Domain din a wɔkyere, DNS awuduru, ne registrar lockout¶

W’ahyehyɛde no domain din titiriw anaa Authoritative DNS zone so tumi a wobɛhwere no yɛ dijitaal ntɛmpɛ a ɛyɛ hu sen biara a adwuma, ayaresabea, kurow no mu adwumayɛbea, anaa intanɛt so nhoma betumi ahyia no mu biako. Esiane sɛ wo domain din ne ahotoso ntini ma nhyehyɛe biara a ɛwɔ intanɛt so nti, ɔtowhyɛfo a ɔkyere wo domain registrar akontaabu anaasɛ ɔde awuduru gu wo DNS kyerɛwtohɔ ahorow mu no nsɛe wo wɛbsaet no kɛkɛ. Wɔ simma kakraa bi mu bere a woasesa wo NS (Edin a Wɔde Di Dwuma), . A/ .AAAA (Wɛb IP), anaasɛ MX (Mail Exchange) kyerɛwtohɔ ahorow, ɔtowhyɛfo no betumi ayɛ komm atwa adwumakuw ne adetɔfo email biara a ɛba, atwam automated Let’s Encrypt Domain Validation (DV) hwɛ sɛ ɛbɛma woanya TLS/SSL encryption adansedi nkrataa a ɛfata wɔ wo din mu, akyere adwumayɛfo Single Sign-On (SSO) passwords, na ɛkanyan password-reset emails ama wo cloud infrastructure, banking portals, ne sikasɛm akontaabu ahorow. Di huammɔdi a ɛnyɛ adwemmɔne mpo, te sɛ domain a ne bere atwam a ɛtɔ mu AutoRenewGracePeriod anaasɛ RedemptionPeriod (clientHold), de wɛb akwantu, API mobile backends, ne adwumakuw email ba ntɛm ara wɔ wiase nyinaa.

Sɛ domain a wɔkyere anaa DNS a wɔatwa no ma ayaresabea ayarefo kwan a wɔfa so kɔ, nkitahodi a wɔde fa ntɛmpɛ so, ɔmanfo mfaso telemetry, anaa nkwa ahobammɔ nhyehyɛe a ɛyɛ adwuma no yɛ basaa a, frɛ wo mpɔtam hɔ ntɛmpɛ nɔma (911 wɔ United States ne Canada no, . 112 wɔ Europa Aman Nkabom no nyinaa mu, . 999 wɔ United Kingdom) anaa hwɛ yɛn international directory no mu nɔma ahorow a egye ntɛmpɛ na bɔ wo ɔman no kɔmputa so nsɛm a esisi ho mmuae kuw (te sɛ CISA wɔ United States wɔ 1-844-SAY-CISA or NCSC in the United Kingdom) immediately. For all commercial, nonprofit, and personal domain crises, execute the triage steps below in exact order.

Yɛ eyi mprempren¶

1. Determine in 30 seconds whether your domain expired, your DNS records were altered, or the domain was transferred to a foreign registrar: Run a live RDAP anaasɛ WHOIS asɛmmisa ne DNS asɛmmisa a ɛwɔ tumi a efi terminal (rdap yourdomain.com anaasɛ whois yourdomain.com, na dig +trace yourdomain.com). Check the Registrar Name, the EPP Status Codes (such as clientHold for billing/verification vs. ok with unfamiliar nameservers), and the Authoritative Nameservers (NS) na ɛyɛ.
2. Freeze all outbound password resets and lock down your Identity Provider (Okta, Microsoft Entra ID, Google Workspace) immediately: If an attacker controls your domain's MX records or NS servers, they receive every single email sent to *@yourdomain.com. Immediately instruct your IT administrators to disable "Forgot Password via Email" self-service resets across all corporate tools, revoke active sessions for users whose email addresses might be used to reset external vendor accounts, and switch administrative logins to hardware FIDO2 security keys or internal .onmicrosoft.com fallback domɛn ahorow.
3. Preserve full forensic snapshots of RDAP/WHOIS, DNS zones, and Certificate Transparency (CT) logs before anything changes: Save the output of dig ANY yourdomain.com @8.8.8.8, . whois yourdomain.com, and check crt.sh/?q=%25.yourdomain.com immediately. Searching crt.sh reveals every unauthorized SSL/TLS certificate the attacker just minted for your subdomains (mail., . vpn., . login., . api.) so you know exactly which internal services they are actively impersonating via Adversary-in-the-Middle (AitM) proxies.
4. Contact the Losing Registrar's dedicated Emergency Abuse / Security Operations Team (not Tier-1 chat support) to trigger an ICANN Unauthorized Transfer Dispute (IRTP) or Registry Lock reversal: If your domain was pushed to another account at the same registrar or transferred via a stolen Auth-Info (EPP) code to a foreign registrar, contact your original registrar's Domain Abuse / High-Risk Security Escalation Desk and request an immediate Registrar Undo / Emergency Transfer Dispute under the ICANN Transfer Policy (Section I.A na Transfer Dispute Resolution Policy), citing unauthorized credential compromise.
5. Escalate directly to the Top-Level Domain (TLD) Registry Operator if the registrar is unresponsive: Remember the hierarchy: Registrars (like GoDaddy, Namecheap, Cloudflare, MarkMonitor, Network Solutions, Gandi, Porkbun) are simply retail resellers; the Registry Operator (such as Verisign for .com/ ..net, Public Interest Registry (PIR) for .org, Nominet for .uk, CIRA for .ca, DENIC for .de, or auDA for .au) runs the master root zone database. Country-code (ccTLD) registries and several gTLD registries can place an emergency serverHold anaasɛ serverUpdateProhibited lock directly at the root level during verified cybercrime incidents.
6. Warn customers, vendors, and banking partners through out-of-band channels that @yourdomain.com email is compromised: If the attacker hijacked your MX records, they will immediately reply to open accounting threads with fake wire transfer instructions. Notify clients via telephone, SMS, LinkedIn, status page on a separate backup domain, or official social media accounts not to trust any email or login portal on the affected domain until restoration is confirmed.

