Domain name hijacking, DNS poisoning, and registrar lockout¶

Kujimija bukokeshi pa dina dia kumpala dia bulongolodi bueba anyi pa tshitupa tshia DNS tshia bukokeshi mbumue bua ku malu mabi a bungi adi mua kufikila mudimu, lupitadi, tshibambalu tshia musoko anyi mikanda ya ku Enternete. Bu mudi dina diebe dia domaine dikale muji wa dieyemena dia tshiamu tshionso tshia ku Enternete, muena tshinyangu udi unyanga konte webe wa domaine anyi unyangakaja mikanda yebe ya DNS kena anu unyanga site webe to. Mu minite mikese ya kushintulula NS (Nameserver), A/AAAA (Web IP), anyi MX (Mail Exchange) udi ufunda, muena tshinyangu udi mua kuangata mu tshimpitshimpi e-mail yonso udi ulua wa kumpanyi ne wa basumbishi, kupitshila mu tshiamu tshia Let's Encrypt Domain Validation (DV) udi utangila bua kuenza mikanda ya TLS/SSL idi mikumbane mu dina diebe, kuangata meyi a tshisokomenu a bena mudimu (SSO), ne kuenza mudimu ne meyi a tshisokomenu a dipingaja dia meyi a tshisokomenu bua tshiamu tshieba tshia ku matutu, tshiibi tshia banke, ne konte yebe ya makuta. Nansha dipanga dia malu adi kaayi mabi, bu mudi domaine mufue udi upona mu AutoRenewGracePeriod anyi RedemptionPeriod (clientHold].

Shi dikuata dia tshitupa anyi dijimija dia DNS didi dinyangakaja njila wa babedi ba mu lupitadi, dimanyisha dia malu a tshimpitshimpi, telemetre ya mudimu wa bantu bonso, anyi tshiamu tshia mudimu tshia bukubi bua muoyo, bikila nimero wa tshimpitshimpi wa muaba unudi (911 mu États-Unis ne mu Canada, 112 mu matunga masanga a ku Mputu, 999 mu Royaume-Uni) anyi tangila mukanda wetu wa malu a pa buloba bujima nomba ya tshimpitshimpi ne kumanyisha tshisumbu tshieba tshia ditunga tshidi tshitangila malu a ku Enternete (bu mudi CISA mu États-Unis ku 1-844-SAY-CISA anyi NCSC mu Royaume-Uni) diakamue. Bua bilumbu bionso bia bungenda, bia tshianana, ne bia muntu nkayende, enza malu adi kuinshi eku mu bulongame bulelela.

Enza nunku mpindieu¶

1. Manya mu masekonde 30 ni domaine webe mmufue, DNS webe mmushintuluke, anyi domaine mmufidibue kudi mufundi wa ku babende: Enza mudimu RDAP anyi WHOIS lukonku ne lukonku lua DNS lua bukokeshi lua ku terminal (rdap yourdomain.com anyi whois yourdomain.com, ne dig +trace yourdomain.com). Tangila Dîna dia mufundi, Kode ya nsombelu wa EPP (bu mudi clientHold bua difuta/dijadika vs. ok ne nameservers idi kayiyi mimanyike), ne Authoritative Nameservers (NS).
2. Imanyika mudimu wonso wa dipingaja dia meyi a tshisokomenu ne kanga tshiamu tshieba tshia dimanyisha (Okta, Microsoft Entra ID, Google Workspace) diakamue: Shi muntu udi ukubunda udi ukokesha tshitupa tshieba MX mikanda anyi NS ba-server, badi bapeta e-mail yonso udibu batuma kudi *@yourdomain.com. Diakamue, ambila balombodi bebe ba malu a ordinatere bua kuimanyika "Forgot Password via Email" self-service resets mu biamu bionso bia mudimu, kumbusha sessions actives bua bena mudimu badi ne adrese ya e-mail idi mua kuikala mienza mudimu bua kupingaja konte ya basumbishi ba pambelu, ne kushintulula logins administratifs ku hardware FIDO2 security keys anyi internal .onmicrosoft.com miaba ya kupingana kunyima.
3. Lama binjinjimbi bionso bia RDAP/WHOIS, DNS zones, ne Certificat Transparency (CT) logs kumpala kua tshintu tshionso kushintuluka: Lama tshipeta tshia dig ANY yourdomain.com @8.8.8.8, whois yourdomain.com, ne tangila crt.sh/?q=%25.yourdomain.com mpindieu. Kukeba crt.sh reveals every unauthorized SSL/TLS certificate the attacker just minted for your subdomains (mail., vpn., login., api.) nunku udi mumanye bimpe midimu ya munda idibu benza ku diambuluisha dia Adversary-in-the-Middle (AitM) proxy.
4. Uyukile ne tshisumbu tshia malu a njiwu / a bukubi tshia mufidi wa mikanda udi mujimije (ki mbua diambuluisha dia Tier-1 to) bua kujula tshilumbu tshia difila dia bintu bidi kabiyi bianyishibue kudi ICANN (IRTP) anyi Registry Lock reversal: Shi domaine webe uvua mufidibue ku konte mukuabu ku registrar umue umue au anyi mufidibue ku diambuluisha dia tshintu tshiiba Auth-Info (EPP) kode kudi mufundi wa ku babende, yukila ne mufundi webe wa kumpala Domain Abuse / High-Risk Security Escalation Desk ne ulombe diakamue Registrar Undo / Emergency Transfer Dispute muinshi mua ICANN Transfer Policy (Section I.A ne Transfer Dispute Resolution Policy), citing unauthorized credential compromise.
5. Escalate directly to the Top-Level Domain (TLD) Registry Operator if the registrar is unresponsive: Remember the hierarchy: Registrars (like GoDaddy, Namecheap, Cloudflare, MarkMonitor, Network Solutions, Gandi, Porkbun) are simply retail resellers; the Registry Operator (such as Verisign for .com/.net, Public Interest Registry (PIR) for .org, Nominet for .uk, CIRA for .ca, DENIC for .de, or auDA for .au) runs the master root zone database. Country-code (ccTLD) registries and several gTLD registries can place an emergency serverHold anyi serverUpdateProhibited lock directly at the root level during verified cybercrime incidents.
6. Warn customers, vendors, and banking partners through out-of-band channels that @yourdomain.com email is compromised: If the attacker hijacked your MX records, they will immediately reply to open accounting threads with fake wire transfer instructions. Notify clients via telephone, SMS, LinkedIn, status page on a separate backup domain, or official social media accounts not to trust any email or login portal on the affected domain until restoration is confirmed.

