Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Please update your DNS records when abandoning servers

news.ycombinator.com

Post reply on HN
Print view View original

21–30 of 69 posts

Re: Tell HN: Please update your DNS records when abandoning servers

#21

Post by Triv888 »

axegon_ wrote: post #18

I agree, but there's something related which I feel is very weird and I wonder if I'm the rule or the exception: I have close to 100 domains to my name(for relatable reasons, i.e. "hey I have a wix site can you please add a domain to it, idk how") in addition to a dozen servers. Some of those domains are completely unused but could be pretty valuable to some people. No one has ever contacted me about either one of th…

I only had about 5 domains and two different Chinese people contacted me about buying 2 of them (4-letter domains)... I sold one for a couple of hundreds.

Re: Tell HN: Please update your DNS records when abandoning servers

#22

Post by susam »

awestroke wrote: post #14
susam wrote: post #12

While domain registrants should certainly be careful that their DNS records point to trusted servers only and should definitely remove any stale DNS entries, we should also configure our web-servers to return successful response for specific hostnames only and error/no response for everything else. Here is roughly how the configuration for, say, https://example.com/ , would look like: sudo mkdir /etc/nginx/ssl sudo o…

The reverse is the problem here: your domain, somebody elses server

> The reverse is the problem here: your domain, somebody elses server

Why would my domain point to somebody else's server?

The original post says, "It seems that the owner had it pointed to a Linode instance/IP which was then abandoned and was subsequently "inherited" by me."

As per my reading of this, it sounds like the domain name is owned by someone else that points to an IP address of the poster's server. My comment was meant for a scenario like this where if someone else's domain name points to my server's IP address and a visitor visits my web server via that domain name, then my server will close the connection without response.

Re: Tell HN: Please update your DNS records when abandoning servers

#23

Post by susam »

detaro wrote: post #19
susam wrote: post #12

While domain registrants should certainly be careful that their DNS records point to trusted servers only and should definitely remove any stale DNS entries, we should also configure our web-servers to return successful response for specific hostnames only and error/no response for everything else. Here is roughly how the configuration for, say, https://example.com/ , would look like: sudo mkdir /etc/nginx/ssl sudo o…

that doesn't prevent the "a domain you own points at someone elses server and they can do unsavory things with it". (Especially bad if it's a subdomain, or a domain linked to one of your others.) it's not for OPs sake, but for the domain owners sake.

My domain name is under my control and therefore should not point to servers I do not trust. If one's domain name points to an untrusted server, a very fundamental mistake has been made and no amount of configuration can fix the issues associated with it.

Webmasters we have two things in control:

1. Their domain name. It should point to trusted servers only.

2. Their web server. It should be configured to return successful responses only for domain names they care about and no response/error for everything else.

Re: Tell HN: Please update your DNS records when abandoning servers

#24

Post by susam »

Denvercoder9 wrote: post #16
susam wrote: post #12

While domain registrants should certainly be careful that their DNS records point to trusted servers only and should definitely remove any stale DNS entries, we should also configure our web-servers to return successful response for specific hostnames only and error/no response for everything else. Here is roughly how the configuration for, say, https://example.com/ , would look like: sudo mkdir /etc/nginx/ssl sudo o…

You can't: the web server has to accept the connection to know the hostname. The best you can do is close the connection immediately without sending a response if it's an unknown hostname. I believe that at least with Apache and nginx doing this requires using a non-default module.

Indeed the web server has to accept the connection, check the hostname, and return an error or close the connection without response.

Re: Tell HN: Please update your DNS records when abandoning servers

#26

Post by sleepydog »

susam wrote: post #22
awestroke wrote: post #14

Earlier quoted context omitted.

The reverse is the problem here: your domain, somebody elses server

> The reverse is the problem here: your domain, somebody elses server Why would my domain point to somebody else's server? The original post says, "It seems that the owner had it pointed to a Linode instance/IP which was then abandoned and was subsequently "inherited" by me." As per my reading of this, it sounds like the domain name is owned by someone else that points to an IP address of the poster's server. My comm…

The OP is putting himself in the domain owner's shoes. It's a mild inconvenience for the OP, but what if the OP was a bad guy? He could have setup a site that looked like the old one saying "unstoppable is back! Log in and update your payment info!" but stole credit card info or passwords.

The owner of the domain should have been more careful to delete their A records once they no longer owned the IP address. IPv4 addresses are finite and it's not surprising for a housing provider to recycle them.

Re: Tell HN: Please update your DNS records when abandoning servers

#27

Post by detaro »

susam wrote: post #22
awestroke wrote: post #14

Earlier quoted context omitted.

The reverse is the problem here: your domain, somebody elses server

> The reverse is the problem here: your domain, somebody elses server Why would my domain point to somebody else's server? The original post says, "It seems that the owner had it pointed to a Linode instance/IP which was then abandoned and was subsequently "inherited" by me." As per my reading of this, it sounds like the domain name is owned by someone else that points to an IP address of the poster's server. My comm…

> "It seems that the owner had it pointed to a Linode instance/IP which was then abandoned and was subsequently "inherited" by me."

answers the "Why would my domain point to somebody else's server?", doesn't it?

Re: Tell HN: Please update your DNS records when abandoning servers

#28

Post by detaro »

susam wrote: post #23
detaro wrote: post #19

Earlier quoted context omitted.

that doesn't prevent the "a domain you own points at someone elses server and they can do unsavory things with it". (Especially bad if it's a subdomain, or a domain linked to one of your others.) it's not for OPs sake, but for the domain owners sake.

My domain name is under my control and therefore should not point to servers I do not trust. If one's domain name points to an untrusted server, a very fundamental mistake has been made and no amount of configuration can fix the issues associated with it. Webmasters we have two things in control: 1. Their domain name. It should point to trusted servers only. 2. Their web server. It should be configured to return succ…

The configuration fixing it for the domain owner is very simple: update your DNS so it doesn't point to a server you don't control anymore. OP observed someone made that mistake and is posting a PSA "hey, remember that that's a thing and don't do it because it's bad". If that's obvious to you and you never make that mistake, great, you are not the target, but real-world experience shows that it happens all the time.

Re: Tell HN: Please update your DNS records when abandoning servers

#29

Post by susam »

sleepydog wrote: post #26
susam wrote: post #22

Earlier quoted context omitted.

> The reverse is the problem here: your domain, somebody elses server Why would my domain point to somebody else's server? The original post says, "It seems that the owner had it pointed to a Linode instance/IP which was then abandoned and was subsequently "inherited" by me." As per my reading of this, it sounds like the domain name is owned by someone else that points to an IP address of the poster's server. My comm…

The OP is putting himself in the domain owner's shoes. It's a mild inconvenience for the OP, but what if the OP was a bad guy? He could have setup a site that looked like the old one saying "unstoppable is back! Log in and update your payment info!" but stole credit card info or passwords. The owner of the domain should have been more careful to delete their A records once they no longer owned the IP address. IPv4 ad…

Thank you for clarifying the OP's intention. It indeed makes sense to advise the domain registrants to be careful about cleaning up stale DNS entries.

Yes, if a domain points to IP addresses of servers we do not control, many bad things can happen. Here is a really interesting security disclosure related to stale DNS entries that comes to my mind: https://thehackernews.com/2019/04/subdomain-microsoft-azure.... .

Post reply on HN