60

Never you mind the comments section below, and never you mind the previous answers in the edit history. After about an hour of some conversation with friends (thank you @joeQwerty, @Iain, and @JourneymanGeek), and some jovial hacking around we got to the bottom of both your question and the situation on the whole. Sorry for brusqueness and misunderstanding ...


35

As per RFC 6761 section 6.4, the domain invalid. and any names falling within .invalid., can be assumed not to exist.


33

They're not supposed to, but some DNS services may treat this as more of a suggestion than a hard rule. They may honor the setting down to some minimum, or they may ignore your TTL completely and always use their own setting (I've heard that 2 days is, or at least was, common). You need to be aware there is nothing you can do that will make those providers ...


32

In addition to Wesley's excellent answer, I'd like to add that there is already a solution to prevent this. It's called DNSSEC. The basics are this: You register your domain (I'll go with the eminent name wesleyisaderp.com here, just because.) You register your name servers with your registrar, usually via a web interface that you authenticate to with a ...


29

This is spam at the least - at worst, it's a scam. Do not agree to send a read receipt. Do not download unnecessary content. Do not click links. Do not reply. Do not pass Go... etc. As others have mentioned, protecting your contact details in whois information may help eliminate these emails; I'd also like to add some common signs of spam/scam emails: "...


18

Only if you make that change to the TTL more than three hours in advance of the IP address change. Remember that the TTL tells other DNS servers how long to cache records. So you must reduce it at least that long in advance of your desired change.


18

This is some attempt to spam/phish/infect with malware. Just delete it and carry on. There is no real way to avoid this crap, but you have your full contact information including mail in the domain record - this makes this extra easy ...


17

A direct answer to this would eventually become outdated if more top-level domains start enforcing HTTPS using HTTP Strict Transport Security (HSTS, RFC 6797). Technically this is an HSTS policy of a TLD submitted to the preloading list. It started with Google's new TLDs, The HSTS preload list can contain individual domains or subdomains and even top-level ...


13

You hit probably one of the worst corner case of domain names, one that is often poorly explained everywhere and that causes a lot of problems. The following applies to gTLDs (some ccTLDs may work the same way, some completely differently): they work in an auto-renewal mode. This means that, at the registry level, a domain really never expires, it gets ...


12

I have a set of domain names that are used internally For internal only uses, you can set a private CA, install its certificate on internal systems, and issue internal certificates yourself. If your internal use servers are somehow used externally, they will not work unless the external clients add an exception for your certificate. That will not stop ...


11

I'm basically parroting Michael here, but this is too much to paste into a comment: ;sai.ngo. IN A ngo. 172800 IN NS b0.nic.ngo. ngo. 172800 IN NS d0.nic.ngo. ngo. 172800 IN NS a2.nic.ngo. ngo. 172800 IN NS a0....


10

You will not need to rejoin clients or re-create users if you are doing a domain rename. I don't know what step-by-step guide you're looking at, but the step-by-step guide to domain rename from Microsoft doesn't contain such instructions. I've done several domain renames in Windows 2003 single-forest, single-domain environments with and without Exchange ...


10

The potential security vulnerabilities of someone squatting your domain that you have AD hosted on ... are no different than the vulnerabilities from people squatting a domain with no AD on it. The would be able to phish your users, with perfectly valid SSL certs, and the correct domain. By using a namespace that is 'inaccessible' - and I intentionally put ...


9

There is such a thing as "too many nameservers", but not for the reasons you're concerned with. The others have covered the irrelevance of latency concerns and I won't beat that horse to death. The real problem with adding too many nameservers is authority bloat. A reply to a SOA record request should not exceed 512 bytes if at all possible, including both ...


9

If you go to mxtoolbox, and check your domain for blacklisting, it doesn't return as listed on any at this time. You can check for blacklisting on: http://mxtoolbox.com/blacklists.aspx If you check domain info, you can see domain icann-monitor.org was registered yesterday, so is definitely not a genuine abuse notice. http://whois.domaintools.com/icann-...