Decision tree: diagnosing and containing a domain or DNS outage¶

Follow this rapid diagnostic flowchart to pinpoint the exact layer of the Domain Name System that has failed or been hijacked:

flowchart TD
    A["Website Down, TLS Certificate Warning, or Corporate Email Halted"] --> B["Run RDAP/WHOIS & dig +trace from External Network"]
    B --> C{"What do RDAP Status & Registrar Fields Show?"}
    C -->|"Status: clientHold, autoRenewPeriod, or redemptionPeriod"| D["Accidental Expiration or ICANN Whois Verification Suspension"]
    D --> E["Log into Registrar Immediately: Pay Renewal / Redemption Fee or Click RAA Verification Link; Request Emergency TTL Flush"]
    C -->|"Registrar Name or Registrant Account Changed Without Authorization"| F["Full Registrar Account Hijack or Unauthorized EPP Transfer"]
    F --> G["Lock Identity Provider (Entra/Google), File Emergency Registrar Abuse Ticket + ICANN Transfer Dispute, Check crt.sh for Rogue Certs"]
    C -->|"Registrar & NS Unchanged, but A / CNAME / MX Records Point to Unknown IPs"| H["Managed DNS Provider Compromise (Cloudflare / Route53 / NS1 API Key or Account Breach)"]
    H --> I["Revoke Compromised DNS API Tokens, Restore Known-Good Zone File, Revoke Rogue TLS Certs, Rotate Exposed Credentials"]
    C -->|"Mufundi, NS, ne mikanda ya zone idi imueneka bu ya pa tshibidilu, kadi site udi upanga ne SERVFAIL"| J["DNSSEC Chain of Trust (DS Record Mismatch anyi Expired RRSIG)"]
    J --> K["Enza DNSViz.net Tangila: Umbusha mukanda wa kale wa DS ku Registrar anyi Re-Sign Zone ku DNS Host"]

Tshitupa 1: Dikonkonona dia malu a mikenji bua kumanya tshidi tshifikisha ku dibunda¶

Padi domaine ulekela kuenza mudimu mu tshimpitshimpi anyi utuadija kufila dibeji dia phishing anyi dishima dia cryptocurrency, minite yonso udibu bapitshisha mu diela meji udi ujimija dîba dia mushinga mukole dia kupingaja. Kudi mishindu inayi mishilangane idi imueneka bu ya muena mudimu wa ndekelu mu tshikebelu tshia ku Enternete, ne yonso udi ulomba dilongolola dishilangane.

Mua kubala RDAP, WHOIS, ne dig Bipeta bu mudi muntu udi wandamuna ku njiwu¶

Kangula tshiamu tshia mudimu pa Linux, macOS, anyi Windows (kuenza mudimu ne WSL anyi nslookup) ne wenza makebulula asatu adi alonda aa ku diambuluisha dia tshiamu tshia neutral public recursive resolver (8.8.8.8 anyi 1.1.1.1):

