Does Your Domain Have a Registry Lock?

Post by reflectiv » Fri, Jan 24, 2020, 8:34 PM UTC

xemoka wrote: post #30

duxup wrote: post #23

Earlier quoted context omitted.

The no humans thing also just closes off any path for exceptions that occur outside of what is coded. I bought a domain for a blogger blog ages ago. At the time google had no domain registry so they partnered with some company. Years later and google starts hammering me with "hey your credit card is expired we're not going to renew your domain" ... Fine right? "Hey go update your payment information on admin.google.c…

Yep, similarly here. eNom successfully "extorted" $300 from me due to it. My fault ultimately in the end though. But it was a stressful couple days, and eNom and Google partnership soured my view of both of them. I no longer do business with eNom.

Post by fierro » Fri, Jan 24, 2020, 8:49 PM UTC

james_pm wrote: post #28

PM at a large, retail domain registrar here. Registry Lock isn't something most retail registrars will offer, because generally, the vast majority of registrants don't really need it. It's not something you can just put into your domain management panel and roll out to everyone because of all the hoops required once enabled. That said, Brian Krebs does need it on his domain(s) for obvious reasons - his domain is a ma…

Post by [deleted] » Fri, Jan 24, 2020, 9:06 PM UTC

admax88q wrote: post #29

parliament32 wrote: post #6

The usual "registrar lock" is the clientTransferProhibited status you see on domains... that's easily removed by social engineering the registrar. "Registry lock" is serverTransferProhibited, the kind where both your registrar and the main registry need to agree to transfer the domain to another registrar. For instance, you can buy a .ca domain from any registrar, but you need CIRA's compliance (the issuing body for…

So what actually makes the "registry lock" robust against social engineering. Reading CIRA's page it just says that to make changes the Registrar will talk to CIRA to have to lock removed on their behalf. Doesn't sound like there's any mandatory OOB check from CIRA back to the actual client.

Post by jjeaff » Fri, Jan 24, 2020, 9:23 PM UTC

Animats wrote: post #27

For really important domains, there was MarkMonitor, the high-end registrar. But they've been acquired by an analytics company, so now it's necessary to wait a few years to see if they are still trustworthy. It's useful to trademark your domain name. That gives you a very likely win if things ever get to the ICANN dispute process.

Post by 3xblah » Fri, Jan 24, 2020, 9:46 PM UTC

omarhaneef wrote: post #8

Wow. Some random person was able to move a domain to their own account simply by whatsapp ing the registrar, telling them that they had bought the domain and were having trouble moving it. That's it. It makes me realize that Google's no humans policy -- is it a policy? -- is actually a strength here. My domains purchased through Google are safe from social engineering because, well, there are no humans to contact to…