Decision tree: diagnosing and containing a domain or DNS outage¶

Follow this rapid diagnostic flowchart to pinpoint the exact layer of the Domain Name System that has failed or been hijacked:

flowchart TD
    A["Website Down, TLS Certificate Warning, or Corporate Email Halted"] --> B["Run RDAP/WHOIS & dig +trace from External Network"]
    B --> C{"What do RDAP Status & Registrar Fields Show?"}
    C -->|"Status: clientHold, autoRenewPeriod, or redemptionPeriod"| D["Accidental Expiration or ICANN Whois Verification Suspension"]
    D --> E["Log into Registrar Immediately: Pay Renewal / Redemption Fee or Click RAA Verification Link; Request Emergency TTL Flush"]
    C -->|"Registrar Name or Registrant Account Changed Without Authorization"| F["Full Registrar Account Hijack or Unauthorized EPP Transfer"]
    F --> G["Lock Identity Provider (Entra/Google), File Emergency Registrar Abuse Ticket + ICANN Transfer Dispute, Check crt.sh for Rogue Certs"]
    C -->|"Registrar & NS Unchanged, but A / CNAME / MX Records Point to Unknown IPs"| H["Managed DNS Provider Compromise (Cloudflare / Route53 / NS1 API Key or Account Breach)"]
    H --> I["Revoke Compromised DNS API Tokens, Restore Known-Good Zone File, Revoke Rogue TLS Certs, Rotate Exposed Credentials"]
    C -->|"Registrar, NS, and Zone Records Look Normal, but Site Fails with SERVFAIL"| J["Broken DNSSEC Chain of Trust (DS Record Mismatch or Expired RRSIG)"]
    J --> K["Run DNSViz.net Check: Remove Stale DS Record at Registrar or Re-Sign Zone at DNS Host"]

Phase 1: Technical forensics to identify the exact attack vector¶

When a domain suddenly stops resolving or starts serving a phishing page or cryptocurrency scam, every minute spent guessing wastes precious recovery time. There are four completely distinct scenarios that look identical to an end user in a web browser, and each requires a completely different fix.

How to Read RDAP, . WHOIS, na dig Outputs Like an Incident Responder¶

Open a command terminal on Linux, macOS, or Windows (using WSL or nslookup) and run the following three diagnostic checks using a neutral public recursive resolver (8.8.8.8 anaasɛ 1.1.1.1): .

1. Check the Registry-Level Delegation (dig +trace na RDAP):

   dig +trace yourdomain.com NS @1.1.1.1
   

   • Look at the step right after the TLD root servers (for example, a.gtld-servers.net. for .com). Which NS (Nameserver) hostnames are returned by the TLD Registry itself?
   • If the TLD Registry returns your normal nameservers (ns1.yourdnsprovider.com) with status NOERROR, the hijack is happening inside your DNS hosting provider (or it is a DNSSEC breakage).
   • If the TLD Registry returns completely unfamiliar nameservers (or if whois yourdomain.com kyerɛ foforo Registrar: din ne an Updated Date: wɔ nnɔnhwerew anaa nna kakraa bi a atwam no mu no), hijack no sii wɔ Domain Registrar level.
2. Decode ICANN EPP Domain Gyinabea Kood ahorow: Hwɛ sɛnea Domain Status: nkyerɛwde a ɛwɔ wo WHOIS anaasɛ RDAP nea efi mu ba. Saa Extensible Provisioning Protocol (EPP) mmara a wɔahyɛ da ayɛ yi kyerɛ wo nea enti a domain bi redi nkogu anaasɛ wɔato mu:

Ɔfã 2: Sɛ wobɛsan anya wo ho afi domain hijack a ɛyɛ bɔne anaasɛ registrar transfer a wɔmma ho kwan mu¶

Ntuafo de akwan titiriw abiɛsa na ɛkyere nnwumakuw, Web3/DeFi, sikasɛm, ne nsɛm ho amanneɛbɔ domɛn a ɛsom bo kɛse: 1. Registrar Account Takeover (Credential Stuffing, Infostealer Malware, anaa SIM Swap): ɔtowhyɛfo no kɔ wo GoDaddy, Namecheap, Google Domains/Squarespace, anaa Network Solutions dashboard mu, dum clientTransferProhibited, sesa no NS kyerɛwtohɔ ahorow de kyerɛ Cloudflare akontaabu a ntuafo di so, anaasɛ ɛma Auth-Info (EPP) code a wɔde bɛma domain no akɔ. 2. Social Engineering of Registrar Support: ɔtowhyɛfo no de atoro incorporation nkrataa, atoro aban IDs, anaa spoofed letterhead kɔ registrar bi akontaabu recovery desk a ɛkyerɛ sɛ mfitiase IT admin no wui anaasɛ ofii adwumakuw no mu. 3. Subdomain a Wɔfa no (Dangling CNAME / . Dangling NS): Wɔn nsa nkaa wo domain titiriw no, nanso ɛyɛ subdomain dedaw (promo.yourdomain.com anaasɛ status.yourdomain.com) da so ara wɔ a CNAME kyerɛwtohɔ a ɛkyerɛ AWS S3 bokiti a wɔagyae adwumayɛ, Azure App Service, GitHub Pages repo, Heroku app, anaa Zendesk nhwɛso a wopopaa asram bi a atwam ni. ɔtowhyɛfo no kyerɛw saa mununkum ahode din a wɔagyaw no wɔ AWS/Azure/GitHub so na ntɛm ara ɔde nneɛma bɔne a efi wo aban subdomain no mu ma.

Step 1: Evict the Attacker from Your Cloud Identity Provider and Email System¶

Ansa na wobɛhyehyɛ registrar recovery form no mpo awie no, fa no sɛ ɔtowhyɛfo no de nsi rekenkan email biara a wɔde akɔ wo domain no so na ɔrebɔ mmɔden sɛ ɔbɛdan akɔ wo mu mununkum infrastructure no mu:

1. Switch Microsoft 365 / Google Workspace to Fallback Domains and Hardware MFA:
   • In Microsoft Entra ID (formerly Azure AD), every tenant has a permanent, un-hijackable fallback domain (yourcompany.onmicrosoft.com). Administrators can log in via admin@yourcompany.onmicrosoft.com even if yourdomain.com DNS yɛ hijacked koraa.
   • Disable all SMS, voice call, and alternate-email password reset methods in Entra ID / Okta / Google Workspace (Authentication Methods Policy). Require FIDO2/WebAuthn hardware security keys or number-matching Authenticator push notifications.
2. Audit Outbound and Inbound Email Logs for the Exact Compromise Window:
   • If your MX records were changed at 02:14 UTC, zero legitimate external emails have reached your real mail servers since 02:14 UTC; every single external email sent to your staff during that window was captured in full plaintext by the attacker's rogue mail server (Postfix/Exim listener).
   • Immediately pull a list of every third-party SaaS platform, bank, AWS/GCP root account, GitHub organization, and vendor portal tied to @yourdomain.com email addresses, and check whether the attacker triggered password resets on those external platforms during the hijack window.

