Mufundi wa domaine anyi mufidi wa DNS udi mupangile: Tshikondo tshia luse tshia dipikula dia domaine tshidi tshijika, DNSSEC SERVFAIL Buteyi, ne dishintuluka dia tshimpitshimpi dia Nameserver¶

Paudi ujuka bua kumanya ne: site wa kumpala wa kumpanyi webe, API endpoints (api.example.com), ne e-mail wa kumpanyi (MX mikanda ya Google Workspace anyi Microsoft 365) kayena mua kufika pa buloba bujima to (DNS_PROBE_FINISHED_NXDOMAIN anyi SERVFAIL) i tshilumbu tshia dijimina dia nzembu dia bintu bia mudimu. Bishilangane na tshiamu tshimue tshia ku Enternete tshidi tshinyanguke tshidi tshinyanga mudimu umue, tshiamu tshia Domain Name System (DNS) anyi dipanga dia difunda dia domaine didi dishipa mudimu wonso udi muinshi mua domaine webe wa muji musangu umue, nansha Single Sign-On (SSO), biibi bia diambuluisha dia bakiliya, ne mikanda ya diandamuna dia malu adi menzeke. Mu kuenza, dijika dia domaine pa buloba bujima didi difumina ku malu asatu mashilangane: (1) dijika dia domaine dia mpukapuka muvua karte ka mfranga kavua mu dosie kafue ne mufundi wa mikanda uvua mukuate NS mikanda idi ileja dibeji dia muaba wa kutekela mashinyi wa kufuta ku dikuma 24 to 48 hours kumpala kua dituku dia ndekelu dia mudimu; (2) DDoS attack anyi control-plane outage kudi mufidi webe wa DNS udi ne bukokeshi (Route 53, Cloudflare, GoDaddy, Namecheap, DNSimple, NS1); anyi (3) mutshibuka DNSSEC (DS record) chain of trust mu tshikondo tshia dishintuluka dia lukasa dia nameserver didi difikisha ku dijadika dia malu (8.8.8.8, 1.1.1.1, ISP resolvers) bua kumbusha 100 pa lukama ya dienda diebe ne SERVFAIL. Bikala muntu udi ukubunda munyange malu ebe a kubuela mu tshilaminu tshia mikanda ne mushintulule anyi mushintulule domaine webe mu mushindu mubi, shintulula ku dikuata dia dina dia kazubu, DNS mufue, ne dikuata dia site; shi mukanda webe wa TLS mufue anyi munyanguke kunyima kua DNS mumane kupingana, tangila Mukanda wa SSL/TLS udi mujika mu mudimu, HSTS preload lockout, ne urgence renewal ne Google Workspace anyi Microsoft 365 custom domain admin lockout ne DNS verification. Shi dipanga edi dipangisha dimanyishangana dia malu a lupitadi, 911/112 ya dituma dia bantu mu tshimpitshimpi, anyi midimu ya bantu bonso idi ne mushinga wa bungi, bikila nimero wa tshimpitshimpi wa muaba unudi (911 mu États-Unis ne mu Canada, 112 mu matunga masanga a ku Mputu, 999 mu Royaume-Uni) anyi tangila mukanda wetu wa nomba ya tshimpitshimpi.

Enza nunku mpindieu¶

1. Ujingulula mu masekonde 10 ni dipanga edi ndijika anyi dijika (EPP Status), dipanga dia DNS Provider udi ne bukokeshi, anyi DNSSEC Dipanga dia dijadika:
2. Kunyema lubilu whois yourdomain.com | grep -iE "Status|Expiry|Name Server" ne dig +trace yourdomain.com.
3. Teta ni kupita DNSSEC dijadika (+cd = Checking Disabled) udi wenza bua domaine webe ajikije kabidi:

   dig @8.8.8.8 yourdomain.com A
   dig @8.8.8.8 yourdomain.com A +cd
   

   Shi dîyi dia kumpala dipingaja status: SERVFAIL padi dîyi dibidi (+cd) udi upingana diakamue status: NOERROR ne adrese wa IP wa tshilaminu tshieba, tshiamu tshieba tshia DNS KAYENA tshienza mudimu to: tshiebe DNSSEC (DS difunda dia kudi mufundi) ndinyanguke. Tuta diakamue ku tshitupa 3 bua kumbusha tshilema DS funda kudi mufundi webe.
4. Bikala tshitupa tshieba tshijika (Auto-Renew Grace Period anyi Redemption Grace Period), buela mu tshilaminu tshiebe tshia mpindieu diakamue ne ufute bitadi bia dipingaja/dipikula; KUINDI bua domaine "akuluke" bua wewe kumona mua kumufundisha kabidi ku mushinga mukesa:
5. Mu matuku a kumpala 1 too ne ku 45 kunyima kua dijika (Auto-Renew Grace Period), kupingaja mu tshiamu tshieba tshia mudimu kudi kupingaja nameservers yebe ya ku ntuadijilu ku mushinga wa dipingaja ($10 to $30).
6. Mu matuku 30 Redemption Grace Period (RGP / redemptionPeriod), udi ne tshia kufuta bitadi bia dipikula dia mukanda wa difunda ($80 to $250) kupitshila kudi mufundi webe wa mpindieu. Shi udi windila bua tshitupa tshijike 5-matuku Pending Delete tshitupa tshia kulama $100, biamu bia mvita bidi bienza mudimu nkayabi (DropCatch, SnapNames, NameJet) neangate tshitupa tshieba munda mua 5 milliseconds wa kupatula ne kumusumbisha ku binunu bia dolare.
7. KUSHINTUKI Nameservers yebe nansha kakese (NS) kule ne DNSSEC-enabled DNS provider (bu mudi Cloudflare, Route 53, anyi Google Cloud DNS) kuyi umbusha DS funda kudi mufundi webe kumpala: Shi DNSSEC udi muanyishibue ne udi ushintulula NS udi ufunda kudi mufidi wa DNS wa dipandisha mu tshikondo tshia dipanga dia nzembu kayi mufute muledi DS (Delegation Signer) difunda mu .com / .org TLD zone kumpala, tshintu tshionso tshidi tshijadika malu pa buloba netshibenge mandamuna adi kaayi mafunda a mufidi wa DNS mupiamupia bu dishima dia malu masokoka (SERVFAIL).
8. Biwikala mupangile mu tshiapu tshieba @yourdomain.com e-mail bualu bua domaine webe MX malu adibu bafunde mmapuekele, KUENA pa "Tuma code wa dipingaja dia mot de passe kudi admin@yourdomain.com" ku mufundi webe: Padi domaine webe NS anyi MX mikanda idi kayiyi pa lutanda lua Internet, e-mail yonso wa dijadika udi mutumibua kudi @yourdomain.com udi utuluka anyi ujimina mu mulongo. Ingidija SMS/Authenticator MFA wa mufundi webe, e-mail wa dilama dia pambelu pa tshisumbu (@gmail.com / @proton.me), anyi mushindu wa kujadika bumuntu bua telefone.
9. Panyima pa wewe mumane kupingaja tshitupa tshia buloba tshidi tshijika, ikala ujadika ne: Mufundi webe mmupingaje Custom Nameservers yebe ya ku ntuadijilu (NS) pamutu pa kulekela domaine pa sedoparking.com / renewyourname.net: Padi domaine ujika, bafundi badi bafunda malu audi mulongolole NS mikanda idi ne mêna a mashinyi (ns1.parklogic.com, dns1.name-services.com). Imue misangu, kufuta dipingaja dia bintu kudi kupingaja dituku dia dijika dia tshidimu tshidi tshilua eku kushiya biamu bia mudimu bia muaba wa kutekela mashinyi bienza mudimu too ne paudi ubipingaja ku bianza.
10. Flush global public recursive DNS caches (Google 8.8.8.8, Cloudflare 1.1.1.1, OpenDNS) muibidi webe NS anyi DS mikanda idi mipingajibua: Pamutu pa kuindila mêba 24 too ne ku 48 bua kulama NXDOMAIN anyi dibeji dia parking NS mikanda idi ne bua kujika nkayayi, enza bua dijimija dia tshilaminu tshia bintu bia pa buloba bujima dia lukasa mu Google Public DNS (developers.google.com/speed/public-dns/cache) ne Cloudflare 1.1.1.1 (one.one.one.one/purge-cache/).

