

Re: Zoho.com CEO says domain with 40M users suspended for abuse complaint

#49

Post by chrsstrm »

avens19 wrote: post #43
foo101 wrote: post #25

Honest question: What exactly does it mean for a registrar to block a domain? I believed so far that for my browser to successfully connect to a web server running on a domain or for a mail server to deliver email to a domain, there should only be valid A, AAAA, MX, and/or CNAME records in the DNS. Was it really a block at the registrar level or was it a block at the DNS level, i.e., the registrar also ran DNS servic…

I assume the registrar was also the nameserver in this case

Am I seeing things or is dig really telling me their NS records pointed to vtitan.com? Who the hell is vtitan? Route53 with AWS would run them what, $100 a month for their level of traffic?

Re: Zoho.com CEO says domain with 40M users suspended for abuse complaint

#50

Post by huac »

chrsstrm wrote: post #49
avens19 wrote: post #43

Earlier quoted context omitted.

I assume the registrar was also the nameserver in this case

Am I seeing things or is dig really telling me their NS records pointed to vtitan.com? Who the hell is vtitan? Route53 with AWS would run them what, $100 a month for their level of traffic?

> vTitan, an international company with offices in California, Singapore and Tamil Nadu, is engaged in the development, manufacture, distribution and sales of a broad range of medical devices and consumables used in global healthcare markets.

what in the world?

Post reply on HN