Step 2: Execute the Registrar and Registry Emergency Recovery Protocol¶

Do not open a generic "My website isn't working" support chat. You must use the exact regulatory and legal terminology that triggers escalation to the Registrar Tier-3 Security / General Counsel / ICANN Compliance Team:

1. Case A: The Domain Is Still at Your Original Registrar (Account Takeover or Internal "Account Push"):
   • Many attackers do not wait 5 days for an inter-registrar EPP transfer; instead, they use the registrar's instant "Push Domain to Another Account" feature to move your domain into a burner account at the same registrar in 3 seconds.
   • Call and email the registrar's Fraud / Account Hijacking / Abuse Department immediately. State clearly: "URGENT SECURITY INCIDENT: Unauthorized Account Access and Internal Domain Push / DNS Modification of [yourdomain.com]. Requesting immediate freezing of the domain under serverHold/ .clientUpdateProhibited ne DNS/Account nsakrae a wɔmma ho kwan a wɔsan de."
   • Assemble Your Proof of Historical Ownership Packet Right Away: Registrar security teams hwehwɛ adanseɛ a akyinnyeɛ biara nni ho sɛ wo ne mmara kwan so deɛ woadi kan akyerɛw wo din ansa na wɔatwe domain bi asan afiri account foforɔ mu. Boaboa nkrataa 5 yi ano ma ɛnyɛ PDF biako ntɛm ara:
     1. Abakɔsɛm mu Registrar Invoices ne Payment Proofs: PDF receipts ne credit card / bank wire statements a ɛkyerɛ sɛ w’ahyehyɛde no retua ka wɔ registration ne renewal of yourdomain.com wɔ mfeɛ 1 kɔsi 10 a atwam no mu (a sikatua kaad anaa wire reference no digit 4 a ɛtwa toɔ ka ho).
     2. Adwumakuw no dinkyerɛw & Ɔpanyin ID a Aban de ama: Official Certificate of Incorporation / Articles of Organization a ɛne abakɔsɛm mu WHOIS hyia Registrant Organization, ne aban mfonini ID a ɛkyerɛ adwumakuw no panyin a ɔde ne nsa hyɛ ntam krataa no ase.
     3. Abakɔsɛm mu DNS Zone Fael & Server Ownership Proof: Wo DNS zone fael a atwam no bi, abakɔsɛm mu WHOIS mfonini ahorow, anaa adanse a ɛkyerɛ sɛ w’ahyehyɛde no wɔ autonomous system no (ASN) anaa IP a wɔde siw ano ( .A kyerɛwtohɔ ahorow) a domain no twee adwene sii so mfe pii ansa na nnɛ nsakrae no reba.
     4. Original Account Creation Email / Ticket History: Email ahorow a wonya fii ɔkyerɛwfo no hɔ bere a wɔkyerɛw domain no mfiase anaa wɔyɛɛ no ​​foforo no ti.
     5. Official Mmarahyɛ Bagua Amanneɛbɔ Nnɔmba: A fileed FBI IC3 (ic3.gov) anwiinwii nɔma (United States), Action Fraud nkyerɛkyerɛmu nɔma (United Kingdom), anaa ɔman polisifo kɔmputa so nsɛmmɔnedi amanneɛbɔ nɔma. Wɔn a wɔkyerɛw wɔn din no yɛ wɔn ade ntɛmntɛm kɛse bere a wɔde mmarahyɛ baguafo asɛm nɔma a ɛfata a ɛkyerɛ sɛ nsɛmmɔnedifo de kɔmputa ahyɛ mu wɔ 18 U.S.C. § 1030 (CFAA) anaa UK Kɔmputa a Wɔde Di Dwuma Ɔkwammɔne so Mmara 1990.
2. Asɛm B: Wɔde Domain no Kɔmaa Ɔkyerɛwfo Foforo (Inter-Registrar Hijack):
   • Wɔ ICANN Transfer Policy (kan no na wɔfrɛ no IRTP) ase no, inter-registrar transfer hwehwɛ sɛ wɔde... Auth-Info (EPP) code na ɛsɛ sɛ wosiw ano nnafua 60 wɔ nsakrae ahorow bi a wɔayɛ wɔ wɔn a wɔkyerɛw wɔn din no akyi gye sɛ wɔayi afi hɔ. Sɛ ɔtowhyɛfo bi hack wo akontaabu wɔ Registrar A ("Losing Registrar") na ɔde domain no kɔma Registrar B ("Gaining Registrar") a:
   • Di Losing Registrar ne Gaining Registrar NO NYINAA adi nkitaho ntɛm ara, nanso fa Losing Registrar's Transfer Dispute / Security Team no di kan. Wɔ ICANN Transfer Dispute Resolution Policy (TDRP) ase no, Losing Registrar no ne adwumakuw a ɔwɔ w’abakɔsɛm mu sikatua ho kyerɛwtohɔ ne login logs a ɛkyerɛ sɛ wɔamma ho kwan sɛ wɔde kɔ baabi foforo no. Ɔkyerɛwfo a Ɔhwere ade no betumi ne Gaining Registrar no mmara sodi ho ɔpanyin no adi nkitaho wɔ ɔkwan a ɛfata so de ayɛ biakoyɛ Registrar Transfer Undo, anaasɛ ɔde TDRP asɛm a ɛfata akɔma.
   • Bere koro no ara mu no fa wo wurayɛ ho adanse krataa ne polisifo amanneɛbɔ kɔma Gaining Registrar’s Abuse Desk hwehwɛ sɛ wɔde bi bɛto hɔ ntɛm ara clientTransferProhibited na clientUpdateProhibited lock wɔ domain no so sɛnea ɛbɛyɛ a ɔtowhyɛfo no ntumi mfa nkɔnsɔnkɔnsɔn a ɛyɛ offshore registrars baasa foforo ("registrar hopping") hop domain no.
3. Fa Emergency Escalation kɔ ICANN (ma gTLDs te sɛ .com, . .net, . .org, . .io sɛ gTLD) anaa ccTLD Registry no a:
   • Sɛ ɔkyerɛwfo bi pow sɛ ɔbɛhwehwɛ nneɛma a wɔde kɔ baabi foforo a wɔamma ho kwan mu anaasɛ wantumi ammua bere a wɔregye obi akɔ baabi foforo a ɛyɛ nnam a, fa Akɔ foforo a wɔmma ho kwan / Domain Hijacking Complaint a egye ntɛmpɛ fa ICANN Contractual Compliance Portal (icann.org/compliance/complaint) na ɛyɛ.
   • Sɛ wo domain no de Ɔman-Kɔde Top-Level Domain (ccTLD), te sɛ .uk, . .ca, . .au, . .de, . .fr, . .nl, . .ch, anaa .jp, wowɔ ɔkwan a ɛyɛ ntɛm mpo: ccTLD registries no, ɔman no sohwɛ mpanyimfo na wɔhwɛ so sen ICANN na ɛkame ayɛ sɛ bere nyinaa wɔhwɛ Registry Emergency Security Teams (sɛ nhwɛso no, Nominet wɔ UK wɔ 0330 236 9470, CIRA wɔ Canada, DENIC wɔ Germany, AFNIC wɔ France) a ebetumi ayɛ freeze domain a wɔafa no tẽẽ wɔ ɔman no registry level wɔ nnɔnhwerew kakraa bi mu bere a wɔagye adwumakuw no din atom no.

