Magatakarda na yanki ko Ƙarfin Mai Ba da Sabis na DNS: Ƙarewar Ƙarshen Ƙarshen Ƙarshen Ƙarfafawa, DNSSEC SERVFAIL Tarko, da Hijira Mai Sunan Gaggawa¶

Farkawa don gano cewa babban gidan yanar gizon kamfanin ku, API ɗin ƙarshensa (api.example.com), da kuma imel na kamfani (MX faifan Google Workspace ko Microsoft 365) ba a iya samun su gaba ɗaya a duk faɗin duniya (DNS_PROBE_FINISHED_NXDOMAIN ko SERVFAIL) rikicin ababen more rayuwa ne gaba daya. Ba kamar sabar gidan yanar gizo guda ɗaya da ta ruɗe da ta shafi sabis ɗaya ba, Tsarin Sunan yanki (DNS) ko gazawar rajistar yanki ya raba kowane sabis guda ɗaya a ƙarƙashin yankin tushen ku a lokaci guda, gami da Sa hannu guda ɗaya (Kun shiga ɗaya).SSO), hanyoyin goyan bayan abokin ciniki, da saƙon saƙon amsawa mai shigowa. A aikace, duhun yanki na duniya ya samo asali ne daga abubuwa daban-daban guda uku: (1) ** ƙarewar yanki mai haɗari ** inda katin kiredit a fayil ya ƙare kuma mai rejista ya sace ka. NS rubuce-rubuce don nuna zuwa shafi-per-click parking page 24 to 48 hours kafin ainihin ranar karewa; (2) harin DDoS ko katsewar jirgin sama a mai ba da sabis na DNS na ku (Route 53, Cloudflare, GoDaddy, Namecheap, DNSimple, NS1); ko (3) a ** karye DNSSEC (DS rikodin) sarkar amana *** a lokacin saurin mai suna uwar garken wanda ke haifar da masu tabbatarwa (8.8.8.8, 1.1.1.1, ISP masu warwarewa) don sauke kashi 100 na zirga-zirgar ku tare da SERVFAIL. Idan maharin ya ɓata shaidar shiga mai rejista kuma ya canza ko ya canza yankinku da mugunta, canza zuwa satar sunan yankin, ƙarewar DNS, da karɓar gidan yanar gizo; idan takardar shaidar TLS ta ƙare ko karya bayan an dawo da DNS, duba Takaddun SSL/TLS ta ƙare a samarwa, HSTS kulle kullewa, da sabuntawar gaggawa kuma Google Workspace ko Microsoft 365 kulle admin yankin al'ada da kuma tabbatar da DNS. Idan wannan katsewar ta hana sadarwar asibiti ta asibiti, 911/112 isar da agajin gaggawa, ko kayan aikin jama'a masu mahimmanci, kira lambar gaggawa ta gida.911 a Amurka da Kanada, 112 a fadin Tarayyar Turai, 999 a Ƙasar Ingila) ko tuntuɓi littafinmu na lambobin gaggawa.

Yi wannan yanzu¶

1. Bincika a cikin daƙiƙa 10 ko gazawar yanki ne da Karewa ne/An dakatar da shi (EPP Status), Ƙarfin Mai Ba da Sabis na DNS, ko a DNSSEC Rashin Tabbatarwa:
2. Gudu whois yourdomain.com | grep -iE "Status|Expiry|Name Server" kuma dig +trace yourdomain.com.
3. Gwada ko wucewa DNSSEC tabbatarwa (+cd = Duban Disabled) yana sa yankinku ya sake warwarewa:

   dig @8.8.8.8 yourdomain.com A
   dig @8.8.8.8 yourdomain.com A +cd
   

   Idan umarnin farko ya dawo status: SERVFAIL yayin umarni na biyu (+cdnan take ya dawostatus: NOERROR tare da adireshin IP na uwar garken ku, **Sabar DNS ɗin ku ba ta ƙasa: naku DNSSEC (DS rikodin a mai rejista) ya karye ***. Tsallaka nan da nan zuwa Mataki na 3 don share tsattsauran ra'ayi DS yin rikodi a mai rejista.
4. **Idan yankinku ya ƙare (Auto-Renew Grace Period ko Redemption Grace Period), shiga cikin mai rejista na yanzu kuma ku biya kuɗin sabuntawa / fansa; KADA KA jira yankin ya "saukar" don haka zaka iya sake yi masa rajista da rahusa ***:
5. A cikin kwanaki 1 zuwa 45 na farko** bayan karewa (Auto-Renew Grace Period), sabuntawa a cikin dashboard ɗin mai rejista yana maido da sabar sunan asalin ku akan daidaitaccen farashin sabuntawa ($10 to $30).
6. Lokacin 30-day Redemption Grace Period (RGP / redemptionPeriod**, dole ne ku biya kuɗin fansa na wajibi na rajista ($80 to $250) ta hannun magatakardan ku na yanzu. Idan kun jira yankin ya gama 5-day Pending Delete lokaci don adanawa $100, Bots na maharbi mai sarrafa kansa (DropCatch, SnapNames, NameJet) zai kwace yankin ku a ciki 5 milliseconds na saki kuma a yi gwanjonsa na dubban daloli.
7. **KADA KA canza Sabar Suna (NS) nesa da mai bada sabis na DNSSEC (kamar Cloudflare, Route 53, ko Google Cloud DNS) ba tare da cirewa ba. DS yin rikodi a mai rejista na farko ***: Idan DNSSEC an kunna kuma kuna musanya naku NS yin rikodin zuwa mai ba da sabis na DNS mai ceto yayin fita ba tare da share iyaye ba DS (Delegation Signer) rikodin a cikin .com / .org Yankin TLD da farko, kowane mai daidaitawa a Duniya zai ƙi sabon martanin da ba a sanya hannu ba na mai ba da sabis na DNS azaman harin ɓarna mai ɓoyewa (SERVFAIL).
8. ** Idan an kulle ku daga kamfanin ku @yourdomain.com imel saboda yankinku MX records sun kasa, KADA danna "Aika lambar sake saitin kalmar sirri zuwa admin@yourdomain.com"a mai rejista**: Yayin yankinku NS ko MX bayanan suna layi, duk wani imel ɗin tabbatarwa da aka aika zuwa gare shi @yourdomain.com bounces ko bace cikin jerin gwano. Yi amfani da SMS/Magance MFA na mai rejista, imel ɗin ajiyar waje na waje (@gmail.com / @proton.me), ko kwararar tabbatar da shaidar waya.
9. Bayan sabunta yankin da ya ƙare, da hannu tabbatar da cewa magatakardan ku ya maido da asalin sabar Sunan naku na Musamman (NS) maimakon barin yankin a kunne sedoparking.com / renewyourname.net: Lokacin da yanki ya ƙare, masu rijista suna sake rubuta al'adar ku NS records tare da na'urorin ajiye motoci (parking nameservers)ns1.parklogic.com, dns1.name-services.com). Wani lokaci biyan sabuntawar yana sabunta ranar karewa zuwa shekara mai zuwa yayin barin masu ba da izinin ajiye motoci suna aiki har sai kun canza su da hannu.
10. ** Cire caches na DNS na jama'a na yau da kullun (Google 8.8.8.8, Cloudflare 1.1.1.1, OpenDNS) na biyu ku NS ko DS an dawo da bayanan ***: Maimakon jira awanni 24 zuwa 48 don cache NXDOMAIN ko filin ajiye motoci NS bayanan don ƙarewa ta zahiri, haifar da share cache na duniya nan take a Google Public DNS (developers.google.com/speed/public-dns/cache) da Cloudflare 1.1.1.1 (one.one.one.one/purge-cache/).

Bishiyar yanke shawara: yanki na duniya ko ƙaddamarwar gaggawa ta DNS¶

Yi amfani da wannan ginshiƙi mai gudana don nuna ainihin Layer na matsayi na DNS (TLD Registry, Registrar EPP Status, DNSSEC DS Chain, ko Authoritative Nameserver) inda ƙuduri ya gaza:

flowchart TD
    Start["Lalacewar Duniya: Gidan Yanar Gizon Yanar Gizo & Imel Rashin Magancewa (NXDOMAIN / SERVFAIL)"] --> RunDiag["Gudu: whois domain.com DA tona @8.8.8.8 domain.com + cd"]

    RunDiag --> CheckCD{"Yana tona @8.8.8.8 domain.com Kasa, Yayin Ƙara + cd Ya Yi Nasara?"}

    CheckCD -->|"Ee: Yana aiki tare da +cd, ya kasa ba tare da + cd ba"| DnssecBreak["Karshe Sarkar Amincewa ta DNSSEC: Share Stale DS Record a magatakarda KO Sake Sa hannu -> Flush 8.8.8.8 & 1.1.1.1"]

    CheckCD -->|"A'a: Dukansu sun kasa ko Koma Kiliya IP"| CheckWhois{"Duba WHOIS EPP Matsayin Domain & Ranar Karewa"}

    CheckWhois -->|"Matsayi: clientHold ko uwar garken"| HoldState["Dakatar da magatakarda / Rijista: Cikakkar ICANN RAA Tabbacin Imel KO Zagi/Tikitin Biyan Kuɗi Nan da nan"]

    CheckWhois -->|"Ƙarshen Ƙarshen Ƙarshen (Yanayin: autoRenewPeriod)"| GraceRenew["Ranar 1 zuwa 45 Bayan Ƙarfafawa: Biyan Sabunta Daidaitacce a Portal Magatakarda -> Tabbatar da Maido da NS na Musamman"]

    CheckWhois -->|"Matsayi: Lokacin fansa (RGP)"| RgpRestore["Ranar 45 zuwa 75 Bayan Karewa: Buɗe Tikitin Tallafin Magatakarda na Gaggawa / Biyan Kuɗin Mayar da RGP ($80-$250) Nan take"]

    CheckWhois -->|"Matsayi: yana jiran Share"| PendingDel["Kulle Kwanaki 5 na Ƙarshe: Ba za a iya Sabuntawa a Magatakarda ba -> Sanya Dokokin Baya ga Duk Manyan Masu Kame Yanzu"]