8

Here is a simple process to get from registering a new domain to having browser requests arrive at the web server. Yes it could be made more fancy, but the focus is on simple in order to clear away the common confusion about different roles of the registrar and Route 53. In AWS Route 53, create a new hosted zone with same name as the domain you registered, ...


8

For Google (8.8.8.8) as with many providers the resolving service gets load balanced over a number of nodes and as each node maintains it's own cache, subsequent queries to apparently the same name server might actually come from a different node and yield different (cached) results. (Different errors, different TTL values etc.) @ is used by dig to select a ...


7

It is legal in form 001.example.com, you can add a hostname 001 as a record on DNS server and you will be able to ping and work with 001.example.com, I'm not sure if any *nix service will fail to work with that, it is according to standards and they should all support it, but you will have problems when omitting the domain. $ ping 001.example.com Pinging ...


7

Let's be clear. Ever since the outage of a low cost low end provider of whatever you do not trust a technology that is proven. Why? You think everyone is as incompetent as GoDaddy? Never had a DNS issue in years. I'm thinking of using Route 53, CloudFlare DNS, and another provider. This means I'd probably end up with about 13 name servers attached to ...


7

RFC2182 section 5 recommends at least 3 nameservers, and preferably no more than 7.


7

It's not DNS CNAME problem. DNS only help clients to resolve IP from FQDN. If virtual host root works, then IP resolving works fine. You need to check you web server configuration, and web server responce for example.co.uk/directory request.


6

man hostname, being cited from its end to beginning FILES /etc/hostname Historically this file was supposed to only contain the hostname and not the full canonical FQDN. Nowadays most software is able to cope with a full FQDN here. This file is read at boot time by the system initialization scripts to set the hostname. /etc/...


6

You can use the dig utility from dns-utils (packaged with bind usually), and use the +trace option. Output Your dns servers seem to be "dns200.anycast.me" and "ns200.anycast.me". Is this correct? They returned no response, so start looking there. If you've changed DNS server addresses, the change can take some time to propagate (in my experience, up to ...


6

Sure, it will still work; they aren't actually related in any technical way (registrars just like to bundle certificates with registration/hosting/etc. to make more money). Any browser that has Gandi's public key in its certificates list (should be just about all of them) will still accept it for as long as it's valid.


6

If you can't use rendom.exe because you have an Exchange organization in your environment, you have to create a new Active Directory domain and use a tool like ADMT to migrate users, groups, and computers into the new domain. Some applications do not support migration in this manner - Exchange is one of them. You will have to configure an Exchange ...


6

There's no good reliable starting point for a WHOIS client. It's more or less an "illusion" that you can use whois without also specifying the whois server to query. I'll refer to my answer here https://serverfault.com/a/615848/183318 for the available means of finding the proper WHOIS server for a TLD. Only the method of querying IANA (WHOIS or http) is ...


6

You'll be fine so long as you claim ownership of the domain at DigitalOcean (i.e. associate it with your account) before you tell the registrar to use their name servers. If someone has associated your domain with their account already you'll find out before the DigitalOcean nameservers become authoritative. And if that happens, talk to DigitalOcean ...


6

It seems to take time for gcp to know how to handle the new domain name. About some 15 minutes after the additional of the new A record, the domain name www.mycompany.com starts to work. The 404 screen is gone


6

If leaking host names is part of your threat model, then CT is probably not the only source of such leakage. Think of email headers, logs, monitoring, compilers, .. lots of tools could eventually spill system names (whether host names or just part of certificates) into publicly accessible spaces. Rather, work on the underlying reasons for wanting them stay ...


6

If your organization changes and you need an entirely new directory structure, sure take the opportunity to pick a best practice DNS name. But you have not identified a problem, either technical or user experience, worth doing a rename project. Adding a UPN of COMPANYNAME.COM or perhaps COMPANYNAME and doing a UserPrincipalName conversion, is supposed to be ...


Only top voted, non community-wiki answers of a minimum length are eligible