Ɔfã 3: Domain a ne bere atwam a wobegye (clientHold, . RedemptionPeriod, na PendingDelete) .¶

Ɛnyɛ wiase nyinaa adwuma a ɛbɛtɔ mpofirim biara na ɛyɛ kɔmputa so ntua. Da biara, nnwumakuw akɛse, SaaS startups, ne aban contractors kɔ sum koraa efisɛ credit card a ɛwɔ file wɔ wɔn domain registrar no twaam, na wɔde renewal nkaebɔ emails kɔmaa former-founder@company.com a ofii adwumakuw no mu mfe abiɛsa a atwam ni no.

ICANN Domain Asetra Bere a Atwam Bere Nhyehyɛe no ntease¶

Sɛ wopɛ sɛ wohu Top-Level Domains a ɛyɛ generic (.com, . .net, . .org, . .biz, . .info), ICANN Expired Registration Recovery Policy (ERRP) no hyɛ nkwa nna a ɛyɛ katee a ɛfa akwan horow pii ho bere a da a ɛbɛba awiei no atwam akyi:

1. Stage 1: Auto-Renew Grace Period (Nna 1 kosi ~30/45 wɔ Expiration akyi):
   • Immediately after expiration (often within 24 to 72 hours), the registrar changes the domain's NS records to a Parked / Expired Renewal Splash Page or places the domain on clientHold na ɛyɛ.
   • Impact: Your website and corporate email stop working immediately (DNS_PROBE_FINISHED_NXDOMAIN or parking ads).
   • Recovery: Log into the registrar account and pay the standard 1-year renewal fee ($10 to $30 USD). The registrar immediately restores your original NS records.
2. Stage 2: Redemption Grace Period (redemptionPeriod, 30 Days Duration):
   • If no one renews the domain during Stage 1 (usually after day 30 to 42 depending on the registrar's Terms of Service), the registrar deletes the domain at the Registry, and the Registry places it into the mandatory 30-day redemptionPeriod (unless the registrar auctioned the expired domain via an internal expired-domain auction platform like GoDaddy Auctions or NameJet, check your registrar's exact day-30 auction cutoff immediately).
   • Recovery: You can still rescue the domain with 100 percent certainty during redemptionPeriod, only through the original Losing Registrar. You must contact their billing/support desk and pay the Registry Redemption Restore Fee (typically $80 to $250 USD) plus a 1-year renewal.
3. Stage 3: Pending Delete (pendingDelete, Final 5 Calendar Days):
   • Once the 30-day redemptionPeriod expires, the domain enters pendingDelete for exactly 5 days (120 hours).
   • Impact: During pendingDelete, the Registry rejects all standard EPP restore commands from the registrar. At the end of day 5 (for .com/ ..net Verisign drops, between 18:00 and 19:15 UTC), the domain is released to the public and snatched within 10 milliseconds by automated drop-catching networks.
   • Emergency Action if Caught in pendingDelete or Registrar Expired Auction:
     • If the domain was sold via the registrar's day-30 expired auction before entering Registry redemptionPeriod, check if your registrar offers a short post-auction redemption window or contact the winning bidder/broker immediately.
     • If the domain is truly in the 5-day Registry pendingDelete phase, simultaneously place high-tier backorders across all three major drop-catching networks (DropCatch.com, . SnapNames.com, na NameJet.com) so that if the domain drops to the public pool on Day 5, your backorder captures it or enters you into the closed bidder auction to buy your domain back.