1. Tangila difila dia bintu bia mu tshitupa tshia difunda dia mêna (dig +trace ne RDAP):

   dig +trace yourdomain.com NS @1.1.1.1
   

   • Tangila tshitupa tshidi tshilonda kunyima kua TLD root servers (tshilejilu, a.gtld-servers.net. bua .com). Tshinyi NS (Nameserver) mêna a bena mudimu adi apingajibua kudi TLD Registry nkayende anyi?
   • Shi TLD Registry upingaja name server yebe ya pa tshibidilu (ns1.yourdnsprovider.com) ne nsombelu NOERROR, dikuata dia bintu didi dienzeka munda mua DNS hosting provider webe (anyi ndinyanguka dia DNSSEC).
   • Shi TLD Registry upingaja name server idi kayiyi mimanyike (nansha shi whois yourdomain.com udi uleja tshintu tshipiatshipia Registrar: dina ne Updated Date: mu meba makese anyi matuku makese a ndekelu), dikuata dia bintu diakenzeka ku tshidiidi tshia mufundi wa domaine.
2. Kumbusha ICANN EPP Domain Status Codes: Tangila Domain Status: milongo mu tshieba WHOIS anyi RDAP tshipatuka. Ma code a Extensible Provisioning Protocol (EPP) adi akuambila bua tshinyi domaine udi unyanguka anyi mukanga:

Tshitupa 2: Kupingana kunyima kua dikuata dia domaine mubi anyi dituma dia mufundi udi kayi muanyishibue¶

Bena tshinyangu badi bakuata bintu bia mushinga mukole bia kumpanyi, Web3/DeFi, malu a mfranga, ne a ngumu ku diambuluisha dia mishindu isatu minene: 1. Dikuata dia konte wa muena mudimu (Diuja dia mikanda ya dianyisha, Infostealer Malware, anyi SIM Swap): Muntu udi ukubunda udi ubuela mu GoDaddy, Namecheap, Google Domains/Squarespace, anyi Network Solutions dashboard, udi ujima clientTransferProhibited, udi ushintulula NS udi ufunda bua kuleja konte wa Cloudflare udibu bakokesha kudi muena tshinyangu, anyi udi upatula Auth-Info (EPP) code bua kufila domaine pambelu. 2. Social Engineering of Registrar Support: Muntu udi uluisha udi utuma mikanda ya dishima ya dijadika dia tshisumbu, mikanda ya dishima ya mbulamatadi, anyi mukanda wa dishima ku biro bia dipingaja dia konte wa mufundi wamba ne: mulombodi wa IT wa kumpala mmufue anyi mmulekele kumpanyi. 3. Diangata dia tshitupa tshikese (Dangling CNAME / Dangling NS): Tshitupa tshieba tshinene katshiena tshilengejibua to, kadi tshitupa tshia kale (promo.yourdomain.com anyi status.yourdomain.com) utshidi anu ne CNAME tshikandakanda tshidi tshileja tshibombi tshia AWS S3 tshidi katshiyi tshienza mudimu, Azure App Service, GitHub Pages repo, Heroku app, anyi Zendesk instance uuvua mujimije ngondo ya bungi mipite eyi. Muntu udi uluisha udi ufunda dina dia bintu bia mu matutu bidibu balekele pa AWS/Azure/GitHub ne diakamue udi utuma bintu bibi bia mu tshitupa tshiebe tshia mbulamatadi.

Tshitupa 1: Umbusha muntu udi ukubunda mu tshiamu tshieba tshia Cloud ne mu tshiamu tshia e-mail¶

Kumpala kua wewe kujikija diuja dia formilere wa dipingaja dia bintu, ela meji ne: muntu udi ukubunda udi ubala e-mail yonso udibu batuma ku domaine webe ne udi uteta bua kubuela mu tshiamu tshiebe tshia munda:

1. Shintula Microsoft 365 / Google Workspace ku Fallback Domains ne Hardware MFA:
   • Mu Microsoft Entra ID (kumpala Azure AD), muena nzubu yonso udi ne tshitupa tshia kashidi, tshidi katshiyi mua kukuata (yourcompany.onmicrosoft.com). Balombodi badi mua kubuela ku diambuluisha dia admin@yourcompany.onmicrosoft.com nansha shi yourdomain.com DNS mmukuata tshishiki.
   • Imanyika mishindu yonso ya SMS, dibikila dia dîyi, ne mishindu mikuabu ya kupingaja mot de passe mu Entra ID / Okta / Google Workspace (Authentication Methods Policy). Bidi bikengela FIDO2/WebAuthn hardware security keys anyi nomba-matching Authenticator push notifications.
2. Tangila mikanda ya e-mail idi ipatuka ne idi ibuela bua dididishi dia diumvuangana dilelela:
   • Shi MX malu avua mashintuluke pa dîba dia 02:14 UTC, kakuena mesaje a pambelu adi malelela adi mafike ku biamu biebe bia mudimu katshia ku dîba dia 02:14 UTC to; e-mail yonso wa pambelu uvuabu batumine bena mudimu bebe mu tshikondo atshi uvua muangatshibue mu mukanda mujima kudi tshiamu tshia mudimu tshia muena tshibawu (Postfix/Exim listener).
   • Diakamue, ela liste wa tshiamu tshionso tshia SaaS tshia bantu bakuabu, banke, konte wa AWS/GCP, bulongolodi bua GitHub, ne tshibuelelu tshia bapanyi tshidi tshilamakaja kudi @yourdomain.com adrese ya e-mail, ne kutangila ni muena tshibawu uvua muenze bua bapingaje meyi a tshisokomenu pa biamu bia pambelu abi mu tshikondo tshia dikuata dia bintu.

