Bokangami ya Mokomisi ya Domaine to Mopesi ya DNS: Eleko ya Ngolu ya Bosikoli ya Domaine oyo esilaki, DNSSEC SERVFAIL Motambo, mpe Migration ya Nameserver ya Urgence¶

Kolamuka mpo na koyeba ete site Internet ya libosoliboso ya kompanyi na yo, ba points d’arrêt ya API (api.example.com), mpe email ya kompanyi (MX ba enregistrements ya Google Workspace to Microsoft 365) ekoki kozuama ata moke te na mokili mobimba (DNS_PROBE_FINISHED_NXDOMAIN to mpe SERVFAIL) ezali crise ya infrastructure ya noir total. Na bokeseni na serveur web moko oyo epanzani oyo etali service moko, Système ya Nkombo ya Domaine (DNS) to kozanga kokomisa nkombo ya domaine ekataka service nyonso moko na nse ya domaine ya misisa na yo na mbala moko, bakisa mpe Single Sign-On (SSO), ba portails ya soutien client, mpe ba emails oyo eyaka mpo na ko répondre na incident. Na misala, ba blackouts ya domaine mondial ewutaka na ba déclencheur misato ekeseni: (1) expiration ya domaine par accident esika carte de crédit oyo ezalaki na dossier esilaki mpe registraire a détourner ya yo NS ba dossiers mpo na kolakisa lokasa ya parking oyo efutaka na clique 24 to 48 hours liboso ya mokolo ya solosolo oyo ekosila; (2) attaque ya DDoS to panne ya avion ya contrôle na fournisseur na yo ya DNS oyo azali na bokonzi (Route 53, . Cloudflare, . GoDaddy, . Namecheap, . DNSimple, . NS1); to (3) ebukani DNSSEC (DS enregistrer) chaîne de confiance na tango ya commutation ya serveur ya kombo ya mbangu oyo esalaka ko valider ba résolveurs (8.8.8.8, . 1.1.1.1, ba résolveurs ya ISP) mpo na kokita 100 pour cent ya trafic na yo na SERVFAIL. Soki mobundi asali ba credentiels ya login ya registraire na yo mpe a transférer to a changer domaine na yo na ndenge ya mabe, changer na ko détourner kombo ya domaine, DNS oyo esilaki, mpe kozua site internet; soki certificat na yo ya TLS esilaki to ebukanaki sima ya DNS ezongi, tala Certificat SSL/TLS esilaki na production, lockout ya précharge ya HSTS, mpe renouvellement ya urgence mpe Google Workspace to Microsoft 365 lockout ya administrateur ya domaine personnalisé mpe vérification ya DNS. Soki bokati oyo ezali kopekisa bopanzi sango ya kliniki ya lopitalo, 911/112 routage ya botindiki ya mbalakaka, to ba services publics ya ntina, benga nimero ya urgence ya esika ofandi (911 na États-Unis mpe na Canada, . 112 na Union européenne mobimba, . 999 na Royaume-Uni) to tala na buku na biso ya banimero ya mbalakaka.

Sala boye sikoyo¶

1. Koyeba na 10 secondes soki échec ezali Domaine Expiré/Suspendu (EPP Status), Kokata ya Mopesi ya DNS oyo azali na bokonzi, to a DNSSEC Bozangi ya Validation:
2. Kima mbangu whois yourdomain.com | grep -iE "Status|Expiry|Name Server" mpe dig +trace yourdomain.com.
3. Meká soki ozali ko contourner DNSSEC validation (+cd = Checking Disabled) esalaka ete domaine na yo esila lisusu:

   dig @8.8.8.8 yourdomain.com A
   dig @8.8.8.8 yourdomain.com A +cd
   

   Soki etinda ya liboso ezongi ** .status: SERVFAIL** nzokande etinda ya mibale (+cd) azongi mbala moko ** .status: NOERROR** na adresse IP ya serveur na yo, ba serveurs DNS na yo ezali na se TE: ya yo DNSSEC (DS dossier na registraire) ebukani. Sauter mbala moko na Phase 3 pona ko effacer stale DS kokoma na mokanda na yo.
4. Soki domaine na yo esilaki (Auto-Renew Grace Period to mpe Redemption Grace Period), kota mbala moko na registraire na yo ya lelo mpe futa mbongo ya renouvellement/redemption; KOZELA TE domaine "ekita" po okoka ko enregistrer yango lisusu na talo moke:
5. Na boumeli ya mikolo 1 kino 45 ya liboso nsima ya kosila (Auto-Renew Grace Period), kozongisa sika na tableau de bord ya registraire na yo ezongisaka ba serveurs na yo ya kombo ya ebandeli na coût standard ya renouvellement ($10 to $30).
6. Na boumeli ya 30-mikolo Redemption Grace Period (RGP / . redemptionPeriod), esengeli ofuta mbongo ya bosikoli ya registre obligatoire ($80 to $250) na nzela ya mokomisi na yo ya lelo. Soki ozelaka domaine esila 5-jours Pending Delete phase pona ko sauver $100, ba bots ya ba tirs à tirs oyo ekangamaka na ndenge ya automatique (DropCatch, . SnapNames, . NameJet) ekobɔtɔla domaine na yo na kati 5 milliseconds ya kobimisa mpe kotɛka yango na vant na bankóto ya badolare.
7. JAMAIS changer ba Nameservers na yo (NS) mosika na mopesi ya DNS oyo azali na DNSSEC (lokola Cloudflare, Route 53, to Google Cloud DNS) kozanga kolongola... DS enregistrer liboso na registraire na yo: Soki DNSSEC ezali activé mpe ozali swap ya yo NS ba enregistrements na fournisseur ya DNS ya rescue na tango ya panne sans ko effacer moboti DS (Delegation Signer) kokoma na kati ya .com / . .org Zone TLD liboso, résolveur validant nionso na Mabele akoboya ba réponses sans signature ya fournisseur ya sika ya DNS lokola attaque ya spoofing cryptographique (SERVFAIL).
8. Soki okangami libanda ya entreprise na yo @yourdomain.com email po domaine na yo ya MX ba enregistrements ezali na se, ko cliquer TE "Tinda code ya réinitialisation ya mot de passe na." admin@yourdomain.com" na registraire na yo: Tango ya domaine na yo NS to mpe MX ba dossiers ezali hors ligne, email nionso ya vérification oyo etindami na @yourdomain.com epumbwaka to elimwaka na molɔngɔ. Salelá SMS/Authenticator MFA ya registraire na yo, email ya sauvegarde hors bande (@gmail.com / . @proton.me), to flux ya vérification ya identité ya téléphone.
9. Nsima ya kozongisa sika domaine oyo esilaki, vérifier manuellement que Registrar na yo azongisaki ba Personal Nameservers na yo ya ebandeli (NS) na esika ya kotika domaine na sedoparking.com / . renewyourname.net: Tango domaine moko esili, ba enregistreurs bakomaka likolo ya coutume na yo NS ba enregistrements oyo ezali na ba serveurs ya kombo ya parking (ns1.parklogic.com, . dns1.name-services.com). Tango mosusu kofuta renouvellement ezo mettre à jour date ya expiration na mbula ekoya tango ozali kotika ba serveurs ya kombo ya parking actives tiii tango oko changer yango manuellement.
10. Flush ba caches DNS récursives publiques mondiales (Google 8.8.8.8, . Cloudflare 1.1.1.1, . OpenDNS) ya mibale ya yo NS to mpe DS ba enregistrements ezo zonga: Na esika ya kozela 24 à 48 heures pona cache NXDOMAIN to lokasa ya parking NS ba enregistrements oyo ekosila na ndenge ya nature, e déclenchaka purge ya cache mondiale instantané na Google Public DNS (developers.google.com/speed/public-dns/cache) mpe Cloudflare mpe ya Cloudflare 1.1.1.1 (one.one.one.one/purge-cache/).

Nzete ya mokano: domaine mondial to triage ya urgence ya blackout ya DNS¶

Salelá diagramme oyo mpo na komonisa na bosikisiki couche ya sikisiki ya hiérarchie ya DNS (TLD Registry, . Registrar EPP Status, . DNSSEC DS Chain, to Authoritative Nameserver) esika oyo résolution ezali kolonga te:

flowchart TD
    Start["Kokata na mokili mobimba: Web & Email ya domaine elongi te kosilisa (NXDOMAIN / SERVFAIL)"] --> RunDiag["Kosala: whois domain.com MPE kotimola @8.8.8.8 domaine.com +cd"]

    RunDiag --> CheckCD{"Dig @8.8.8.8 domain.com elongi te, Ntango Kobakisa +cd elongi?"}

    CheckCD -->|"Oui: Esalaka na +cd, Elonga Sans +cd"| DnssecBreak["Chaîne de confiance ya DNSSEC oyo ebukani: Kolongola Enregistrement ya DS ya kala na Zone ya Registrar TO Kozongela ko signer -> Flush 8.8.8.8 & 1.1.1.1"]

    CheckCD -->|"Te: Bango mibale ba échouer to bazongi IP ya parking"| CheckWhois{"Tala Etat ya Domaine ya WHOIS EPP & Date ya expiration"}

    CheckWhois -->|"Ezalela: clientHold to serverHold"| HoldState["Mokomisi / Bopemisi ya registre: Kosilisa Vérification ya Email ya ICANN RAA TO Ticket ya mabe/kofuta mbala moko"]

    CheckWhois -->|"Mokolo ya bosilisi eleki (Ezalela: autoRenewPériod)"| GraceRenew["Mokolo ya 1 kino 45 Après expiration: Futa Renouvellement Standard na Portal ya Registrar -> Verifier NS personnalisé Restauré"]

    CheckWhois -->|"Ezalela: Période ya bosikoli (RGP) ."| RgpRestore["Mokolo ya 45 kino 75 Nsima ya kosila: Fungola Ticket ya lisungi ya mokomisi ya nokinoki / Futa mbongo ya bozongisi ya RGP ($80-$250) Noki"]

    CheckWhois -->|"Ezalela: ezali kozelaKolongola"| PendingDel["Final 5-Day Lock: Ekoki Kozongisama sika te na Registrar -> Kotia Backorders Na Ba Drop-Catchers Nionso Ya minene Sikoyo"]