    CheckWhois -->|"Matsayi: ok / Abokin ciniki An haramta Canja wurin DA Karewa a nan gaba"| AuthDown["Rajistar Yanki Lafiya -> Ragewar Mai Ba da Sabis na DNS ko Yankin Rasa"]

    AuthDown --> MigrateNS["Shigo Fayil na Yanki (`BIND` / Terraform) zuwa Mai ba da Sabis na DNS na biyu -> Cire Rikodin DS idan DNSSEC Kunna -> Sabunta NS a Magatakarda"]

Mataki na 1: Tsawon Rayuwar Karewa Domain ICANN (Auto-Renew vs. Redemption vs. Pending Delete)¶

Lokacin Babban Matsayin Babban Matsayi (gTLD kamar .com, .net, .org, .io, .ai, .co, .app, .dev) ya ƙare saboda sabon katin kiredit na atomatik ya gaza ko kuma an soke katin kuɗi bayan ma'aikaci ya tafi, yankin yana wucewa ta tsauraran matakan rayuwa masu yawa wanda ICANN's Expired Registration Recovery Policy (ERRP* da yarjejeniyar ma'aikacin rajista (Verisign domin .com/.net, PIR domin .org, Identity Digital).

Yadda yanki ke mutuwa da kuma dalilin da yasa yake zuwa layi KAFIN ko RANAR 1 na ƙarewa¶

+-------------------------------------------------------------------------+
| ICANN gTLD EXPIRATION TIMELINE (.com / .net / .org example)             |
|                                                                         |
| [Active Domain]                                                         |
|       |                                                                 |
|       v  (Expiration Date Reached: Day 0)                               |
| +---------------------------------------------------------------------+ |
| | STAGE 1: Auto-Renew Grace Period (Day 1 to Day 30-45)               | |
| | - EPP Status: ok or clientHold (Registrar swaps your NS to parking) | |
| | - Production Impact: 100% OFFLINE within 0 to 48 hours of expiry    | |
| | - Recovery: Log into registrar & pay normal renewal ($10-$30).      | |
| +---------------------------------------------------------------------+ |
|       |  (Registrar sends Delete command to Registry at Day 30-45)      |
|       v                                                                 |
| +---------------------------------------------------------------------+ |
| | STAGE 2: Redemption Grace Period [RGP] (Exactly 30 Calendar Days)   | |
| | - EPP Status: redemptionPeriod (Domain removed from TLD Root Zone)  | |
| | - Recovery: Still 100% guaranteed to original owner, MUST pay       | |
| |   Registry RGP Redemption Fee ($80-$250) + renewal via registrar.   | |
| +---------------------------------------------------------------------+ |
|       |  (30-Day RGP expires without redemption payment)                |
|       v                                                                 |
| +---------------------------------------------------------------------+ |
| | STAGE 3: Pending Delete (Exactly 5 Calendar Days)                   | |
| | - EPP Status: pendingDelete                                         | |
| | - Recovery: IMPOSSIBLE to renew or redeem at any price. Registry    | |
| |   rejects all registrar commands until public drop at Day 5 (~18:00 | |
| |   UTC for Verisign .com/.net).                                      | |
| +---------------------------------------------------------------------+ |
+-------------------------------------------------------------------------+

Kwatanta ainihin haƙƙoƙinku, farashin ku, da ayyukan dawo da ku a kowane mataki na ƙarewa, gami da Babban-Level Domains na lambar ƙasa (ccTLDs kamar .uk, .de, .eu, .ca, .au), wanda ba* bin ICANN gTLD dokoki:

Mataki na 2: Farfadowa mataki-mataki na wanda ya ƙare ko RedemptionPeriod yankin¶

Bi wannan madaidaicin jeri don dawo da yankin da ya ƙare akan layi a cikin ɗan gajeren lokaci mai yuwuwa:

Mataki 1: Sake samun dama ga Asusun Magatakarda ku lokacin @yourdomain.com imel ya mutu¶

Anan ga babban Catch-22 na yankin da ya ƙare: - yankinku (company.com) ƙarewa, haka MX records ga company.com daina warwarewa. - Kuna ƙoƙarin shiga cikin rajistar yankinku (GoDaddy, Namecheap, Cloudflare, Porkbun, Hover, Network Solutions, Gandi), kuma magatakardar ya ce: "Mun aika da lambar tabbatarwa mai lamba 6 zuwa admin@company.com." - Domin company.com ya ƙare, imel ɗin ba zai taɓa zuwa ba.