Tshitupa 2: Enza mudimu wa Registrar ne Registry Emergency Recovery Protocol¶

Kukangula muyuki wa diambuluisha wa "Site wanyi kena wenza mudimu to." Udi ne tshia kuenza mudimu ne miaku ya mikenji ne ya mikenji idi mua kufikisha ku dibandisha dia Registrar Tier-3 Security / General Counsel / ICANN Compliance Team:

1. Tshilumbu A: Tshitupa tshidi anu kudi mufundi weba wa kumpala (diangatshila dia konte anyi "difila dia konte" wa munda):
   • Bantu ba bungi badi baluisha kabatu bindile matuku 5 bua difila dia EPP pankatshi pa bafundi to; Pamutu pa nanku, badi benza mudimu ne tshiamu tshia "Push Domain to Another Account" tshia mufundi bua kufila domaine webe mu konte wa burner ku muena mufundi mu masekonde 3.
   • Bikila ne ufundile Tshibambalu tshia dishima / Dikuata dia konte / Dinyanga dia makuta tshia mufundi diakamue. Amba patoke ne: "BUALU BUA KUDIMUENA: Dibuela mu konte didi kadiyi dianyishibue ne dishintulula dia domaine wa munda / Dishintulula dia DNS dia [yourdomain.com]. Dilomba dia kuimanyika domaine diakamue muinshi mua serverHold/clientUpdateProhibited ne dipingaja dia mashintuluka a DNS/Account adi kaayi maanyishibue."
   • Sangisha tshijadiki tshiebe tshia bumfumu bua kale diakamue: Bisumbu bia bukubi bia bafundi bidi bikengela bijadiki bidi kabiyi mua kupingana bia se: udi mufundi wa kumpala kumpala kua bobu kupingaja domaine ku konte mukuabu. Usangishe mikanda itano eyi mu PDF umua diakamue:
     1. Ma facture a kale a mufundi wa mikanda ne bijadiki bia difuta: Bipetu bia PDF ne mikanda ya karte ka mfranga / ya ku banke idi ileja bulongolodi buenu budi bufuta bua difunda ne dipingaja dia yourdomain.com mu bidimu 1 too ne ku 10 bishale ebi (kusangisha ne nomba 4 ya ndekelu ya karte ka difuta anyi ya tshiamu tshia nzembu).
     2. Mukanda wa mbulamatadi mufila kudi mbulamatadi ne ID wa muena mudimu: Mukanda wa dianyisha dia mbulamatadi / Mikenji ya bulongolodi idi ipetangana ne WHOIS wa kale Registrant Organization, pamue ne tshimfuanyi tshia mbulamatadi tshia muena mudimu wa kumpanyi udi utua tshiala pa mukanda wa ditshipa.
     3. Mukanda wa DNS wa kale ne tshijadiki tshia bumfumu bua serveur: Bimfuanyi bia mukanda webe wa kumpala wa DNS, bimfuanyi bia kale bia WHOIS, anyi tshijadiki tshia se: bulongolodi buebe budi ne tshiamu tshia mudimu tshidi tshienza mudimu nkayatshi (ASN) anyi IP blocks (A mikanda) idi tshitupa etshi tshileja bidimu bia bungi kumpala kua dishintuluka dia lelu.
     4. Email wa dienza dia konte wa kumpala / Muyuki wa tike: Mitu ya mikanda ya e-mail mipeta kudi mufundi tshikondo tshivua domaine mufunda anyi mupingajibua.
     5. Nombre wa luapolo lua dikumbaja dia mikenji: A filed FBI IC3 (ic3.gov) nomba wa tshilumbu (États-Unis), Action Fraud nomba wa tshijadiki (Royaume-Uni), anyi nomba wa luapolo lua malu a tshinyangu lua ku Enternete lua bampulushi ba ditunga. Bafundi ba mikanda batu benza malu ne lukasa lua bungi padibu babapesha nomba wa tshilumbu tshia mbulamatadi udi ujadika ne: muntu mmubuele mu ordinatere bilondeshile mikenji ya 18 U.S.C. § 1030 (CFAA) anyi UK Computer Misuse Act 1990.
2. Tshilumbu B: Tshitupa tshia buloba tshivua tshifila kudi mufundi mukuabu (Inter-Registrar Hijack):
   • Muinshi mua ICANN Transfer Policy (kumpala IRTP), difila dia bintu pankatshi pa bafundi didi dilomba Auth-Info (EPP) code ne udi ne tshia kuikala mukanga matuku 60 kunyima kua mashintuluka kampanda a mufundi pa kumbusha padibu bamulekela. Shi muntu udi ubuela mu konte webe ku Registrar A ("Mufundi udi ujimija") ne mufila domaine kudi Registrar B ("Mufundi udi upeta"):
   • Ambila BOTH Registrar Losing ne Gaining Registrar diakamue, kadi uteka pa muaba wa kumpala Losing Registrar's Transfer Dispute / Security Team. Muinshi mua ICANN's Transfer Dispute Resolution Policy (TDRP), mufundi udi mujimije i tshisumbu tshidi ne mikanda yebe ya kale ya difuta dia bitadi ne mikanda ya dibuela idi ileja ne: difila dia bintu kadivua dianyishibue to. Mufundi udi ujimija udi mua kubikila muena mudimu udi utangila malu a mikenji wa mufundi udi upeta bua kuenza mudimu wa Registrar Transfer Undo, anyi kufunda tshilumbu tshia TDRP.
   • Tuma mukanda webe wa tshijadiki tshia bumfumu ne luapolo lua bampulushi kudi Gaining Registrar's Abuse Desk ulomba bua bateke diakamue clientTransferProhibited ne clientUpdateProhibited kanga pa domaine bua muena lukuna kayi mua kupitshila mu domaine kupitshila ku tshisumbu tshia bafundi bakuabu basatu ba ku mpenga ("registrar hopping").
3. Funda mukanda wa tshimpitshimpi kudi ICANN (bua gTLDs bu mudi .com, .net, .org, .io shi gTLD) nansha ccTLD Registry:
   • Bikala mufundi wa mikanda ubenga bua kukonkonona difila dia bintu didi kadiyi dianyishibue anyi mupangile bua kuandamuna mu tshikondo tshia dikuata dia bintu, utume mukanda wa lukasa wa Difila dia bintu didi kadiyi dianyishibue / Dilomba dia dikuata dia bintu ku diambuluisha dia ICANN Contractual Compliance Portal (icann.org/compliance/complaint).
   • Shi tshitupa tshieba tshienza mudimu ne Country-Code Top-Level Domain (ccTLD), bu mudi .uk, .ca, .au, .de, .fr, .nl, .ch, anyi .jp, udi ne mushindu mutambe buimpe: mikanda ya ccTLD idi ilombodibua kudi balombodi ba ditunga pamutu pa ICANN ne misangu yonso itu ilama Bisumbu bia bukubi bia njiwu (tshilejilu, Nominet mu UK ku 0330 236 9470, CIRA mu Canada, DENIC mu Allemagne, AFNIC mu France) udi mua kukanga tshitupa tshia buloba tshidibu bakuate buludiludi ku tshibambalu tshia ditunga mu mêba makese panyima pa dijadika dia bumuntu bua tshisumbu.

