Tell HN: Please update your DNS records when abandoning servers

#1

Post by mwgarcia » Sun, Jan 03, 2021, 1:00 PM UTC

I got contacted by someone wanting to buy the domain and was thoroughly surprised. It seems that the owner had it pointed to a Linode instance/IP which was then abandoned and was subsequently "inherited" by me.

http://unstoppable.com/

https://whois.domaintools.com/unstoppable.com

https://reverseip.domaintools.com/search/?q=unstoppable.com

Re: Tell HN: Please update your DNS records when abandoning servers

#2

Post by pluc » Sun, Jan 03, 2021, 1:13 PM UTC

On a related note, you should also set proper DNS on domains you do not use!

https://www.gov.uk/guidance/protect-domains-that-dont-send-e...

Re: Tell HN: Please update your DNS records when abandoning servers

#3

Post by cpach » Sun, Jan 03, 2021, 1:30 PM UTC

So how did the prospective buyer even find your e-mail address...?

If I were you I would configure my web server so that it will only accept HTTP connections for hostnames that are your own. If you had done that then the buyer would probably never have found you.

Re: Tell HN: Please update your DNS records when abandoning servers

#4

Post by nickjj » Sun, Jan 03, 2021, 1:31 PM UTC

Yep.

A few years ago I had a server on DigitalOcean and stopped using it. I forgot to remove the A record for it on a sub-domain connected to my main site and suddenly a sub-domain on my main site was serving ~400,000 pirated PDFs because the old server's IP address was in control by someone else.

I wrote about it here: https://nickjanetakis.com/blog/a-recycled-ip-address-caused-...

And it was discussed on HN back then: https://news.ycombinator.com/item?id=17020944

Then another DNS related issue happened 6 months ago where someone thought I owned a domain they used to have: https://nickjanetakis.com/blog/at-first-i-thought-someone-wa...

In this 2nd case someone else forgot to update an old domain redirect and I ended up being the recipient.

Re: Tell HN: Please update your DNS records when abandoning servers

#5

Post by bob33212 » Sun, Jan 03, 2021, 1:34 PM UTC

cpach wrote: post #3

So how did the prospective buyer even find your e-mail address...? If I were you I would configure my web server so that it will only accept HTTP connections for hostnames that are your own. If you had done that then the buyer would probably never have found you.

Do a dns lookup for a large website. Then google that up address. There is a good chance you will see the domain name in one of the results

Re: Tell HN: Please update your DNS records when abandoning servers

#6

Post by bilekas » Sun, Jan 03, 2021, 1:37 PM UTC

I don't see why you should care.

Don't allow the requests from non hosted domains on your server.

You don't control the DNS' you can't rely on people to updated them.

Re: Tell HN: Please update your DNS records when abandoning servers

#7

Post by mwgarcia » Sun, Jan 03, 2021, 1:39 PM UTC

cpach wrote: post #3

So how did the prospective buyer even find your e-mail address...? If I were you I would configure my web server so that it will only accept HTTP connections for hostnames that are your own. If you had done that then the buyer would probably never have found you.

The Whois record showed the title of my page which has my name lol. They contacted me in LinkedIn using that. Directed them to use the GoDaddy contact thing based on Whois. EDIT: I got it mixed up, they just browsed unstoppable.com which was not filtered out by my server.

And yeah I should have had server_name in my nginx config in the first place. This time I did some fun with multiple roots/domains on one server: one for unstoppable.com and the other for my actual website.

Re: Tell HN: Please update your DNS records when abandoning servers

#8

Post by mongol » Sun, Jan 03, 2021, 1:39 PM UTC

So obvious in retrospect, and so little talked about. Could something be done with the DNS / IP protocols that would improve this?

Re: Tell HN: Please update your DNS records when abandoning servers

#9

Post by asplake » Sun, Jan 03, 2021, 1:53 PM UTC

Another reason to require https?

Re: Tell HN: Please update your DNS records when abandoning servers

#10

Post by mwgarcia » Sun, Jan 03, 2021, 2:02 PM UTC

bilekas wrote: post #6

I don't see why you should care. Don't allow the requests from non hosted domains on your server. You don't control the DNS' you can't rely on people to updated them.

Totally agree. I failed to add server_name to my nginx config. IIRC I wrongly assumed that it can only accept one domain/pattern and didn't want to bother so I can simplify testing using localhost.