Yadda ake fita daga madauki imel ɗin yanki da ya ƙare nan da nan: 1. ** Kar a canja wurin ko canza wani abu tukuna: duba idan za ku iya jujjuya mai kamawa na gaggawa na wucin gadi KAWAI idan yankin bai ƙare ba (idan yankin da kansa ya ƙare a matakin TLD, MX ba zai iya warware ko'ina ba har sai an sabunta)**. 2. Yi amfani da "Lost Email Access/ Domain Expire" Channel farfadowa da na'ura mai rijista: - Kusan duk masu rijistar ICANN da aka amince da su suna ba da keɓaɓɓen waya ko aikin ID na gwamnati / kamfani-haɗin-haɗin-takardun aiki musamman ga abokan cinikin da imel ɗin shiga yake zaune. @ yankin da ya ƙare a cikin asusun. - Shirya abubuwa guda uku kafin kiran tallafin mai rejista: (a) ** lambobi 4 na ƙarshe na katin kiredit ** ko ID ɗin ma'amala na PayPal da aka yi amfani da su akan daftarin sabuntawa na baya, (b) ID ɗin asusun rajista / Abokin Ciniki , da © ** ID na hoto na gwamnati + Labaran Haɗin kai / lissafin amfani *** daidai da Kungiyar Masu rijista ta WHOIS (Tech / Admin / Registrant). 3. Da zarar an shiga, nan da nan canza adireshin imel ɗin Majigilar ku zuwa wani yanki na waje (@gmail.com, @proton.me, ko wani yanki na gaggawa na daban da kuka mallaka) kuma kunna ** Maɓallin Tsaro na Hardware (FIDO2 ko ** TOTP Authenticator App* MFA don haka shiga baya dogara da hakan @company.com imel kuma.

Mataki 2: Yi Sabuntawa ko RedemptionPeriod (RGP) Maidawa¶

1. ** Idan yankin yana cikin mataki na 1 (Auto-Renew Grace Period, Kwanaki 1 zuwa 30/45)**:
2. Je zuwa Biyan Kuɗi -> Sabuntawa ko Jerin yanki -> Tace Mai ƙarewa kuma ku biya daftarin sabuntawa.
3. Binciken Mahimmanci na daƙiƙa 60 bayan biyan kuɗi: Buɗe uwar garken suna NS* saituna a cikin dashboard mai rejista. Bincika ko mai rejista ta atomatik ya mayar da sabar na ainihi (misali, ns-123.awsdns-15.com ko ada.ns.cloudflare.com) ko barin yankin yana nuni ga sabar-sabar da ta kare (parking)ns1.sedoparking.com / dns1.registrar-servers.com). Idan har yanzu ana jera sabar wuraren ajiye motoci, da hannu sake shigar da masu samar da suna kuma ajiye.
4. ** Idan yankin yana cikin mataki na 2 (Redemption Grace Period / redemptionPeriod, Kwanaki 30/45 zuwa 75)**:
5. Duba cikin wani shafin daban a cikin dashboard ɗin mai rejista sau da yawa mai lakabi ** Wuraren da suka ƙare -> Fansa**, ** Shara / Mayarwa ***, ko Grace/Biyan Kuɗi.
6. Biyan kuɗin Mayar da RGP + sabuntawa na shekara 1.
7. Ta yaya aikin RGP yake aiki a Registry (Verisign / PIR)? Lokacin da kuka biya kuɗin RGP, mai rejista ya aika da EPP <update><restore op="request"> umarnin zuwa TLD Registry. Rijistar nan take ta canza matsayin yankin daga redemptionPeriod ku pendingRestore ** kuma yana sanya yankinku NS yin rikodin baya cikin Tushen TLD a cikin mintuna 15 zuwa 60** yayin da mai rejista ya gabatar da restore op="report" tabbatar da yarda.

Mataki 3: Ketare jinkirin cache na gida ta ISP ta sharewa 8.8.8.8 kuma 1.1.1.1¶

Lokacin da yankinku ya ƙare, masu gyara DNS masu maimaitawa a duk duniya sun adana masu amfani da filin ajiye motoci ko mara kyau. NXDOMAIN martani (wanda TLD's ke gudanarwa SOA Minimum TTL, yawanci 900 ku 3,600 seconds, ko 86,400 dakika don NS records). Lokacin dig @a.gtld-servers.net yourdomain.com NS (tambaya da .com tushen uwar garken kai tsaye) yana sake nuna ainihin masu samar da suna: 1. Buɗe ** Google Public DNS Flush Cache** (https://developers.google.com/speed/public-dns/cache): - Nau'in ruwa NS na farko don yourdomain.com,sannan ki watsarSOA, A, AAAA, MXkumaTXT. 2. Buɗe ** Cloudflare 1.1.1.1 Tsabtace Cache** (https://one.one.one.one/purge-cache/): - Tsaftace NS, A, AAAAkumaMX za yourdomain.com.

Mataki na 3: Sabar Sunan Gaggawa (NS) Hijira A Lokacin Ƙullawar Mai Ba da Sabis na DNS (Kuma DNSSEC tarko)¶

Me zai faru idan rajistar yankin ku yana da inganci kashi 100 kuma bai ƙare ba, amma ** Mai ba da DNS mai izini *** (Route 53, Cloudflare, GoDaddy DNS, DigitalOcean DNS, Azure DNS, DNSimple, Dyn) yana fama da bala'i ko harin DDoS, kuma kuna buƙatar ƙaura Servers Nameservers (NS) zuwa ga mai bada sabis na DNS a yanzu?