Tshitupa 3: Kusungila tshitupa tshidi tshijika (clientHold, RedemptionPeriod, ne PendingDelete)¶

Ki mbualu buonso budi buenzeka mu tshimpitshimpi pa buloba bujima budi buenzeka ku Enternete to. Dituku dionso, kumpanyi minene, SaaS startups, ne bena mudimu ba mbulamatadi badi baya mu mîdima bualu karte ka mfranga kadi mu domaine wabu kakajika, ne mikanda ya divuluija ya dipingaja dia bintu ivua itumibua kudi former-founder@company.com uvua mulekele tshiapu kukadi bidimu bisatu.

Kumvua tshikondo tshia muoyo wa tshitupa tshia ICANN tshidi tshijika¶

Bua Top-Level Domains (.com, .net, .org, .biz, .info), ICANN Expired Registration Recovery Policy (ERRP) udi ulomba tshikondo tshia muoyo tshidi ne bitupa bia bungi kunyima kua dituku dia ndekelu dimane kupita:

1. Tshitupa 1: Tshikondo tshia luse tshia kudipingaja (Matuku 1 too ne ku ~30/45 kunyima kua dijika):
   • Diakamue kunyima kua dijika (misangu ya bungi mu mêba 24 too ne ku 72), mufundi udi ushintulula domaine NS udi ufunda mu Parked / Expired Renewal Splash Page anyi uteka domaine pa clientHold.
   • Tshipeta: Site webe ne e-mail wa kumpanyi bidi bilekela kuenza mudimu diakamue (DNS_PROBE_FINISHED_NXDOMAIN anyi mamanyisha a muaba wa kutekela mashinyi).
   • Dipingaja: Buela mu konte wa mufundi ne ufuta bitadi bia tshidimu tshimue bia dipingaja ($10 too ne ku $30 USD). Mufundi udi upingaja diakamue tshieba tshia kumpala NS mikanda.
2. Tshitupa 2: Tshikondo tshia ngasa tshia dipikudibua (redemptionPeriod, Matuku 30):
   • Shi muntu nansha umo kena upingaja tshitupa tshia buloba mu tshitupa tshia kumpala (pa tshibidilu kunyima kua dituku dia 30 to ne dia 42 bilondeshile mikenji ya mudimu ya mufundi), mufundi udi ubutula tshitupa etshi ku nzubu wa difunda, ne nzubu wa difunda udi umuteka mu matuku 30 adibu ne bua kuenza redemptionPeriod (pa kumbusha pikala mufundi musumbishe domaine udi mufue ku diambuluisha dia tshisanji tshia munda tshia domaine udi mujike bu mudi GoDaddy Auctions anyi NameJet, tangila diakamue dituku dia 30 dia mufundi webe).
   • Dipingaja: Udi mua kusungila tshitupa etshi ne dishindika dia 100 pa lukama mu tshikondo tshia redemptionPeriod, anu ku diambuluisha dia mufundi wa kumpala udi ujimija. Udi ne tshia kubikila tshibambalu tshiabu tshia difuta dia bitadi ne kufuta Makuta a dipingaja dia difunda dia mêna (pa tshibidilu $80 too ne ku $250 USD) pamue ne dipingaja dia tshidimu tshimue.
3. Tshitupa 3: Kujimija (pendingDelete, Matuku 5 a ndekelu a kalandriye):
   • Musangu umue mu matuku 30 redemptionPeriod udi ujika, tshitupa tshidi tshibuela pendingDelete bua matuku 5 (mêba 120).
   • Tshipeta: Mu tshikondo tshia pendingDelete, tshibambalu tshia difunda tshidi tshibenga EPP yonso ya tshibidilu restore mêyi a kudi mufundi. Ku ndekelu kua dituku 5 (bua .com/.net Verisign udi upueka, pankatshi pa 18:00 ne 19:15 UTC), tshitupa etshi tshidi tshipatuka kudi bantu bonso ne tshidi tshikuata mu 10 milliseconde kudi biamu bia mudimu bidi bikuata bintu.