    CheckWhois -->|"Statut: ok / clientTransferProhibited MPE Esili na mikolo ekoya"| AuthDown["Enregistrement ya domaine Santé -> Panne ya Fournisseur ya DNS Authoritative to Zone oyo ezangi"]

    AuthDown --> MigrateNS["Importer Fichier ya Zone (`BIND` / Terraform) na Fournisseur ya DNS Secondaire -> Longola Enregistrement DS soki DNSSEC On -> Mikolo NS na Registrar"]

Eteni ya 1: Cycle ya bomoi ya bosilisi ya domaine ya ICANN (Auto-Renew vs. Redemption vs. Pending Delete) .¶

Tango Domaine ya Niveau ya Likolo ya Générique (gTLD lokola .com, . .net, . .org, . .io, . .ai, . .co, . .app, . .dev) esili mpo carte de crédit ya auto-renouveau elongaki te to carte ya finance elongolamaki sima ya mosali moko kokende, domaine elekaka na cycle de vie ya makasi ya ba étapes ebele oyo etambwisami na Politique ya récupération ya enregistrement oyo esilaki ya ICANN (ERRP) mpe boyokani ya mosali ya registre (Verisign mpo na .com/.net, . PIR mpo na .org, . Identity Digital).

Ndenge nini domaine ekufaka mpe mpo na nini ekendaka hors ligne AVANT to NA Mokolo ya 1 ya expiration¶

+-------------------------------------------------------------------------+
| ICANN gTLD EXPIRATION TIMELINE (.com / .net / .org example)             |
|                                                                         |
| [Active Domain]                                                         |
|       |                                                                 |
|       v  (Expiration Date Reached: Day 0)                               |
| +---------------------------------------------------------------------+ |
| | STAGE 1: Auto-Renew Grace Period (Day 1 to Day 30-45)               | |
| | - EPP Status: ok or clientHold (Registrar swaps your NS to parking) | |
| | - Production Impact: 100% OFFLINE within 0 to 48 hours of expiry    | |
| | - Recovery: Log into registrar & pay normal renewal ($10-$30).      | |
| +---------------------------------------------------------------------+ |
|       |  (Registrar sends Delete command to Registry at Day 30-45)      |
|       v                                                                 |
| +---------------------------------------------------------------------+ |
| | STAGE 2: Redemption Grace Period [RGP] (Exactly 30 Calendar Days)   | |
| | - EPP Status: redemptionPeriod (Domain removed from TLD Root Zone)  | |
| | - Recovery: Still 100% guaranteed to original owner, MUST pay       | |
| |   Registry RGP Redemption Fee ($80-$250) + renewal via registrar.   | |
| +---------------------------------------------------------------------+ |
|       |  (30-Day RGP expires without redemption payment)                |
|       v                                                                 |
| +---------------------------------------------------------------------+ |
| | STAGE 3: Pending Delete (Exactly 5 Calendar Days)                   | |
| | - EPP Status: pendingDelete                                         | |
| | - Recovery: IMPOSSIBLE to renew or redeem at any price. Registry    | |
| |   rejects all registrar commands until public drop at Day 5 (~18:00 | |
| |   UTC for Verisign .com/.net).                                      | |
| +---------------------------------------------------------------------+ |
+-------------------------------------------------------------------------+

Kokanisa makoki na yo ya sikisiki, ba frais, mpe misala ya bozongisi na kati ya eteni nyonso ya bosilisi, bakisa mpe ba Domaines ya Niveau ya Likolo ya code ya mboka (ccTLDs lokola .uk, . .de, . .eu, . .ca, . .au), oyo elandaka ICANN te gTLD mibeko:

Eteni ya 2: Bozongisi ya litambe na litambe ya to oyo esilaki RedemptionPeriod domaine¶

Landa molongo oyo ya sikisiki mpo na kozongisa domaine oyo esilaki na nzela ya internet na ntango mokuse:

Etape 1: Kozongela nzela ya kokɔta na Compte ya Mokomisi na yo ntango @yourdomain.com email ekufi¶

Tala Catch-22 classique ya domaine oyo esilaki: - Domaine na yo (company.com) esilaki, yango wana MX ba dossiers mpo na company.com atikaki kosilisa mikakatano. - Olukaka kokota na registraire ya domaine na yo (GoDaddy, . Namecheap, . Cloudflare, . Porkbun, . Hover, . Network Solutions, . Gandi), mpe mokomi alobi: "Totindaki code ya vérification ya 6 chiffres na." admin@company.com." ."* - Mpamba te company.com esili, email wana ekoki kokoma jamais.

