Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do I secure the domain for my business?

news.ycombinator.com

Post reply on HN
Print view View original

31–40 of 64 posts

Re: Ask HN: How do I secure the domain for my business?

#31

Post by Symbiote »

vocram wrote: post #22

The major risk here is social engineering, someone who pretends to be you and call your registrar to get credentials reset. Surprisingly I haven’t find any good solution among the answers here.

I think markmonitor.com offers this sort of service, but I suspect it's "call us" pricing.

Note how domains like google.com, amazon.com, microsoft.com are registered with them. You can find similar services by looking in Whois records, e.g. bankofamerica.com is with www.cscprotectsbrands.com, lloyds.com is with ascio.com.

Re: Ask HN: How do I secure the domain for my business?

#32

Post by michaelt »

samwillis wrote: post #18

Outside the best practices others are mentioning there are companies that specialise or provide high security domain registration, Mark Monitor are the big one. CloudFlare also offer this type of service. I have no idea how much it costs, would actually love to know if anyone has any experience with any of them? https://www.cloudflare.com/products/registrar/custom-domain-... https://markmonitor.com/

This. You can use 'whois' to find the registrars used by big sites.

The registrar for google.com? microsoft.com? netflix.com? ubuntu.com? reddit.com? amazon.com? They all use Markmonitor.

Of course, markmonitor aren't perfect: https://news.ycombinator.com/item?id=28351432

Other options include 'CSC corporate domains', the registrar for apple.com and twitter.com - and some companies, like facebook and cloudflare, are their own registrars.

Re: Ask HN: How do I secure the domain for my business?

#33

Post by TekMol »

Most advice here seems to be about securing it from yourself. Making sure you do not let someone get your credential via whatever means.

I would be more interested in how to secure it from the registrar fucking up? Is there a way to hold a domain so that even when your registrar is being tricked into giving it awway, you can still prevent that or get it back?

Or do we have to wait for cryptographically secured ownership of domains so that a key that only you yourself hold is needed to move it? Something like Ethereum Name Service domains?

Re: Ask HN: How do I secure the domain for my business?

#34

Post by xsc »

Tijdreiziger wrote: post #29
math-dev wrote: post #9

Buy for 10 years (assuming .com)

Beware: if your registrar of choice goes bust within those 10 years, you probably lose your money.

This is unlikely. When a registrar goes bust, the registry can take over, assign a replacement registrar by buyout or alternate agreement. See “Registerfly” case as an example.

Re: Ask HN: How do I secure the domain for my business?

#35

Post by Tijdreiziger »

xsc wrote: post #34
Tijdreiziger wrote: post #29

Earlier quoted context omitted.

Beware: if your registrar of choice goes bust within those 10 years, you probably lose your money.

This is unlikely. When a registrar goes bust, the registry can take over, assign a replacement registrar by buyout or alternate agreement. See “Registerfly” case as an example.

In some cases though, the registrar only pays the registry for 1 year at a time, making the money their customers pre-pay effectively a low-interest loan for the registrar. If that registrar goes bust, you'll be able to transfer your domain to a different registrar, but you'll lose the money you paid (i.e. loaned) to the original registrar.

There's also another risk: if you decide after 2 years you're not happy with your registrar, tough luck, you've already paid for 10 years.

Re: Ask HN: How do I secure the domain for my business?

#36

Post by vasco »

technion wrote: post #26
davidkuennen wrote: post #24

Earlier quoted context omitted.

Yes, I think business domains should be handled with absolute care and know how internally. Hence why I put so much importance on this matter.

Honestly have a look at web development subs. You'll often find posts like "this business asked me to change their landing page but they want to manage their own domain WTF is this possible??". And I have to admit, yes I'm salty. I got torn to pieces over a large mail cluster "failing" and this turned out to be the cause.

Maybe you should be salty that management thinks "tearing people to pieces" is an appropriate response to an incident before the cause is even known.

Re: Ask HN: How do I secure the domain for my business?

#37

Post by holdenc »

You have not really given us enough information to suggest the best solution. For example, is this because you host many websites for other people who all use your custom nameservers? Either way, if you are hosting many sites with custom nameservers, look at what AWS does for its nameservers for route53. Theirs are set-up like so:

ns-1271.awsdns-11.co.uk

ns-522.awsdns-02.net

ns-433.awsdns-03.com

ns-1870.awsdns-03.org

In your case, you'd likely want to each domain used in your custom nameserver configuration to be registered at a different company. In this way, you no longer have a single point of failure.

Re: Ask HN: How do I secure the domain for my business?

#38

Post by gruez »

TacticalCoder wrote: post #17

What if a company incorporates using your name in this or that jurisdiction then claims your .com? It happened in the past (although many companies, at first, simply bought the .com from the early .com hoarders for it was easier and faster than claim the name ownership). I don't know how you can defend against that, except having a company incorporated with that name in the country which corresponds to the TLD.

You see to have a misunderstanding of how the domain dispute process works. Having a trademark/company registered doesn't allow you to expropriate domains from an existing owner. See for instance, nissan.com. However, if you registered a domain in "bad faith" against someone with a trademark (eg. using it to redirect to a competitor's site, or trying to extort money from them), your domain can be seized.

see https://www.icann.org/resources/pages/policy-2012-02-25-en for the UDRP, which is used for most, but not all the TLDs.

Re: Ask HN: How do I secure the domain for my business?

#39

Post by HWR_14 »

vasco wrote: post #36
technion wrote: post #26

Earlier quoted context omitted.

Honestly have a look at web development subs. You'll often find posts like "this business asked me to change their landing page but they want to manage their own domain WTF is this possible??". And I have to admit, yes I'm salty. I got torn to pieces over a large mail cluster "failing" and this turned out to be the cause.

Maybe you should be salty that management thinks "tearing people to pieces" is an appropriate response to an incident before the cause is even known.

> "tearing people to pieces" is an appropriate response to an incident before the cause is even known.

Or after the cause is known. Unless maliciously done "tearing someone to pieces" is a strange way to deal with managements training failures, lack of procedures or similar.

Re: Ask HN: How do I secure the domain for my business?

#40

Post by web007 »

Tijdreiziger wrote: post #35
xsc wrote: post #34

Earlier quoted context omitted.

This is unlikely. When a registrar goes bust, the registry can take over, assign a replacement registrar by buyout or alternate agreement. See “Registerfly” case as an example.

In some cases though, the registrar only pays the registry for 1 year at a time, making the money their customers pre-pay effectively a low-interest loan for the registrar. If that registrar goes bust, you'll be able to transfer your domain to a different registrar, but you'll lose the money you paid (i.e. loaned) to the original registrar. There's also another risk: if you decide after 2 years you're not happy with…

That's not usually a problem. You can transfer a registration with N years remaining, the new company will charge a one year registration and you now have N+1 years covered.

The only time it becomes a problem is if your new registrar doesn't support N+1 year registration - your 8-year example means you need to find someplace that supports 9- or 10-year regs.

Post reply on HN