Mutshi wa mapangadika: tshitupa tshia buloba bujima anyi DNS wa tshimpitshimpi¶

Ingidija tshimfuanyi etshi bua kuleja tshitupa tshijalame tshia bulongolodi bua DNS (TLD Registry, Registrar EPP Status, DNSSEC DS Chain, anyi Authoritative Nameserver) mudi dijikija dia malu dipanga:

flowchart TD
    Start["Dipanga dia mudimu pa buloba bujima: Web ne Email ya ku Enternete idi kayiyi mua kujika (NXDOMAIN / SERVFAIL)"] --> RunDiag["Enza: whois domain.com NE dig @8.8.8.8 domain.com +cd"]

    RunDiag --> CheckCD{"Dig @8.8.8.8 domain.com udi upangila, padi +cd ukumbaja anyi?"}

    CheckCD -->|"Eyowa: Udi wenza mudimu ne +cd, udi upanga padiye kayi ne +cd"| DnssecBreak["DNSSEC Chain of Trust: Supula Stale DS Record ku Registrar OR Re-Sign Zone -> Flush 8.8.8.8 & 1.1.1.1"]

    CheckCD -->|"Tòo: Bionso bibidi bidi bipangila anyi bipingana IP wa diteka mashinyi"| CheckWhois{"Tangila nsombelu wa tshitupa tshia WHOIS EPP ne dituku dia ndekelu"}

    CheckWhois -->|"Nsombelu: clientHold anyi serverHold"| HoldState["Mufundi / Diimanyika dia mudimu: Kujikija ICANN RAA Email Verification OR Abuse/Billing Ticket Immediately"]

    CheckWhois -->|"Dituku dia ndekelu dipita (nsombelu: autoRenewPeriod)"| GraceRenew["Dituku dia 1 to ne dia 45 kunyima kua dijika: Futa dipingaja dia mushinga mu tshibuelelu tshia bafundi -> Tangila NS wa pa buende mupingajibue"]

    CheckWhois -->|"Nsombelu: tshikondo tshia dipikula (RGP)"| RgpRestore["Dituku dia 45 to ne dia 75 kunyima kua dijika: Kangula tike wa diambuluisha dia lukasa / Futa RGP Restore Fee ($80-$250) Diakamue"]

    CheckWhois -->|"Nsombelu: muindileKujimija"| PendingDel["Matuku 5 a ndekelu: Kaena mua kupingajibua kudi Registrar to -> Teka Backorders mu Drop-Catchers yonso minene mpindieu"]

    CheckWhois -->|"Nsombelu: ok / ClientTransferTransferProhibited AND Expiry in Future"| AuthDown["Difunda dia domaine dimpe -> Mufidi wa DNS udi ne bukokeshi udi mupangile anyi muaba udi mujimine"]

    AuthDown --> MigrateNS["Enter Zone File (`BIND` / Terraform) to Secondary DNS Provider -> Remove DS Record if DNSSEC on -> Update NS at Registrar"]

Tshitupa 1: Tshikondo tshia dijika dia tshitupa tshia ICANN (Auto-Renew vs. Redemption vs. Pending Delete)¶

Padi Top-Level Domain (gTLD bu mudi .com, .net, .org, .io, .ai, .co, .app, .dev) udi ujika bualu karte ka mfranga kavua kapingajibua nkayaku kavua kapangile anyi karte ka mfranga kavua kapangile panyima pa muena mudimu mumane kuya, tshitupa etshi tshidi tshipita mu tshikondo tshikole tshia muoyo tshidi tshilombodibua kudi ICANN's Expired Registration Recovery Policy (ERRP) ne bipungidi bia mudimu wa difunda (Verisign bua .com/.net, PIR bua .org, Identity Digital).

Mushindu kayi udi domaine ufua ne bua tshinyi udi uya pambelu pa internet KUMPALA anyi MU Dituku dia 1 dia dijika¶

+-------------------------------------------------------------------------+
| ICANN gTLD EXPIRATION TIMELINE (.com / .net / .org example)             |
|                                                                         |
| [Active Domain]                                                         |
|       |                                                                 |
|       v  (Expiration Date Reached: Day 0)                               |
| +---------------------------------------------------------------------+ |
| | STAGE 1: Auto-Renew Grace Period (Day 1 to Day 30-45)               | |
| | - EPP Status: ok or clientHold (Registrar swaps your NS to parking) | |
| | - Production Impact: 100% OFFLINE within 0 to 48 hours of expiry    | |
| | - Recovery: Log into registrar & pay normal renewal ($10-$30).      | |
| +---------------------------------------------------------------------+ |
|       |  (Registrar sends Delete command to Registry at Day 30-45)      |
|       v                                                                 |
| +---------------------------------------------------------------------+ |
| | STAGE 2: Redemption Grace Period [RGP] (Exactly 30 Calendar Days)   | |
| | - EPP Status: redemptionPeriod (Domain removed from TLD Root Zone)  | |
| | - Recovery: Still 100% guaranteed to original owner, MUST pay       | |
| |   Registry RGP Redemption Fee ($80-$250) + renewal via registrar.   | |
| +---------------------------------------------------------------------+ |
|       |  (30-Day RGP expires without redemption payment)                |
|       v                                                                 |
| +---------------------------------------------------------------------+ |
| | STAGE 3: Pending Delete (Exactly 5 Calendar Days)                   | |
| | - EPP Status: pendingDelete                                         | |
| | - Recovery: IMPOSSIBLE to renew or redeem at any price. Registry    | |
| |   rejects all registrar commands until public drop at Day 5 (~18:00 | |
| |   UTC for Verisign .com/.net).                                      | |
| +---------------------------------------------------------------------+ |
+-------------------------------------------------------------------------+