Ndenge nini kobima na boucle ya email ya domaine oyo esilaki mbala moko: 1. Ko transferer to ko modifier nanu eloko TE: vérifier soki okoki ko spin up catcheur ya mail ya urgence temporaire KAKA soki domaine esili te (soki domaine yango moko e expiré na niveau ya TLD, MX ekoki kosilisa esika moko te kino ekozongisama sika). 2. Salelá Chaîne ya Récupération ya Compte "Accès Email oyo ebungaki / Domaine esili" ya Registrar: - Pene na ba registrateurs nionso oyo ICANN accrédités bapesaka téléphone to flux ya mosala ya vérification ya ID ya gouvernement / document ya entreprise-incorporation-e dédié spécifiquement pona ba clients oyo email ya login na bango efandi @ domaine oyo esilaki na kati ya compte. - Zala na biloko misato prêt avant ya kobenga soutien ya inscription : (a) chiffres 4 ya suka ya carte de crédit to ID ya transaction ya PayPal oyo esalelamaki na facture ya renouvellement ya liboso, (b) ID ya compte ya registre / PIN ya client na yo, mpe © ID ya photo ya gouvernement + Articles d’incorporation / facture d’utilité oyo ekokani na Organisation ya Inscription ya OMS (Tech / Admin / Registrant). 3. Ntango okoti, bongola mbala moko adresse email ya Compte ya Registrar na yo na domaine ya libanda (@gmail.com, . @proton.me, to domaine ya urgence ekeseni oyo ozali na yango) mpe activer Fulé de sécurité matériel (FIDO2) to TOTP Authenticator App MFA donc login e dépend jamais na @company.com email lisusu.

Etape 2: Kosala Renouvellement to RedemptionPeriod (RGP) Kozongisa¶

1. Soki domaine ezali na Stage 1 (Auto-Renew Grace Period, Mikolo 1 kino 30/45):
2. Kende na Fucturation -> Renouvellement to Liste ya domaine -> Filtre expiré mpe futa facture ya renouvellement.
3. Vérification critique 60 secondes après kofuta: Fungola ba Nameservers ya domaine (NS) ba paramètres na tableau de bord ya enregistreur. Tala soki registraire azongisaka automatiquement ba serveurs ya kombo na yo ya solo (ndakisa, . ns-123.awsdns-15.com to mpe ada.ns.cloudflare.com) to atikaki domaine oyo ezali kolakisa ba serveurs na yango ya parking oyo esilaki (ns1.sedoparking.com / . dns1.registrar-servers.com). Soki ba serveurs ya parking ezali kaka na liste, kotisa lisusu na maboko ba serveurs ya kombo ya production na yo mpe bomba.
4. Soki domaine ezali na Stage 2 (Redemption Grace Period / . redemptionPeriod, Mikolo 30/45 kino 75):
5. Tala na onglet ekeseni na kati ya tableau de bord ya enregistreur na yo oyo mbala mingi ekomamaka Domaines expirées -> Redemption, Poubelle / Restaurer, to Fucturation ya ngolu/Rédemption.
6. Futa mbongo ya RGP Restore + renouvellement ya mbula moko.
7. Ndenge nini bozongisi ya RGP esalaka na Registre (Verisign / . PIR)? Tango ofuti mbongo ya RGP, registraire na yo atindaka ** .EPP <update><restore op="request">** etinda na Registre ya TLD. Registre ebongoli mbala moko état ya domaine depuis redemptionPeriod na pendingRestore pe atie ya domaine na yo NS ba enregistrements ezongi na Zone ya misisa ya TLD na kati ya 15 à 60 minutes tango registraire na yo azali kotinda ba restore op="report" bondimisi ya botosi.

Etape 3: Ko contourner ba retards ya cache ya ISP local na purge 8.8.8.8 mpe 1.1.1.1¶

Tango domaine na yo esilaki, ba résolveurs DNS récursifs na mokili mobimba ba cachesaki ba serveurs ya kombo ya parking to ba négatifs NXDOMAIN eyano (etambwisami na ba TLD's SOA Minimum TTL, mbala mingi 900 na 3,600 segɔnde, to 86,400 segɔnde mpo na NS ba dossiers). Moment wana dig @a.gtld-servers.net yourdomain.com NS (kotuna mituna na... .com root server directement) elakisaka lisusu ba serveurs ya kombo ya production na yo ya solo: 1. Fungola Cache ya DNS ya bato banso ya Google (https://developers.google.com/speed/public-dns/cache): - Lolenge ya kosukola ** .NS** liboso mpo na yourdomain.com, na nsima kosukola ** .SOA, A, AAAA, MX, mpe ** .TXT . 2. Fungola Cloudflare 1.1.1.1 Cache ya bopeto (https://one.one.one.one/purge-cache/): - Kopɛtola ** .NS, A, AAAA, mpe ** .MX** mpo na yourdomain.com.

Eteni ya misato: Mosaleli ya nkombo ya mbalakaka (NS) Migration Na tango ya panne ya Fournisseur ya DNS (Mpe ba DNSSEC Motambo)¶

Ezali boni soki enregistrement ya domaine na yo ezali 100 pour cent valide mpe esili te, kasi Provider DNS Autoritable na yo (Route 53, . Cloudflare, . GoDaddy DNS, . DigitalOcean DNS, . Azure DNS, . DNSimple, . Dyn) ezali ko souffrir na panne catastrophique to attaque ya DDoS, mpe esengeli o migrer ba Nameservers ya domaine na yo (NS) na mopesi ya DNS ya sauvegarde sikoyo?