   • Tshienzedi tshia lukasa pikalabu bakuate pendingDelete anyi Registrar Expired Auction:
     • Shi domaine uvua mupane ku diambuluisha dia dituku dia 30 dia mufundi dia bintu kumpala kua kubuela mu Registry redemptionPeriod, check if your registrar offers a short post-auction redemption window or contact the winning bidder/broker immediately.
     • Shi tshitupa tshidi bushuwa mu tshilaminu tshia matuku 5 pendingDelete tshitupa, musangu umua uteka malu a panyima a mushinga mukole mu mishindu yonso isatu minene ya dikuata dia bintu (DropCatch.com, SnapNames.com, ne NameJet.com) so that if the domain drops to the public pool on Day 5, your backorder captures it or enters you into the closed bidder auction to buy your domain back.

Why Does My Website Still Fail for Hours After I Renewed an Expired Domain? (Fixing Negative DNS Caching)¶

Padi domaine webe ujika, mufundi udi upingana pa muaba wa NS mikanda idi ne biamu bia mudimu bia tshitupa tshîpi bidi ne TTL (Time-To-Live) wa mêba 24 too ne ku mêba 48 (86400 anyi 172800 masekonde). Nansha wewe mumane kufuta bitadi bia dipingaja dia makuta ne mufundi webe wa mikanda udi upingaja NS bifunda mu tshitupa tshia miji mu minite 5, biamu bia DNS bia pa buloba bujima (Google 8.8.8.8, Cloudflare 1.1.1.1, Quad9 9.9.9.9, ne ISP resolvers) badi mua kutungunuka ne kufila dibeji dia parking didi dijika too ne padi TTL wa mêba 48 ujika.

Mushindu kayi wa kuenzeja bua kujikija tshilaminu tshia DNS tshia pa buloba bujima mu masekonde 60: Kuindidi meba 48 bua tshilaminu tshia bintu tshijika nkayatshi to. Kumbusha domaine webe ku bianza kudi bafidi ba DNS banene ba pa buloba bujima mpindieu ku diambuluisha dia portail yabu ya tshianana ya cache-purge: 1. Flush Google Public DNS (8.8.8.8 / 8.8.4.4): Kuendakana developers.google.com/speed/public-dns/cache, kututa yourdomain.com, sungula mushindu wa difunda NS (ne pashishe upingaje bua A, AAAA, MX, ne DS), ne tuaku pa Flush Cache. Ebi bidi biumusha domaine webe mu nzubu yonso wa Google DNS pa buloba bujima mu tusunsa tukese tua 10. 2. Flush Cloudflare Public DNS (1.1.1.1 / 1.0.0.1): Kuendakana one.one.one.one/purge-cache/, kubuela yourdomain.com, kusungula NS, A, AAAA, ne MX, ne tuaku pa Purge Cache. 3. Flush OpenDNS / Cisco Umbrella (208.67.222.222): Kuendakana cachecheck.opendns.com, kubuela yourdomain.com, tangila bipeta mu bitupa bia buloba bujima, ne tuaku pa Refresh the Cache kuinshi kua mesa.

Tshitupa 4: Kulongolola DNSSEC munyanguke (SERVFAIL) kunyima kua dienda anyi dikuata dia bintu ku bukole¶

Dîna dia tshitupa tshia bulongolodi (DNSSEC) udi ufunda malu ebe a DNS (RRSIG mikanda mifunda kudi Zone Signing Key ZSK ne Key Signing Key KSK) ne upatula Delegation Signer (DS) hash mu tshitupa tshia TLD tshia tatu ku mufundi webe.