Kisan Hijira na #1: Sauyawa NS Yayin DNSSEC (DS Rikodi) An Kunna¶

Kafin canza guda ɗaya NS yi rikodin a mai rejista, gudanar da wannan umarni don bincika ko DNSSEC an kunna kan yankin ku a wurin rajistar iyaye TLD:

dig +short yourdomain.com DS @8.8.8.8

+-------------------------------------------------------------------------+
| WHY CHANGING NS RECORDS WITH AN ACTIVE DS RECORD BREAKS THE INTERNET    |
|                                                                         |
| 1. Parent TLD (.com) holds your old DNS provider's DS Record (Key #2371)|
| 2. Old DNS Provider goes down. You import zone to New DNS Provider      |
|    (unsigned, or signed with a brand-new Key #9910) and swap NS.        |
| 3. Validating Resolver (8.8.8.8 / 1.1.1.1 / Comcast / ISP) queries      |
|    New DNS Provider, sees signature does NOT match DS Key #2371.        |
| 4. Resolver assumes an active MITM Spoofing Attack -> Returns SERVFAIL  |
| 5. RESULT: Your domain stays 100% dead worldwide even though the new    |
|    DNS servers are up and answering cleanly.                            |
+-------------------------------------------------------------------------+

Amintaccen Lissafin Hijira Mai Suna Server (Zero SERVFAIL Tsari)¶

1. ** Sake ginawa ko shigo da cikakken Fayil na Yanki na DNS a sabon mai ba da DNS na farko ***:
2. Kada ku taɓa tunanin bayanan DNS ɗinku daga ƙwaƙwalwar ajiya (@, www, kuma api ba kasafai ne kawai bayanan ba; mantuwa MX, SPF/TXT, DKIM, _dmarc, autodiscover, ko CAA karya isar da imel da sabuntawar TLS).
3. Inda za a sami cikakken yankin ku na DNS lokacin da babban dashboard ɗin mai ba da sabis na DNS ɗin ku ya ƙare:
   • ** Bincika Kayan Aiki-as-Code (Terraform, Pulumi, OctoDNS, DNSControl*** a cikin ma'ajiyar Git.
   • Duba fitar da yankin kwanan nan (BIND .zone fayiloli) ko bincika bayanan bayanan DNS na tarihi (SecurityTrails, ViewDNS.info, DNSDumpster, ko Censys / crt.sh don subdomains).
   • Tambayoyin da aka adana har yanzu suna zaune a cikin masu warware matsalar jama'a (dig @8.8.8.8 yourdomain.com MX, dig @1.1.1.1 yourdomain.com TXT, dig @9.9.9.9 api.yourdomain.com A) kafin TTL su ƙare.
4. Tabbatar da sabon mai ba da sabis na DNS yana amsa da izini ga kowane rikodin mahimmanci KAFIN taɓa mai rejista: A ce sabon mai ba da sabis ya ba ku ns1.rescuedns.com kuma ns2.rescuedns.com. Gwada su kai tsaye da dig:

   dig @ns1.rescuedns.com yourdomain.com SOA +norecurse
   dig @ns1.rescuedns.com yourdomain.com A +norecurse
   dig @ns1.rescuedns.com yourdomain.com MX +norecurse
   

   Jira har sai flags: layi a cikin dig rubutun kai tsaye ya haɗa da aa (Authoritative Answer) kuma ya dawo status: NOERROR.
5. Idan dig +short yourdomain.com DS dawo a DS rikodin, rike DNSSEC na rejista:
6. Lokacin kashewa mai aiki inda tsohon mai ba da sabis na DNS gaba ɗaya ba zai iya isa ba: Shiga cikin Mai rijistar yanki* (inda kuka sayi yankin), je zuwa sashin DNSSEC / DS Records, kuma ** share duk DS rikodin** don haka yankin ya koma mara sa hannu (Insecure) yanayin a yankin iyaye na TLD. Jira har sai dig +short yourdomain.com DS @a.gtld-servers.net ya dawo fanko (kuma yayi ruwa DS in 8.8.8.8 / 1.1.1.1), ko ƙara *sabon *** sabobin DNS DS yin rikodin tare da tsohon idan yin ƙaura mai sa hannu da yawa da aka tsara.
7. ** Sabunta sunan uwar garke (NS) a Domain Registrar **: Sauya matattun masu suna da ns1.rescuedns.com kuma ns2.rescuedns.com a cikin kwamitin Custom Nameservers mai rejista (bayanin kula: canzawa NS rubuce-rubucen da ke cikin editan yankin ba komai lokacin da tsoffin sabobin suka mutu; Dole ne ku canza Manne / Wakilin Wakilan Iyaye a matakin magatakarda).
8. ** Tsaftace NS kuma DS caches akan Google (8.8.8.8da Cloudflare (1.1.1.1***: Yi amfani da kayan aikin share cache na jama'a daga Mataki na 2 Mataki na 3 don tilasta ɗaukar sabbin sabar suna nan take.