Mobomi ya Migration #1: Kobongola NS Ntango DNSSEC (DS Enregistrer) Ezali Activé¶

Yambo ya kobongola ata moko NS enregistrer na registraire na yo, sala commande oyo pona ko vérifier soki DNSSEC ezali activé na domaine na yo na registre ya TLD ya moboti:

dig +short yourdomain.com DS @8.8.8.8

+-------------------------------------------------------------------------+
| WHY CHANGING NS RECORDS WITH AN ACTIVE DS RECORD BREAKS THE INTERNET    |
|                                                                         |
| 1. Parent TLD (.com) holds your old DNS provider's DS Record (Key #2371)|
| 2. Old DNS Provider goes down. You import zone to New DNS Provider      |
|    (unsigned, or signed with a brand-new Key #9910) and swap NS.        |
| 3. Validating Resolver (8.8.8.8 / 1.1.1.1 / Comcast / ISP) queries      |
|    New DNS Provider, sees signature does NOT match DS Key #2371.        |
| 4. Resolver assumes an active MITM Spoofing Attack -> Returns SERVFAIL  |
| 5. RESULT: Your domain stays 100% dead worldwide even though the new    |
|    DNS servers are up and answering cleanly.                            |
+-------------------------------------------------------------------------+

Liste ya vérification ya migration ya Nameserver ya urgence ya sécurité (Zéro SERVFAIL Ndenge ya kosala)¶

1. Kotonga lisusu to kokɔtisa Fichier Zone DNS na yo mobimba na mopesi ya sika ya DNS liboso:
2. Jamais deviner ba enregistrements DNS na yo na mémoire (@, . www, mpe api ezali mbala mingi te kaka mikanda oyo ekomamaki; kobosana MX, . SPF/TXT, . DKIM, . _dmarc, . autodiscover, to CAA ebukaka bopesi ya email mpe bozongisi sika ya TLS).
3. Epayi wapi okoki kozwa zone DNS na yo mobimba ntango tableau de bord ya mopesi DNS na yo ya liboso ezali na nse:
   • Tala Infrastructure-lokola-Code (Terraform, . Pulumi, . OctoDNS, . DNSControl) na ebombelo na yo ya Git.
   • Tala ba exportations ya zone oyo euti kosalema (BIND .zone ba fichiers) to luka ba bases de données ya DNS ya kala (SecurityTrails, . ViewDNS.info, . DNSDumpster, to Censys / . crt.sh mpo na ba sous-domaines).
   • Ba enregistrements cachés ya requête oyo efandi kaka na kati ya ba résolveurs récursifs publics (dig @8.8.8.8 yourdomain.com MX, . dig @1.1.1.1 yourdomain.com TXT, . dig @9.9.9.9 api.yourdomain.com A) liboso ete ba TTL na bango esila.
4. Vérifier que fournisseur ya sika ya DNS azali ko répondre na autorité pona enregistrement nionso ya critique AVANT ya kosimba registraire na yo: Kanisá ete mopesi na yo ya sika apesaki yo mosala ns1.rescuedns.com mpe ns2.rescuedns.com. Meka bango directement na dig: 1 .

   dig @ns1.rescuedns.com yourdomain.com SOA +norecurse
   dig @ns1.rescuedns.com yourdomain.com A +norecurse
   dig @ns1.rescuedns.com yourdomain.com MX +norecurse
   

   Zela tii ntango... flags: molongo na kati ya dig motó ya likambo esangisi polele ** .aa** (Authoritative Answer) mpe ezongaka status: NOERROR.
5. Soki soki dig +short yourdomain.com DS azongaki a DS enregistrer, kosimba DNSSEC na mosali ya mikanda:
6. Na tango ya panne active esika fournisseur ya kala ya DNS azali totalement inreachable: Kota na Registrar ya domaine na yo (esika osombi domaine), kende na eteni DNSSEC / DS Records, mpe longola nionso DS enregistrements yango wana domaine ezongaka na sans signature (Insecure) mode na zone ya moboti ya TLD. Zelá tii ntango dig +short yourdomain.com DS @a.gtld-servers.net ezongaka pamba (mpe flush DS na 8.8.8.8 / . 1.1.1.1), to bakisa ya ya sika ya mopesi ya DNS DS enregistrer pembeni ya oyo ya kala soki ozali kosala migration multi-signateur oyo ekanamaki.
7. Kobongisa ba Serveurs ya Nkombo (NS) na Mokomisi ya Domaine na yo: Bobongola ba serveurs ya kombo oyo ekufá na ns1.rescuedns.com mpe ns2.rescuedns.com na panneau Custom Nameservers ya registraire na yo (note: kobongwana NS ba enregistrements na kati ya éditeur ya zone esalaka eloko te tango ba serveurs ya kala ekufi; esengeli obongola Glue / Parent Delegation Nameservers na niveau ya Registrar).
8. Kopɛtola NS mpe DS ba caches na Google (8.8.8.8) mpe Cloudflare ( .1.1.1.1): Salelá bisaleli ya kopɛtola cache publique uta na Phase 2 Etape 3 mpo na kotinda na makasi adoption ya mbala moko ya ba serveurs ya sika ya kombo.