Fuanyikija bukenji buebe bulelela, mushinga, ne malu audi mua kuenza bua kupingaja bintu mu tshitupa tshionso tshia dijika dia matuku, nansha mu Top-Level Domains (ccTLDs bu .uk, .de, .eu, .ca, .au), idi kayi ilonda ICANN gTLD mikenji:

Tshitupa 2: Dipingaja dia tshitupa ku tshitupa tshia tshintu tshidi tshijika anyi RedemptionPeriod tshitupa¶

Londa bulongame ebu bua kupingaja domaine udi mujike ku Enternete mu tshikondo tshipi menemene:

Tshitupa 1: Peta kabidi mushindu wa kubuela mu konte webe wa mufundi padi @yourdomain.com email mmufue¶

Mona Catch-22 wa kale wa tshitupa tshikadi tshijika: - Tshitupa tshieba (company.com) mujika, nunku MX mikanda ya company.com wakalekela kujikija. - Udi uteta bua kubuela mu tshilaminu tshiebe tshia domaine (GoDaddy, Namecheap, Cloudflare, Porkbun, Hover, Network Solutions, Gandi), ne mufundi udi wamba ne: "Tudi batume kode wa dijadika wa nomba 6 kudi admin@company.com." - Bualu company.com udi mufue, e-mail au kena mua kufika to.

Mushindu kayi wa kupatuka diakamue mu tshitupa tshia email tshidi tshijika: 1. KUENA mua kufila anyi kushintulula tshintu nansha tshimue: tangila ni udi mua kuenza mudimu ne tshiamu tshia kukanga natshi mikanda tshia lukasa ANYI pikala domaine kayi mujike (bikala domaine nkayende mujike ku tshipiminu tshia TLD, MX kayena mua kujikija muaba nansha umue too ne padibu bamupingaja). 2. Wenza mudimu ne mushindu wa kupingaja konte wa "Lost Email Access / Domain Expired" wa Registrar: - Pabuipi ne bafundi bonso badibu banyishile kudi ICANN batu bafila tshiamu tshia telefone anyi tshia mbulamatadi-ID / corporate-incorporation-document verification workflow nangananga bua bakiliya badi ne e-mail wa kubuela mu site @ tshitupa tshidi tshijika munda mua konte. - Ikala ne bintu bisatu bilongolola kumpala kua kubikila diambuluisha dia mufundi: (a) nomba 4 ya ndekelu ya karte ka mfranga anyi ID wa dipana dia PayPal uvuabu benze nende mudimu pa facture wa dipingaja dia kumpala, (b) ID webe wa konte wa mufundi / PIN wa muena mudimu, ne © ID wa foto wa mbulamatadi + mikanda ya dijadika / difuta dia bintu bia mudimu udi upetangana ne bulongolodi bua WHO ( WISTech / Admin / Registrant). 3. Paudi ubuela, shintulula diakamue adrese webe wa e-mail wa konte webe wa Registrar ku domaine wa pambelu (@gmail.com, @proton.me, anyi tshitupa tshikuabu tshia njiwu tshiudi natshi) ne enza bua Hardware Security Key (FIDO2) anyi TOTP Authenticator App MFA nunku dibuela kadiena dimanyine pa @company.com email kabidi.