Why Does My Website Still Fail for Hours After I Renewed an Expired Domain? (Fixing Negative DNS Caching)¶

When your domain expires, the registrar replaces your NS records with temporary parking nameservers that often carry a 24-hour to 48-hour TTL (Time-To-Live) (86400 anaasɛ 172800 seconds). Even after you pay the renewal bill and your registrar restores your real NS records in the root zone within 5 minutes, public recursive DNS resolvers around the world (Google 8.8.8.8, Cloudflare 1.1.1.1, Quad9 9.9.9.9, and ISP resolvers) may keep serving the cached expired parking page until that 48-hour TTL expires.

How to Force an Instant Global DNS Cache Flush in 60 Seconds: Do not wait 48 hours for recursive caches to expire naturally. Manually flush your domain from the three largest global public DNS providers right now using their free web cache-purge portals: 1. Flush Google Public DNS (8.8.8.8 / . 8.8.4.4): Visit developers.google.com/speed/public-dns/cache, type yourdomain.com, select record type NS (and then repeat for A, ** .AAAA, ** .MX, and DS), and click Flush Cache. This clears your domain across every Google DNS data center worldwide in less than 10 seconds. 2. Flush Cloudflare Public DNS (1.1.1.1 / . 1.0.0.1): Visit one.one.one.one/purge-cache/, enter yourdomain.com, select NS, ** .A, ** .AAAA, and MX, and click Purge Cache. 3. Flush OpenDNS / Cisco Umbrella (208.67.222.222): Visit cachecheck.opendns.com, enter yourdomain.com, check the results across global nodes, and click Refresh the Cache at the bottom of the table.

Phase 4: Fixing broken DNSSEC (SERVFAIL) after a migration or hijack¶

Domain Name System Security Extensions (DNSSEC) cryptographically signs your DNS records (RRSIG records signed by a Zone Signing Key ZSK and Key Signing Key KSK) and publishes a matching Delegation Signer (DS) hash in the parent TLD zone at your registrar.

While DNSSEC prevents cache poisoning, a broken DNSSEC configuration causes an instant, total global outage (SERVFAIL) on every validating resolver (including 8.8.8.8, . 1.1.1.1, Comcast, and major mobile carriers). This most commonly happens during an emergency migration: an administrator moves yourdomain.com's nameservers from Cloudflare to AWS Route 53 (or vice versa) without first deleting the old provider's DS record at the domain registrar.

Diagnosing and Repairing a DNSSEC SERVFAIL Lockout in 5 Minutes¶

1. Confirm DNSSEC Is the Culprit: Run two dig ahyɛde ahorow akyi-akyi: asɛmmisa biako a ɛyɛ daa, ne asɛmmisa biako a ** .+cd (Checking Disabled)** frankaa, a ɛka kyerɛ recursive resolver no sɛ onbu n’ani ngu DNSSEC cryptographic validation so:

   dig yourdomain.com @8.8.8.8
   dig yourdomain.com @8.8.8.8 +cd
   

   • Sɛ ahyɛde a edi kan no di nkogu wɔ ** .status: SERVFAIL** ne mmuae a ɛyɛ zero, bere a ahyɛde a ɛto so abien (+cd) di nkonim ntɛm ara ne ** .status: NOERROR** na ɔsan de wo A record IP address, Wo outage no ɔha mu nkyekyɛmu 100 yɛ DNSSEC nkɔnsɔnkɔnsɔn a abubu a ɛkyerɛ ahotoso.
2. Hwɛ Breakage no Pɛpɛɛpɛ ne DNSViz.net anaasɛ Verisign DNSSEC Debugger: 1. .
   • Bue dnsviz.net anaa ** .dnssec-debugger.verisignlabs.com** na hyɛn mu yourdomain.com.
   • Ɛbɛtwetwe mfonini a wɔde aniwa hu a ɛkyerɛ sɛ ebia... DS kyerɛwtohɔ a wɔatintim wɔ wo registrar no ntumi nhyia DNSKEY a wo mprempren DNS host no som, anaasɛ sɛ ebia wo zone signatures (RRSIG) no atwam.
3. Nneɛma a Ɛho Hia Ntɛmntɛm:
   • Sɛ woasesa DNS providers nkyɛe a: Kɔ wo Domain Registrar mu, kɔ DNSSEC / DS Records ɔfa no so, na popa dedaw no DS record (anaasɛ fa foforo no si ananmu DS kyerɛwtohɔ a wo DNS host foforo no ayɛ).
   • Flush na ɛyɛ DS record cache: Ntɛm ara kɔ Google Public DNS Cache Flush (developers.google.com/speed/public-dns/cache) ne Cloudflare Purge Cache (one.one.one.one/purge-cache/) na tew ** no ho .DS** ne DNSKEY kyerɛwtohɔ ahorow ma yourdomain.com enti validating resolvers gyae hwɛ a wɔapopa no DS hash ntɛm ara.

Ɔfã 5: Ahotew wɔ bere a wɔasan agye akyi, TLS adansedi krataa a wɔtwe, ne nea ɛyɛ den¶

Wo domain registrar akontaabu ne DNS kyerɛwtohɔ ahorow a wobɛsan anya wɔ wo tumi ase no yɛ ɔko no fã pɛ. Wɔ nnɔnhwerew anaa nna a ɔtowhyɛfo no dii wo domain no DNS so no, na wɔwɔ tumi a edi mũ a wɔde bɛkyerɛ sɛ "Domain Control Validation" (DCV) de kɔma Adansedi Krataa Tumi biara ( .CA) wɔ okyinnsoromma yi so.

1. Akontaabu Adansedi Krataa a Ɛda Hɔ Ho Nsɛm a Wɔakyerɛw ( .crt.sh) ne Revoke Rogue TLS Adansedi nkrataa¶

Bere a ɔtowhyɛfo bi de ne nsa kyerɛ wo A anaasɛ NS records to wɔn server, wɔyɛ ntɛm ara certbot (Momma yɛnyɛ Encrypt, ZeroSSL, Google Trust Services, anaa Sectigo) na yɛayɛ TLS adansedi nkrataa a ɛfata, a browser-gye di ama yourdomain.com, . *.yourdomain.com, . vpn.yourdomain.com, na mail.yourdomain.com. Sɛ wosan de wo DNS kyerɛwtohɔ ahorow no ba wie mpo a, ɔtowhyɛfo no da so ara kura Private Key (.key) na wɔde wɔn nsa ahyɛ ase Ɔmanfo Adansedi Krataa (.crt) ma wo domain, a wobetumi de ayɛ captive-portal Wi-Fi ntua, BGP hijacks, anaa internal network spoofing wɔ nnafua 90 a edi hɔ no mu.

1. Abisadeɛ Abodin krataa a ɛda adi pefee ho nsɛm:
   • Kɔ ** .crt.sh/?q=%25.yourdomain.com** or Censys Certificate Search (search.censys.io/certificates) na ɛyɛ.
   • Sort by Logged At / . Not Before date and inspect every single certificate issued during the hijack window (and in the 24 hours after recovery, due to cached DCV authorizations).
2. Force Immediate Certificate Revocation:
   • Identify the issuing Certificate Authority (Issuer Name) on every unauthorized certificate.
   • Every publicly trusted CA is required under the CA/Browser Forum Baseline Requirements (Section 4.9.1.1) to revoke a fraudulent or unauthorized certificate within 24 hours of confirming that the applicant was not authorized by the true domain owner.
   • If you already regained DNS control over the domain, you can revoke unauthorized Let's Encrypt or ACME certificates yourself in 60 seconds without even needing the attacker's private key: simply install certbot on a server you control, pass a fresh DNS-01 or HTTP-01 challenge for the exact same domain name using a brand-new ACME account key, and run:

     certbot revoke --cert-path downloaded_rogue_cert_from_crt_sh.pem --reason keycompromise
     

   • Alternatively, submit the Certificate Serial Numbers directly to the CA's emergency revocation portal (for example, Let's Encrypt's revocation instruction page, DigiCert's /revoke portal, or Sectigo's SSL Abuse reporting form).