Phase 4: Kobika na 60 jours ya ICANN Registrar Transfer Lock na tango ya urgence¶

Est-ce que soki esengeli o transférer domaine na yo na registraire ya sika (ICANN Inter-Registrar Transfer), kaka mpo na kozwa bloqué na ** .Domain Status: clientTransferProhibited** mpe message oyo elobi: "Domaine oyo ezali na se ya 60 jours ICANN Transfer Lock mpo ba informations ya contact ewutaki mise à jour"?

1. Mpo na nini blocage ya mikolo 60 e déclenché: Na se ya Politiki ya botindiki ya ICANN (Eteni II.C.1), ba enregistreurs batiaka blocage ya transfert ya mikolo 60 tango nionso domaine moko ekomamaki sika, e transférer entre ba enregistreurs, to esali "Change ya Inscription" (kosala mise à jour ya Nkombo ya Liboso, Kombo ya Nsuka, Nkombo ya Organisation, to Addresse Email ya contact ya Mokomisi).
2. Ndenge ya ko contourner to ko opter libanda ya lock ya mikolo 60 ya Change-of-Registrant:
3. Yambo ya kobongisa ba détails ya contact ya WHOIS: Pene na ba enregistreurs minene nionso bapesaka boîte de contrôle kaka na écran ya édition ya contact oyo ezali na étiquette: "Op out of the 60-day transfer lock after this contact update." Kotiya elembo na boîte wana epesaka yo nzela ya ko mettre à jour adresse email na yo ya admin/inscription mpe kosala kaka EPP Auth-Code (Transfer Secret) mpo na kopesa domaine yango kaka mokolo wana.
4. Kobosana te ete esengeli TE o transferer enregistrement ya domaine pona ko changer ba fournisseurs ya DNS: Ata soki domaine ekangami mikolo 60 contre Transfers ya Registrar (clientTransferProhibited), okoki kaka kobongola Nameservers (NS dossiers) na registraire ya lelo na tango nionso na période ya kozela zéro ; kobongola DNS esɛngaka miniti, nzokande transfert mobimba ya enregistreur esɛngaka mikolo 5 to 7 longola kaka soki registrateur oyo abungi a cliquer mbala moko Approve Outgoing Transfer (FOa) na bouton.

Phase 5: Koyeisa makasi ba enregistrements ya domaine na DNS contre ba pannes oyo ekoya¶

Soki domaine na yo mpe résolution ya DNS ezongisami 100 pour cent, silisa liste oyo ya vérification ya résilience:

• Kofungola nzela Registry Lock (serverDeleteProhibited, . serverUpdateProhibited, . serverTransferProhibited) na ba domaines ya production oyo ezali na mission-critique: Standard Registrar Lock (clientTransferProhibited) ekoki ko toggled off na clic moko soki attaqueur a détourner login ya registraire na yo. Registry Lock (oyo epesami na Verisign, PIR, Cloudflare, CSC, MarkMonitor, Gandi, mpe Porkbun/Namecheap mpo na ba domaines ya entreprise) ekanga domaine directement na niveau ya Registre TLD, esengaka vérification ya voix/cryptographique ya batu ebele libanda ya bande avant ata moko NS enregistrement ekoki ko changer to domaine e supprimer.
• Kozongisa sika ba domaines ya production pendant 5 à 10 ans avant (ICANN maximum horizon is 10 years): Kotika ata moke te domaine oyo ezali na ntina mingi mpo na mombongo na bozongisi sika mbula na mbula epai wapi carte de crédit ya entreprise moko oyo esilaki ekoki kobimisa panne ya expiration. Pre-pay 5 à 10 ans na mbala moko.
• Kosalela ata moke te an @yourdomain.com adresse email lokola contact ya login to ya notification ya facturation na registraire oyo azali ko gérer yourdomain.com: Salelá liste ya distribution ya sécurité dédiée na domaine administratif indépendant to compte externe dur, mpe monitor RDAP / WHOIS dates d'expiration via monitores prometheus/Uptime externes automatiques (domain_expiry_days < 60).
• Na nse NS mpe DS Ba TTL (300 na 3600 secondes) 48 heures avant migration nionso ya DNS oyo ekanamaki: Kokitisa ba TTL liboso esalaka que ba résolveurs ba changer na kati ya 5 minutes ya cutover oyo ekanamaki.