Mataki na 4: Tsira Makullin Canja wurin Magaji na ICANN na kwanaki 60 a lokacin gaggawa¶

Menene idan kuna buƙatar canja wurin yankinku zuwa sabon mai rejista (ICANN Inter-Registrar Transfer), kawai don toshe ta Domain Status: clientTransferProhibited da saƙon da ke cewa: "Wannan yanki yana ƙarƙashin Kulle Canja wurin kwanaki 60 na ICANN saboda an sabunta bayanan tuntuɓar kwanan nan"?

1. ** Me yasa kulle kwana 60 ya jawo *: A ƙarƙashin ** ICANN Policy Canja wurin (Sashe II.C.1), masu rajista suna sanya kullewar kwanaki 60 a duk lokacin da wani yanki ya kasance sabon rajista, canjawa wuri tsakanin masu rijista, ko kuma ya sami "Canjin Registrant" (yana sabunta Sunan Farko, Sunan Ƙarshe, Sunan Ƙungiya, adireshin imel).
2. Yadda ake ƙetare ko fita daga Canjin-Makulli na kwana 60:
3. **Kafin a gyara bayanan tuntuɓar WHOIS ***: Kusan duk manyan masu rejista suna ba da akwati daidai akan allon gyare-gyaren tuntuɓar mai lamba: "Fita daga kullewar canja wuri na kwanaki 60 bayan wannan sabuntawar tuntuɓar." Duba wannan akwatin yana ba ku damar sabunta adireshin imel ɗin admin/mai rejista kuma har yanzu yana samar da saƙon. EPP Auth-Code (Transfer Secret) don canja wurin yankin a rana guda.
4. Ka tuna cewa ba kwa buƙatar canja wurin rajistar yankin don canza masu samar da DNS : Ko da an kulle yanki na kwanaki 60 akan * Canja wurin Magaji * (clientTransferProhibited), har yanzu kuna iya canza sabar ta * * Nameservers (NS records) a mai rejista na yanzu a kowane lokaci ba tare da lokacin jira ba; canza DNS yana ɗaukar mintuna, yayin da cikakken canja wurin mai rejista yana ɗaukar kwanaki 5 zuwa 7 sai dai idan mai rejista da ya ɓace ya danna nan take ** Amincewa da Canja wurin Mai fita (FOa button.

Mataki na 5: Ƙaddamar da rajistar yanki da DNS akan abubuwan da ke gaba¶

Da zarar yankinku da ƙudurin DNS an dawo da kashi 100, kammala wannan jerin abubuwan da suka dace:

• ** Kunna Registry Lock (serverDeleteProhibited, serverUpdateProhibited, serverTransferProhibited) akan yankunan samarwa masu mahimmancin manufa ***: Standard Registrar Lock (clientTransferProhibited) za'a iya kashe shi tare da dannawa ɗaya idan maharin ya sace shiga rajistar ku. ** Kulle Rijista *** (wanda Verisign, PIR, Cloudflare, CSC, MarkMonitor, Gandi, da Porkbun/ Namecheap ke bayarwa don wuraren kasuwanci) yana kulle yankin kai tsaye a matakin rajistar TLD, yana buƙatar tabbatar da muryar mutum da yawa/cryptographic kafin kowane. NS ana iya canza rikodin ko share yankin.
• ** Sabunta wuraren samarwa na shekaru 5 zuwa 10 a gaba (ICANN maximum horizon is 10 years***: Kar a taɓa barin yanki mai mahimmanci na kasuwanci akan sabuntawar shekara zuwa shekara inda katin kiredit na kamfani guda ɗaya zai iya haifar da ƙarewar ƙarewar. Pre-biya 5 zuwa shekaru 10 lokaci guda.
• Kada kayi amfani da wani @yourdomain.com Adireshin imel a matsayin lambar shiga ko sanarwar biyan kuɗi a ma'aikacin mai rejista yourdomain.com: Yi amfani da keɓaɓɓen lissafin tsaro na rarraba akan yankin gudanarwa mai zaman kansa ko taurare asusu na waje, da saka idanu RDAP / WHOIS kwanakin ƙarewa ta hanyar Prometheus / Uptime na waje mai sarrafa kansa (domain_expiry_days < 60).
• ** Kasa NS kuma DS TTLs (300 ku 3600 seconds) Sa'o'i 48 kafin duk wani ƙaura na DNS da aka shirya ***: Rage TTLs a gaba yana tabbatar da cewa masu warwarewa sun canza cikin mintuna 5 na yanke hukunci.

Lambobin gaggawa na yanki da ka'idojin hukumar¶

Lokacin da yanki ko kashewar DNS ya shafi wuraren kiwon lafiya, sabis na gaggawa, abubuwan amfani na birni, ko kayan aikin gwamnati, bi waɗannan tashoshi na haɓaka yanki:

• Amurka da Kanada: Dial 911 idan yanki/katsewar DNS ya hana telemetry na asibiti na asibiti, aika motar asibiti, ko tsarin amincin rayuwa. Bayar da rahoton harin DDoS akan ababen more rayuwa na DNS ko BGP/DNS sace zuwa CISA (1-844-Say-CISA / cisa.gov/report, FBI IC3 (ic3.gov, ko ** Cibiyar Tsaro ta Intanet ta Kanada (Cibiyar Tsaro ta Intanet)1-833-CYBER-88). Domin .gov yanki, tuntuɓi CISA .gov Registrar HelpDesk.
• ** United Kingdom *: Dial 999 don barazana ga rayuwa ko tsangwama na NHS. Bayar da rahoto mai mahimmancin fitar da DNS ko satar yanki zuwa NCSC (ncsc.gov.uk, da kuma tuntuɓar ** Nominet (01865 332244 kai tsaye ga gaggawa .uk / .gov.uk / .nhs.uk al'amurran yin rajista.
• Ƙungiyar Tarayyar Turai: Dial112* a duk ƙasashe membobin EU. Ana tsara masu ba da sabis na DNS da rajistar suna TLD a ƙarƙashin ** EU NIS2 Directive (Directive 2022/2555** kuma dole ne su ba da rahoton mahimman abubuwan da suka faru ga CSIRT na ƙasa a cikin sa'o'i 24.
• ** Ostiraliya da New Zealand ***: Kiran kira 000 a Ostiraliya ko 111 a New Zealand; bayar da rahoton mahimman abubuwan da suka faru na DNS ko yanki ga ACSC (1300 CYBER1 **aA (don .au),o Hukumar Sunan yanki NZ (don .nz).
• **Indiya da Asiya-Pacific **: Kiran kira 112 a Indiya don amsa gaggawa; bayar da rahoton hare-haren abubuwan more rayuwa na DNS/ yanki zuwa CERT-In (incident@cert-in.org.in a cikin awanni 6 ko NIXI don .in karuwar rajista.

Tambayoyin da ake yawan yi¶

Me yasa yankina ya daina aiki sa'o'i 24 KAFIN tambarin lokacin ƙarewar WHOIS?¶

Na farko, duba wuraren lokaci: WHOIS `Registry Expiry Date` ana buga shi koyaushe a **UTC (`Z`**, wanda ke gaban sa'o'i 4 zuwa 8 gaba da sa'o'i na Arewacin Amurka (ma'ana yanki yana ƙarewa a `2026-11-01T04:00:00Z` a zahiri ya ƙare a `8:00 PM PDT` Oktoba 31). Na biyu, idan ka `NS` records sun kasance a `24-hour` ko `48-hour` TTL da mai rejista sun musanya su a `00:00 UTC` a ranar karewa, masu amfani waɗanda masu warwarewarsu suka farfaɗo da wuri sun bugi filin ajiye motoci nan da nan yayin da wasu ke ajiyewa na sa'o'i.

Mai rejista na gaba daya ya fita kasuwanci ko ya kasa amsa (Dead / De-accredited Registrar), kuma yankina yana ƙarewa. Ta yaya zan ceto shi?¶

Lokacin da ICANN ta ƙare ko ba da izini ga mai rejista da ya gaza a ƙarƙashin Tsarin Canjin Rijistar Magaji mara izini (**)`DARTP`**, ICANN ta atomatik girma-yana canja wurin duk yankuna zuwa mai rejista mai rikodi akan farashin sifili ga masu rajista. Duba `whois yourdomain.com` (ko `lookup.icann.org`) don ganin wane ** magatakarda *** da ** IANA ID *** a halin yanzu ke riƙe yankinku, ko shigar da gaggawa ** Sabunta yanki / Kokarin Canja wurin ** kai tsaye tare da * Yarjejeniyar Kwangilar ICANN (`icann.org/compliance/complaint`)**.

Me yasa gidan yanar gizona yake aiki ga wasu abokan ciniki akan bayanan wayar hannu, amma har yanzu yana nuna shafin ajiye motoci da ya ƙare akan ofishin mu Wi-Fi 6 hours bayan na sabunta yankin?¶

Cibiyar sadarwar ofis ɗin ku ko ISP na gida mai jujjuyawa DNS mai warwarewa ya adana shafin-parkin mai rejista `NS` kuma `A` rikodin yayin da yankin ya ƙare, kuma masu amfani da filin ajiye motoci sanannen suna saita manyan TTLs (`3,600` ku `86,400` seconds / 24 hours) don haka shafukan talla sun daɗe suna adanawa. Goge Google (`8.8.8.8`da Cloudflare (`1.1.1.1`) ta amfani da kayan aikin tsabtace gidan yanar gizon su, sannan a kan kwamfutar ku ta gida `ipconfig /flushdns` (Windows), `sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder` (macOS), ko `sudo resolvectl flush-caches` (Linux).