2. Lock Down Your Domain Permanently So It Can Never Be Hijacked Again¶

Once operations are restored, implement these five enterprise domain-hardening controls:

1. Enable Registry Lock (serverUpdateProhibited, . serverDeleteProhibited, . serverTransferProhibited):
   • For mission-critical production domains, upgrade to a registrar that offers true Registry Lock (supported by Verisign on .com/ ..net, PIR on .org, and offered through enterprise registrars like MarkMonitor,CSC Digital Brand Services, Cloudflare Enterprise, Porkbun/Gandi/Namecheap Registry Lock tiers). With Registry Lock active, even if a hacker steals your registrar login and MFA, the TLD Registry rejects all NS or transfer changes unless a human security officer completes an out-of-band cryptographic/telephone ceremony.
2. Publish CAA (Certification Authority Authorization) DNS Records:
   • Add a CAA record (RFC 8659) to your DNS zone specifying the exact Certificate Authorities allowed to issue TLS certificates for your domain (for example, 0 issue "letsencrypt.org" anaasɛ 0 issue "digicert.com", plus 0 iodef "mailto:security@yourdomain.com"). While an attacker who controls your whole DNS zone can delete a CAA record, a CAA record stops BGP hijackers or compromised subdomain CNAME targets from using unauthorized CAs.
3. Separate Your Domain Registrar from Your Daily DNS Hosting Provider:
   • Keep your domain registration locked inside a high-security vault registrar account that only 2 corporate officers can access using FIDO2 hardware security keys (YubiKey), and delegate daily DNS record management (A, . CNAME, . TXT) to a separate managed DNS service with granular Role-Based Access Control (RBAC) and scoped API tokens.
4. Audit and Eliminate Dangling Subdomain CNAME na NS Records:
   • Run a monthly automated scan of your entire DNS zone file (subzy, . nuclei -t takeovers/, or OWASP Amass) to identify any CNAME, . ALIAS, or subdomain NS record pointing to an unregistered external cloud resource or expired domain, and delete the DNS record before decommissioning the cloud server.
5. Set Up Automated External RDAP, DNS, and CT Log Monitoring:
   • Configure an external monitor (such as CertSpotter, Cloudflare Certificate Transparency Monitoring, or a simple hourly cron script checking dig NS na whois) that alerts a dedicated Slack/PagerDuty channel and an off-domain SMS/email address the exact minute a new TLS certificate is logged in Certificate Transparency or an NS/ .MX/ .DS record changes.

Nsɛm a wɔtaa bisa¶

Sources a wɔhwɛɛ mu¶

• Cybersecurity and Infrastructure Security Agency (CISA, United States): Emergency Directive 19-01: Mitigate DNS Infrastructure Tampering (CISA mandates on Registry Lock, MFA for DNS/Registrars, Certificate Transparency log auditing, and DNSSEC validation) (cisa.gov/news-events/directives/emergency-directive-19-01).
• Internet Corporation for Assigned Names and Numbers (ICANN, International): Transfer Policy (Inter-Registrar Transfer Policy / IRTP), Transfer Dispute Resolution Policy (TDRP), Expired Registration Recovery Policy (ERRP), and EPP Status Codes Reference (icann.org/resources/pages/epp-status-codes-2014-06-16-en).
• National Institute of Standards and Technology (NIST, United States): Special Publication 800-81-2, Secure Domain Name System (DNS) Deployment Guide (csrc.nist.gov).
• National Cyber Security Centre (NCSC, United Kingdom): Protecting Bulk Personal Data and Domain Security: Registry Lock, CAA Records, and Subdomain Takeover Prevention (ncsc.gov.uk).
• CA/Browser Forum (International): Baseline Requirements for the Issuance and Management of Publicly-Trusted TLS Server Certificates (Section 4.9.1.1: 24-Hour Mandatory Revocation for Domain Compromise) (cabforum.org).
• Internet Engineering Task Force (IETF, International): RFC 4033/4034/4035 (DNSSEC), RFC 8659 (DNS Certification Authority Authorization / CAA Resource Record), and RFC 9083 (Registration Data Access Protocol / RDAP) (datatracker.ietf.org).

Akwankyerɛ ahorow a ɛfa ho¶

• Web hosting crisis, migration, and backup restoration
• Phishing ne akontaabu a wɔagye atom
• MFA phishing ne ɔtamfo-wɔ-mfinimfini bypass
• Data breach mmuae ne password leaks
• Business ransomware and server breach
• SIM swapping