Mituya ya mbalakaka ya etuka mpe ba protocoles ya agence¶

Tango bokati ya domaine to DNS esali impact na ba installations ya santé, ba services ya urgence, ba utilités municipales, to ba infrastructures ya gouvernement, landa ba voies oyo ya escalation régionale:

• Etats-Unis na Canada: Benga 911 soki bokati ya domaine/DNS e désactiver télémétrie clinique ya lopitalo, dispatch ya ambulance, to ba systèmes ya sécurité ya vie. Lakisa ba attaques ya DDoS na infrastructure ya DNS to na détournement ya BGP/DNS na CISA (1-844-Say-CISA / . cisa.gov/report), ba FBI IC3 (ic3.gov), to Centre canadien ya sécurité cybernétique (1-833-CYBER-88). Mpo na .gov ba domaines, benga na CISA .gov Bureau ya lisalisi ya Mokomisi nkombo.
• Royaume-Uni: Benga 999 mpo na makama ya bomoi to bopanzani ya NHS ya makasi. Lakisa ba pannements ya DNS ya critique to ba détournements ya domaine na NCSC (ncsc.gov.uk), mpe bokutana na Moponi (01865 332244) directement pona urgent .uk / . .gov.uk / . .nhs.uk makambo ya registre.
• Union européenne: Benga 112 na kati ya ba Etats membres nionso ya UE. Ba fournisseurs ya service DNS mpe ba registres ya ba kombo ya TLD ezali réglementés na se ya Directive NIS2 ya UE (Directive 2022/2555) mpe basengeli koyebisa makambo ya ntina ya bozali na CSIRT na bango ya ekolo na kati ya ngonga 24.
• Australie na Nouvelle-Zélande: Benga 000 na Australie to ** .111** na Nouvelle-Zélande; koyebisa makambo ya ntina mingi ya DNS to ya domaine na ACSC (1300 CYBER1), auDA (mpo na .au), to Commission ya Nkombo ya Domaine NZ (mpo na .nz).
• Inde na Asie-Pacifique: Benga 112 na Inde mpo na eyano ya nokinoki; koyebisa ba attaques ya infrastructure ya DNS/domaine na CERT-In (incident@cert-in.org.in) na kati ya ngonga 6 to NIXI mpo na .in ba escalations ya registre.

Mituna oyo batunaka mingi¶

Pourquoi domaine na ngai etikalaki kosala 24 heures AVANT temps officiel na yango ya expiration WHOIS?¶

Ya liboso, talá ba fuseaux horaires: WHOIS `Registry Expiry Date` enyatamaka ntango nyonso na **UTC (`Z`)**, oyo ezali ngonga 4 to 8 liboso ya ba fuseaux horaires ya Amérique du Nord (elingi koloba domaine moko ekosila na `2026-11-01T04:00:00Z` esili mpenza na ngonga ya `8:00 PM PDT` na mokolo ya 31 Ɔkɔtɔbɛ). Ya mibale, soki ya yo `NS` ba dossiers ezalaki na a `24-hour` to mpe `48-hour` TTL na registraire ba échanger bango na `00:00 UTC` na mokolo ya kosila, basaleli oyo ba résolveurs na bango ezongisami sika liboso babɛtaka mbala moko lokasa ya parking nzokande basusu batikalaka na cache na boumeli ya bangonga mingi.

Mokomisi na ngai azali mpenza na mosala te to azali koyanola te (Dead / De-accredited Registrar), mpe domaine na ngai ezali kosila. Ndenge nini nakoki kobikisa yango?¶

Tango ICANN esili to elongoli accrédité mokomi oyo alongi te na se ya **Procédure ya transition ya registre dé-accrédité (`DARTP`)**, ICANN e transférer automatiquement en gros ba domaines nionso na enregistreur ya gardien oyo azali ko gagner na coût zéro na ba inscriptions. Vérifier `whois yourdomain.com` (to `lookup.icann.org`) mpo na komona **Registrar** mpe **ID IANA** nini ezali na domaine na yo na tango oyo, to kosala **Plainte ya noki noki **Renouveauté ya domaine / transfert** directement na **ICANN Contractual Compliance (`icann.org/compliance/complaint`)**.

Pourquoi site na ngai ezali kosala pona ba clients misusu na ba données cellulaires, mais ezo lakisa kaka page ya parking expiré na Wi-Fi ya bureau na biso 6 heures après na renouveler domaine?¶

Réseau ya bureau na yo to résolveur DNS récursif ya ISP local e cacheki parking-page ya registraire `NS` mpe `A` ba enregistrements tango domaine esilaki, mpe ba serveurs ya kombo ya parking notoirement ba mettre ba TTL ya likolo (`3,600` na `86,400` secondes / 24 heures) yango wana ba pages ya ba publicités etikalaka na cache tango molayi. Flush Google (`8.8.8.8`) mpe Cloudflare ( .`1.1.1.1`) kosalela bisaleli na bango ya kopɛtola web, na nsima na ordinatɛrɛ na yo ya esika ozali kotambola `ipconfig /flushdns` (Bafenetre), . `sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder` (macOS), to mpe `sudo resolvectl flush-caches` (Linux) oyo ezali na kati.