Padi DNSSEC ukandika dinyanguka dia tshisokomenu, dilongolola dia DNSSEC didi dinyanguka didi difikisha ku dijika dia lukasa dia buloba bujima (SERVFAIL) pa tshintu tshionso tshidi tshijadika (kusangisha ne 8.8.8.8, 1.1.1.1, Comcast, ne biapu binene bia telefone). Bitu bitamba kuenzeka mu tshikondo tshia dishintuluka dia lukasa: mulombodi udi uya yourdomain.com's nameservers from Cloudflare too ne ku AWS Route 53 (anyi vice versa) kuyi muanji kumbusha ya provider wa kale DS funda ku mufundi wa domaine.

Kukonkonona ne kulongolola DNSSEC SERVFAIL Kukanga mu minite 5¶

1. Ujadike ne: DNSSEC ke udi ne bualu: Lubila bibidi dig meyi alondangana: lukonku lumue lua pa tshibidilu, ne lukonku lumue ne +cd (Checking Disabled) flag, udi wambila muena mudimu wa diandamuna bua kulengulula DNSSEC cryptographic validation:

   dig yourdomain.com @8.8.8.8
   dig yourdomain.com @8.8.8.8 +cd
   

   • If the first command fails with status: SERVFAIL and zero answers, while the second command (+cd) immediately succeeds with status: NOERROR and returns your A record IP address, 100 percent of your outage is a broken DNSSEC chain of trust.
2. Inspect the Exact Breakage with DNSViz.net anyi Verisign DNSSEC Debugger:
   • Open dnsviz.net anyi dnssec-debugger.verisignlabs.com and enter yourdomain.com.
   • It will draw a visual diagram showing whether the DS record published at your registrar fails to match the DNSKEY served by your current DNS host, or whether your zone signatures (RRSIG) have expired.
3. Emergency Remediation:
   • If you just changed DNS providers: Log into your Domain Registrar, navigate to the DNSSEC / DS Records section, and delete the old stale DS record (or replace it with the new DS record generated by your new DNS host).
   • Flush the DS record cache: Immediately visit Google Public DNS Cache Flush (developers.google.com/speed/public-dns/cache) and Cloudflare Purge Cache (one.one.one.one/purge-cache/) and purge the DS and DNSKEY record types for yourdomain.com so validating resolvers stop checking the deleted DS hash immediately.

Phase 5: Post-recovery clean-up, TLS certificate revocation, and hardening¶

Getting your domain registrar account and DNS records back under your control is only half the battle. During the hours or days that the attacker controlled your domain's DNS, they had complete authority to prove "Domain Control Validation" (DCV) to every Certificate Authority (CA) on the planet.

1. Audit Certificate Transparency Logs (crt.sh) and Revoke Rogue TLS Certificates¶

When an attacker points your A anyi NS records to their server, they immediately run certbot (Let's Encrypt, ZeroSSL, Google Trust Services, or Sectigo) to generate valid, browser-trusted TLS certificates for yourdomain.com, *.yourdomain.com, vpn.yourdomain.com, ne mail.yourdomain.com. Even after you restore your DNS records, the attacker still holds the valid Private Key (.key) and signed Public Certificate (.crt) for your domain, which they can use to stage captive-portal Wi-Fi attacks, BGP hijacks, or internal network spoofing for the next 90 days.

1. Query Certificate Transparency Logs:
   • Go to crt.sh/?q=%25.yourdomain.com or Censys Certificate Search (search.censys.io/certificates).
   • Longolola bilondeshile Logged At / Not Before dituku ne kutangila mukanda wonso udibu bafila mu tshikondo tshia dikuata dia bintu (ne mu mêba 24 kunyima kua dipeta dia bintu, bua bukenji bua DCV budibu balame).
2. Kuenzeja diumusha dia lukasa dia mukanda wa dianyisha:
   • Umanye udi ufila Bukokeshi bua mukanda wa dianyisha (Issuer Name) pa mukanda wonso udi kauyi muanyishibue.
   • CA yonso udibu beyemena kudi bantu bonso udi ne tshia kulonda CA/Browser Forum Baseline Requirements (Tshitupa 4.9.1.1) bua kumbusha mukanda wa dishima anyi udi kauyi muanyishibue mu mêba 24 a kujadika ne: muntu udi ulomba kavua muanyishibue kudi muena domaine mulelela to.
   • Shi udi mupeta kabidi bukokeshi bua DNS pa tshitupa, udi mua kumbusha mikanda ya Let's Encrypt anyi ya ACME idi kayiyi mianyishibue wewe nkayebe mu tusunsa 60 kuyi nansha dijinga ne tshifungu tshia tshisokomenu tshia muena lukuna: anu kuela certbot pa tshilaminu tshiudi ukokesha, enza mudimu mupiamupia wa DNS-01 anyi HTTP-01 bua dina dia domaine dia muomumue ku diambuluisha dia tshifungu tshipiatshipia tshia ACME, ne wenze:

     certbot revoke --cert-path downloaded_rogue_cert_from_crt_sh.pem --reason keycompromise
     

   • Alternatively, submit the Certificate Serial Numbers directly to the CA's emergency revocation portal (for example, Let's Encrypt's revocation instruction page, DigiCert's /revoke tshiibi, anyi mukanda wa dimanyisha dia malu mabi a SSL wa Sectigo).