Me ke Faruwa da Saƙonnin Imel da Aka Aiko zuwa gare su @yourdomain.com Yayin da Domain mu ko DNS ya ƙare na sa'o'i 18? Shin Sun Bace Har Abada?¶

A mafi yawan lokuta, Imel na halal da aka aika a cikin sa'o'i 12 zuwa 48 na farko na katsewar DNS ba su ɓace ba: ana yin layi akan sabar saƙon mai aikawa kuma za su zo ta atomatik cikin ƴan sa'o'i masu zuwa.. Karkashin **`RFC 5321` (Ƙa'idar Canja wurin Saƙo mai Sauƙi, Sashe na 4.5.4.1)**, lokacin da sabar saƙon aika (`Gmail`, `Microsoft Exchange Online`, `Postfix`) ya sami gazawar binciken DNS na ɗan lokaci (`SERVFAIL`) ko ba zai iya haɗi zuwa wani `MX` Mai watsa shiri, yana sanya saƙon a cikin layin sake gwadawa na kwanaki 4 zuwa 5 (`96 to 120 hours`***, sake gwadawa tare da koma baya mai ma'ana. Koyaya, idan shafi na filin ajiye motoci na mai rejista ya ƙunshi ** mara amfani da katin daji `MX` rikodin (`0 .`*** ko uwar garken mail ɗin ajiye motoci wanda ya ƙi saƙo tare da wuya `550 5.1.1 User Unknown` billa na dindindin, waɗancan masu aikawa sun sami sanarwar billa nan take kuma dole ne su sake aika imel ɗin su.

Zan iya saita masu samar da DNS guda biyu a lokaci guda (Cloudflare + Route 53) kawai ta hanyar jera Cloudflare guda biyu NS Rubuce-rubucen da Hanyar Biyu 53 NS rubuce-rubuce a magatakarda na?¶

Ee, idan dai `DNSSEC` an kashe (ko an daidaita shi da kyau tare da `RFC 8901` Multi-Signer DNSSEC) da duka masu samarwa suna hidimar rikodin DNS iri ɗaya. Tambayoyi masu warware maimaitawa suna tambayar duk iyaye da aka jera `NS` yin amfani da zaɓin latency na zagaye-robin/RTT (`SRTT`). Idan ka lissafta `ns1.providerA.com`, `ns2.providerA.com`, `ns1.providerB.com`, kuma `ns2.providerB.com` a cikin Sabar Sunan Kwastomomi na magatakarda ku kuma kiyaye sassan biyu suna aiki tare ta amfani da **OctoDNS**, **DNSControl**, **Terraform**, ko `AXFR / IXFR` Canja wurin yanki, yankinku yana tsira ta atomatik daga kashi 100 na kowane mai ba da sabis na DNS.

Menene bambanci tsakanin clientHold kuma serverHold a cikin WHOIS?¶

Lambobin matsayin EPP suna farawa da **`client...`** (`clientHold`, `clientTransferProhibited`) *Mai rijistar yanki** (dillalin da kake sarrafa asusunka, kamar Namecheap ko GoDaddy) ne ya saita kuma ana iya cire shi nan da nan ta hanyar tallafin mai rejista ko tsarin biyan kuɗi. Lambobin matsayi suna farawa da **`server...`** (`serverHold`, `serverTransferProhibited`) an saita su kai tsaye ta **TLD Registry Operator** (`Verisign`, `PIR`, `Nominet`) saboda umarnin kotu, rigingimun UDRP, matakin dakatarwar cin zarafi, ko kayan aiki ** Kulle Rijista**, kuma suna buƙatar tuntuɓar Registry ta wurin mai rejista don ɗagawa.

Jagora masu alaƙa¶

• Satar sunan yanki, ƙarewar DNS, da karɓar gidan yanar gizo
• Takardar shaidar SSL/TLS ta ƙare a samarwa, HSTS preload lockout, CA CAA rikodin toshe, da sabuntawar gaggawa
• Google Workspace ko Microsoft 365 kulle admin na al'ada, tabbatar da TXT DNS, da ceton masu haya
• Satar DNS, ISP na'ura mai ba da hanya tsakanin hanyoyin sadarwa WAN sake daidaitawa, da ƙwanƙwasa tashar tashar jirgin ruwa
• Rikicin karbar bakuncin gidan yanar gizo, ƙaura, da maidowa madadin
• Lambobin gaggawa ta ƙasa

Tushen da jagorar hukuma¶

• Kamfanin Intanet don Sunaye da Lambobi (Lambobi)ICANN): Manufar Maido da Rijista ta ƙare (ERRPManufofin Share Domain da ya ƙare (EDDP), Manufar Canja wurin Magatakarda (Makulle Canjin Kwanaki 60), da Tunanin Lambobin Matsayin EPP (clientHold, redemptionPeriod, pendingDelete).
• Rundunar Injiniya ta Intanet (IETF::RFC 6781 (DNSSEC Ayyuka na Ayyuka: Maɓallin Maɓalli da Gaggawa DS Cire) & RFC 8901 (Multi-Signer DNSSEC Model don Multi-Signer Izini DNS).
• Cibiyar Ƙididdiga da Fasaha ta Ƙasa (NIST) (Amurka): Buga na Musamman 800-81-2: Amintaccen Tsarin Sunan yanki (DNS) Jagoran Aiwatarwa.
• Hukumar Tsaro ta Yanar Gizo da TsaroCISA) (Amurka): Umargancin Gaggawa 19-01: Rage Taimakawa Kayayyakin Kayayyakin Ciniki na DNS.
• Hukumar Tarayyar Turai don Tsaro ta Intanet (ENISA): NIS2 Jagorar Fasaha don Masu Ba da Sabis na DNS da Rijistar Sunan TLD.