Nini Esalemaka Na Ba Emails Batindami na @yourdomain.com Tango Domaine to DNS Na biso Ezalaki Expiré Pendant 18 Heures? Babungi Libela?¶

Mbala mingi, . ba emails légitimes oyo etindami na boumeli ya ngonga 12 kino 48 ya liboso ya panne ya DNS ebungaka TE: ezali na molongo na serveur ya mail ya motindi mpe ekokoma automatiquement na mwa bangonga oyo ekolanda. Na nse ya ** .`RFC 5321` (Protocole ya botindiki mikanda ya pete, Eteni 4.5.4.1)**, tango serveur ya botindiki ya ba mail (`Gmail`, . `Microsoft Exchange Online`, . `Postfix`) azwi bozangi ya boluki ya DNS mpo na mwa ntango (`SERVFAIL`) to akoki te kozala na boyokani na an `MX` hôte, etie message na molongo ya komeka lisusu pendant **4 à 5 jours (`96 to 120 hours`)**, komeka lisusu na bozongisi sima ya exponentiel. Kasi, soki lokasa ya parking ya registraire oyo esilaki ezalaki na **wildcard null `MX` enregistrement (`0 .`)** to serveur ya mail ya parking oyo eboyaki mail na hard `550 5.1.1 User Unknown` rebond permanent, ba tindi wana bazuaki notification ya rebond ya mbala moko mpe basengeli kotinda lisusu ba emails na bango.

Nakoki kosala ba fournisseurs mibale ya DNS na mbala moko (Cloudflare + Route 53) kaka na kotanga ba Cloudflare mibale NS ba dossiers mpe mibale Route 53 NS ba dossiers na registraire na ngai?¶

Ɛɛ, . ntango nyonso oyo `DNSSEC` ezali désactivé (to configuré malamu na `RFC 8901` Multi-Signer DNSSEC) mpe ba fournisseurs nionso mibale basalelaka ba enregistrements DNS identiques. Ba résolveurs récursifs ba requêter ba parent nionso oyo ba liste `NS` ba enregistrements oyo esalelaka pona ya latence ya round-robin/RTT (`SRTT`). Soki ozali na liste `ns1.providerA.com`, . `ns2.providerA.com`, . `ns1.providerB.com`, mpe `ns2.providerB.com` na ba NameServers Personnalisés ya registraire na yo mpe bomba ba zones nionso mibale synchronisées na kosalelaka **OctoDNS**, **DNSControl**, **Terraform**, to `AXFR / IXFR` ba transferts ya zone, domaine na yo ebikaka automatiquement na panne ya 100 pour cent ya fournisseur moko to mosusu ya DNS.

Bokeseni nini ezali kati na clientHold mpe serverHold na NANI?¶

Ba code ya état ya EPP oyo ebandi na ** .`client...`** (`clientHold`, . `clientTransferProhibited`) etiamaki na **Mokomisi ya Domaine** na yo (motɛki esika ozali kotambwisa kɔnti na yo, lokola Namecheap to GoDaddy) mpe ekoki kolongola yango mbala moko na lisungi to système ya kofuta ya mokomisi na yo. Ba code ya état oyo ebandi na **`server...`** (`serverHold`, . `serverTransferProhibited`) etiamaki mbala moko na **Opérateur ya registre ya TLD** (`Verisign`, . `PIR`, . `Nominet`) mpo na mitindo ya esambiselo, matata ya UDRP, bopemisi ya mabe na niveau ya registre, to matériel **Registry Lock**, mpe esengaka kokutana na Registre na nzela ya registraire na yo mpo na kotombola.

Ba guides oyo etali yango¶

• Ko détourner kombo ya domaine, DNS oyo esilaki, mpe kozua site internet
• Certificat SSL/TLS esilaki na production, lockout ya précharge ya HSTS, blocage ya enregistrement ya CA CAA, mpe renouvellement ya urgence
• Google Workspace to Microsoft 365 lockout ya administrateur ya domaine personnalisé, vérification ya DNS TXT, mpe kobikisa ba locataires
• Détournement ya DNS, reconfiguration ya WAN ya routeur ISP, mpe spoofing ya portail captive
• Crise ya hébergement web, migration, na restauration ya sauvegarde
• Mituya ya mbalakaka na kotalela mboka

Maziba mpe bokambi ya Leta¶

• Société Internet mpo na bankombo mpe mituya oyo bapesi (ICANN): Politiki ya kozongisama ya bokomisi nkombo oyo esilaki (ERRP), Politiki ya kosilisa domaine oyo esilaki (EDDP), Politiki ya botiami na kati ya bakomisi nkombo (Bokangami ya mikolo 60 ya mbongwana ya bakomi), mpe Botali ya ba Codes ya ezalela ya EPP (clientHold, . redemptionPeriod, . pendingDelete).
• Etuluku ya mosala ya Ingénierie Internet (IETF): * .RFC 6781 (Misala ya misala ya DNSSEC: Ba Rollovers ya ntina mpe ya mbalakaka DS Kolongola) & . RFC 8901 (Modèles DNSSEC ya ba signeurs ebele pona DNS Authoritative ya ba fournisseurs ebele)*.
• Institut national ya ba normes mpe ya technologie (NIST) (Etats-Unis): Mokanda ya sipesiale 800-81-2: Système ya ba kombo ya domaine ya libateli (DNS) Buku ya bopanzi sango.
• Agence ya cybersécurité mpe ya sécurité ya ba infrastructures (CISA) (Etats-Unis): Directive ya urgence 19-01: Kokitisa mbongwana ya ba infrastructures ya DNS.
• Agence ya Union européenne mpo na sécurité cybernétique (ENISA): Bokambami ya tekiniki ya NIS2 mpo na ba Fournisseurs ya Service ya DNS mpe ba registres ya ba kombo ya TLD.