Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Name.com hijacks non-existent subdomains and redirects to their servers

destructuring.net

Post reply on HN
Print view View original

11–20 of 93 posts

Re: Name.com hijacks non-existent subdomains and redirects to their servers

#11

Post by pi18n »

moepstar wrote: post #5
rgbrenner wrote: post #4

Earlier quoted context omitted.

yes, you can enter a wildcard record yourself, and that will override the name.com wildcard. Is it irritating that they do that? Sure. Should they be doing? probably not. But it does have a pretty simple fix. Personally, I use a third-party dns service. Seen too many registrars play with DNS. Don't know why anyone would trust them.

>> Don't know why anyone would trust them. I don't know about you, but i give everyone the benefit of doubt and unless someone violates this trust, i'd think most people do too. Also, at least i tend to think of registrars as some kind of neutral entity that i, indeed, can trust - guess there are some exceptions to the rule. How many years and years of abuse has it taken for people to notice what GoD*ddy has been doi…

This is what happened. For example, I previously gave Name.com the benefit of the doubt and sent them an email asking them to fix the issue. They did not, so now I mention this every time I see their service mentioned. They are scum just like GoDaddy but on a lower scale.

Re: Name.com hijacks non-existent subdomains and redirects to their servers

#13

Post by nbpoole »

Some previous discussion on this issue (almost 2 years ago):

http://news.ycombinator.com/item?id=2443710

I'll say the same thing I said then:

As an anecdotal counterpoint, I'm an extremely happy Name.com customer. I transfered several domains to them a year or so ago from GoDaddy. They support two-factor authentication, their interface is uncluttered, I pay them less money than I paid GoDaddy, and I haven't had a single issue. I would highly recommend them to anyone looking for a registrar.

That being said, I don't use them for DNS. If this is a feature of their nameservers, I do find it strange that they don't offer a way to opt out (other than using alternative nameservers).

I am still an incredibly happy Name.com customer and would recommend them as a registrar to anyone who asks. I just would point them somewhere else for DNS hosting.

Re: Name.com hijacks non-existent subdomains and redirects to their servers

#15

Post by ricardobeat »

MatthewPhillips wrote: post #7

I caught Hover.com doing something similar[1] a couple of years ago. They were adding forwards not for subdomains but paths of the root domain. I actually switched to Name.com for this very reason, troubling to see another pulling this stuff. [1] http://matthewphillips.info/posts/no-thanks-hover.html

At the end of the post you say you fully believe their explanation (that those are added as forwarding examples on new accounts). Which one is it?

Re: Name.com hijacks non-existent subdomains and redirects to their servers

#16

Post by machrider »

My workaround for this was to add a TXT record for *.mydomain.com that just returns a string like "Unused". This seems to stop them from hijacking any subdomains, and it's not an A record so undefined subdomain names do not resolve, just like if you had not defined them in the first place.

(Workaround shouldn't be necessary of course, but this kind of bullshit is par for the course with cheap hosting companies.)

Re: Name.com hijacks non-existent subdomains and redirects to their servers

#17

Post by JoshTriplett »

lcampbell wrote: post #9
fuser wrote: post #3

Can't you just do a CNAME entry with a wildcard pointing to your primary domain?

The wildcard fix is annoying when you have everything on SSL but don't want to handle a wildcard cert[1]. When someone typos https://foo.example.com I'd like the UX to be a browser's "could not connect to server" error, not "this site is untrusted, run away as fast as you can". -- [1] IMO, the use of wildcard certs is a dangerous practice[2] made obsolete by SNI. [2] If the cert gets stolen from one server, the thief…

Given that no means currently exists to safely hand out a certificate for example.org that can in turn sign separate certificates for arbitrary foo.example.org subdomains, some sites still need wildcards. If you hand customers their own subdomain, and you automatically mint new customer subdomains when new customers sign up, you can't get a separate CA certificate for each one even if SNI does work; you really do need a wildcard for that.

Re: Name.com hijacks non-existent subdomains and redirects to their servers

#18

Post by zrail »

jstanley wrote: post #2

It's really not that hard to run your own nameserver. While I obviously disagree with what they're doing, I think you should have been running your own in the first place.

It's really not hard at all. I wrote a blog post about my setup a few months ago[1]. To summarize: djbdns + a few VPS instances which can be very tiny + puppet.

[1]: https://bugsplat.info/2012-12-31-how-i-run-my-own-dns.html

Re: Name.com hijacks non-existent subdomains and redirects to their servers

#19

Post by ams6110 »

machrider wrote: post #16

My workaround for this was to add a TXT record for *.mydomain.com that just returns a string like "Unused". This seems to stop them from hijacking any subdomains, and it's not an A record so undefined subdomain names do not resolve, just like if you had not defined them in the first place. (Workaround shouldn't be necessary of course, but this kind of bullshit is par for the course with cheap hosting companies.)

Just fyi, mydomain.com is a real domain, example.com is better to use for illustrative purposes.

Re: Name.com hijacks non-existent subdomains and redirects to their servers

#20

Post by MatthewPhillips »

ricardobeat wrote: post #15
MatthewPhillips wrote: post #7

I caught Hover.com doing something similar[1] a couple of years ago. They were adding forwards not for subdomains but paths of the root domain. I actually switched to Name.com for this very reason, troubling to see another pulling this stuff. [1] http://matthewphillips.info/posts/no-thanks-hover.html

At the end of the post you say you fully believe their explanation (that those are added as forwarding examples on new accounts). Which one is it?

What do you mean? I believed their explanation but wanted to leave anyways. I don't want them redirecting my domains regardless of intent.
Post reply on HN