Ask HN: How do I secure the domain for my business? • Hacker News Board

Re: Ask HN: How do I secure the domain for my business?

#61

Post by wlonkly » Mon, Mar 28, 2022, 1:47 PM UTC

YetAnotherNick wrote: post #57

wlonkly wrote: post #55

Earlier quoted context omitted.

Your registRAR's availability doesn't stop your domain from being present at the registRY, but _if_ your DNS provider becomes unavailable you'll be thankful that your registrar is able to change your NS records with the registry.

Even if you registrar's DNS you could change it in the same way. What would using different DNS acheive?

There's three players: registry, registrar, and DNS host. The parts that affect your availability are the registry's nameservers and your DNS host. The registrar is the control plane for the registry -- if your registrar is unavailable and your registry and DNS host are fine, you're still up.

If your DNS host is unavailable _and_ they're your registrar, then you can't make changes at the registry to use a different DNS host.

But if they're unavailable and they're not your registrar, then you can still make changes at the registry to use a different DNS host (although you'll still have to deal with the two-day TTL on the NS records at the root).

So the idea of using a different registrar and DNS host amounts to separating the control and data plane for your domain.

Re: Ask HN: How do I secure the domain for my business?

#62

Post by toast0 » Mon, Mar 28, 2022, 11:35 PM UTC

technion wrote: post #30

ivanr wrote: post #11

Here's a very good guide from GOV UK: https://www.gov.uk/guidance/keeping-your-domain-name-secure It's written for domains under gov.uk, but, ignoring that, the rest is universal and thorough.

Unfortunately a registry lock for most TLDs seems very difficult to get.

Not all TLD registries offer registry locks, but those run by Verisign (includes .com, .net), Affilias (lots of gtlds), and Neustar (.biz and .org), and according to a MarkMonitor slide deck, about 30 ccTLDs do.

You may need to switch to a registrar that will let you do it, but that's generally a matter of finding one and giving them enough money, which isn't really difficult. Look for a corporate/brand focused registrar and call their sales and see what the minimum spend is.

If the registry for your domain doesn't do any registry locks, then you would need to switch to a different TLD, which is difficult.

Re: Ask HN: How do I secure the domain for my business?

#63

Post by toast0 » Mon, Mar 28, 2022, 11:47 PM UTC

samwillis wrote: post #18

Outside the best practices others are mentioning there are companies that specialise or provide high security domain registration, Mark Monitor are the big one. CloudFlare also offer this type of service. I have no idea how much it costs, would actually love to know if anyone has any experience with any of them? https://www.cloudflare.com/products/registrar/custom-domain-... https://markmonitor.com/

At my last job, I worked with MarkMonitor to get registry lock on our domains after an incident at Network Solutions [1]. It was expensive, but the price didn't matter because they had an annual spending requirement that was more than our annual renewals, since we didn't have many domains. Ownership has changed since then, and I don't have the slightest idea about current pricing. I think they charged us $1000/year for registry locks, on top of the $100/year for a .com/.net. If you had more domains, they might have had a bulk discount; but from our perspective, it was pay $$$$/year for registry locks on our two important domains and get the rest of our registrations free.

Never had any hijacks after that. We did have to postpone a DNS service change because the CEO didn't answer the verification call and the registry wouldn't try again on the same day. No big deal, we set up the lock for a reason and fail-closed is desirable.

[1] I know, but the CEO thought they must still be good, because they were in charge in the 90s. I'll check closer on these things in the future, I guess.

Re: Ask HN: How do I secure the domain for my business?

#64

Post by toast0 » Mon, Mar 28, 2022, 11:56 PM UTC

Tijdreiziger wrote: post #41

web007 wrote: post #40

Earlier quoted context omitted.

That's not usually a problem. You can transfer a registration with N years remaining, the new company will charge a one year registration and you now have N+1 years covered. The only time it becomes a problem is if your new registrar doesn't support N+1 year registration - your 8-year example means you need to find someplace that supports 9- or 10-year regs.

Read the first part of my comment again. Some (many?) registrars don't actually register the domain for N years at once with the registry, even if you pay them for N years.

If they don't pay the registry, wouldn't it not show up in whois? If it doesn't show up with the expected expiration date in whois shortly after registration/renewal, I'd be demanding it get fixed.