2. Kanga domaine webe bua kashidi bua kabamukuatshi kabidi to¶

Once operations are restored, implement these five enterprise domain-hardening controls:

1. Enable Registry Lock (serverUpdateProhibited, serverDeleteProhibited, serverTransferProhibited):
   • For mission-critical production domains, upgrade to a registrar that offers true Registry Lock (supported by Verisign on .com/.net, PIR pa .org, ne udi ufila ku diambuluisha dia bafundi ba midimu bu mudi MarkMonitor, CSC Digital Brand Services, Cloudflare Enterprise, Porkbun/Gandi/Namecheap Registry Lock tiers). Padi Registry Lock wenza mudimu, nansha mudi muena tshinyangu mua kuiba tshibuelelu tshieba tshia registrar ne MFA, TLD Registry udi ubenga bionso NS anyi kutuma mashintuluka pa kumbusha padi muena mudimu wa bukubi wa bantu ujikija tshibilu tshia difunda dia malu a ordinatere anyi a telefone.
2. Kupatula CAA (Certification Authority Authorization) DNS Records:
   • Add a CAA record (RFC 8659) to your DNS zone specifying the exact Certificate Authorities allowed to issue TLS certificates for your domain (for example, 0 issue "letsencrypt.org" anyi 0 issue "digicert.com", plus 0 iodef "mailto:security@yourdomain.com"). While an attacker who controls your whole DNS zone can delete a CAA record, a CAA record stops BGP hijackers or compromised subdomain CNAME targets from using unauthorized CAs.
3. Separate Your Domain Registrar from Your Daily DNS Hosting Provider:
   • Keep your domain registration locked inside a high-security vault registrar account that only 2 corporate officers can access using FIDO2 hardware security keys (YubiKey), and delegate daily DNS record management (A, CNAME, TXT) to a separate managed DNS service with granular Role-Based Access Control (RBAC) and scoped API tokens.
4. Audit and Eliminate Dangling Subdomain CNAME ne NS Records:
   • Run a monthly automated scan of your entire DNS zone file (subzy, nuclei -t takeovers/, or OWASP Amass) to identify any CNAME, ALIAS, or subdomain NS record pointing to an unregistered external cloud resource or expired domain, and delete the DNS record before decommissioning the cloud server.
5. Set Up Automated External RDAP, DNS, and CT Log Monitoring:
   • Configure an external monitor (such as CertSpotter, Cloudflare Certificate Transparency Monitoring, or a simple hourly cron script checking dig NS ne whois) that alerts a dedicated Slack/PagerDuty channel and an off-domain SMS/email address the exact minute a new TLS certificate is logged in Certificate Transparency or an NS/MX/DS record changes.

Nkonko itubu bela misangu ya bungi¶

Miaba mifumina¶

• Cybersecurity and Infrastructure Security Agency (CISA, United States): Emergency Directive 19-01: Mitigate DNS Infrastructure Tampering (CISA mandates on Registry Lock, MFA for DNS/Registrars, Certificate Transparency log auditing, and DNSSEC validation) (cisa.gov/news-events/directives/emergency-directive-19-01).
• Internet Corporation for Assigned Names and Numbers (ICANN, International): Transfer Policy (Inter-Registrar Transfer Policy / IRTP), Transfer Dispute Resolution Policy (TDRP), Expired Registration Recovery Policy (ERRP), and EPP Status Codes Reference (icann.org/resources/pages/epp-status-codes-2014-06-16-en).
• National Institute of Standards and Technology (NIST, United States): Special Publication 800-81-2, Secure Domain Name System (DNS) Deployment Guide (csrc.nist.gov).
• National Cyber Security Centre (NCSC, United Kingdom): Protecting Bulk Personal Data and Domain Security: Registry Lock, CAA Records, and Subdomain Takeover Prevention (ncsc.gov.uk).
• CA/Browser Forum (International): Baseline Requirements for the Issuance and Management of Publicly-Trusted TLS Server Certificates (Section 4.9.1.1: 24-Hour Mandatory Revocation for Domain Compromise) (cabforum.org).
• Internet Engineering Task Force (IETF, International): RFC 4033/4034/4035 (DNSSEC), RFC 8659 (DNS Certification Authority Authorization / CAA Resource Record), and RFC 9083 (Registration Data Access Protocol / RDAP) (datatracker.ietf.org).

Malu adi apetangana¶

• Web hosting crisis, migration, and backup restoration
• Dishima ne konte minyanguke
• MFA phishing ne adversary-in-the-middle bypass
• Data breach response and password leaks
• Mashinyi a bungenda ne dishipa dia tshiamu tshia mudimu
• Dishintakaja dia SIM