Tshitupa 2: Enza dipingaja anyi RedemptionPeriod (RGP) Kupingaja¶

1. Bikala tshitupa tshidi mu tshitupa tshia 1 (Auto-Renew Grace Period, Matuku 1 too ne ku 30/45):
2. Enda ku Billing -> Renewals anyi Domain List -> Expired Filter ne ufute facture wa dipingaja.
3. Dikonkonona dia mushinga kunyima kua sekonde 60 kunyima kua difuta: Kangula Nameservers (NS) malu adibu balongolole mu tshilaminu tshia mikanda. Tangila ni mufundi udi mua kupingaja name server yebe ya bushuwa (tshilejilu, ns-123.awsdns-15.com anyi ada.ns.cloudflare.com) anyi kushiya domaine uleja ku serveur yende ya parking idi mimane kujika (ns1.sedoparking.com / dns1.registrar-servers.com). Shi biamu bia mudimu bidi anu bifunda, funda kabidi biamu biebe bia dienza nabi mudimu ne ubilame.
4. Bikala tshitupa tshidi mu tshitupa 2 (Redemption Grace Period / redemptionPeriod, Matuku 30/45 too ne 75):
5. Tangila mu tshitupa tshikuabu tshidi munda mua tshiamu tshieba tshia difunda natshi tshidi misangu ya bungi tshifunda ne: Malu adi mapite -> Dipikula, Trash / Restore, anyi Grace/Redemption Billing.
6. Futa bitadi bia RGP Restore + tshidimu tshimue tshia dipingaja.
7. Mmunyi mudi dipingaja dia RGP dienza mudimu ku Registry (Verisign / PIR)? Paudi ufuta bitadi bia RGP, mufundi webe udi utuma EPP <update><restore op="request"> dîyi dia ku TLD Registry. Tshibambalu tshia difunda dia mêna tshidi tshishintulula diakamue nsombelu wa domaine kumbukila ku redemptionPeriod ku pendingRestore ne udi uteka tshitupa tshieba NS udi upingaja mu TLD Root Zone mu minite 15 too ne ku 60 padi mufundi webe utuma restore op="report" dijadika dia dilonda dia mikenji.

Tshitupa 3: Pita dipanga dia tshilaminu tshia ISP pa kumbusha 8.8.8.8 ne 1.1.1.1¶

Pavua domaine webe mujike, biamu bia DNS bia pa buloba bujima bivua bilama mêna a parking anyi negative NXDOMAIN diandamuna (dilombodibua kudi TLD's SOA Minimum TTL, pa tshibidilu 900 ku 3,600 masekonde, anyi 86,400 masekonde bua NS mikanda). Tshikondo dig @a.gtld-servers.net yourdomain.com NS (kukonka .com root serveur directly) udi uleja kabidi nameservers yebe ya bushuwa ya dienza dia bintu: 1. Kangula Google Public DNS Flush Cache (https://developers.google.com/speed/public-dns/cache): - Mushindu wa kusukula NS wa kumpala bua yourdomain.com, pashishe ela SOA, A, AAAA, MX, ne TXT. 2. Kangula Cloudflare 1.1.1.1 Purge Cache (https://one.one.one.one/purge-cache/): - Kusukula NS, A, AAAA, ne MX bua yourdomain.com.

Tshitupa 3: Nameserver wa tshimpitshimpi (NS) Dishintuluka mu tshikondo tshia dipanga dia DNS Provider (Ne DNSSEC Buteyi)¶

Netuambe tshinyi pikala difunda dia domaine webe dikumbane 100 pa lukama ne kadiyi dijika, kadi Mufidi wa DNS udi ne bukokeshi (Route 53, Cloudflare, GoDaddy DNS, DigitalOcean DNS, Azure DNS, DNSimple, Dyn) udi ukenga ne tshinyangu tshikole anyi tshipupu tshia DDoS, ne udi ne tshia kushintulula Nameservers ya domaine webe (NS) kudi mufidi wa DNS wa tshilaminu mpindieu anyi?

Mushipianganyi wa #1 wa dienda dia bantu: Kushintulula NS Padi DNSSEC (DS Difunda) didi dienzejibua¶

Kumpala kua kushintulula tshintu tshimue NS funda ku tshilaminu tshieba, enza mudimu ne dîyi edi bua kutangila ni DNSSEC udi muenzeja mu domaine webe ku tshilaminu tshia TLD tshia tatu:

dig +short yourdomain.com DS @8.8.8.8

+-------------------------------------------------------------------------+
| WHY CHANGING NS RECORDS WITH AN ACTIVE DS RECORD BREAKS THE INTERNET    |
|                                                                         |
| 1. Parent TLD (.com) holds your old DNS provider's DS Record (Key #2371)|
| 2. Old DNS Provider goes down. You import zone to New DNS Provider      |
|    (unsigned, or signed with a brand-new Key #9910) and swap NS.        |
| 3. Validating Resolver (8.8.8.8 / 1.1.1.1 / Comcast / ISP) queries      |
|    New DNS Provider, sees signature does NOT match DS Key #2371.        |
| 4. Resolver assumes an active MITM Spoofing Attack -> Returns SERVFAIL  |
| 5. RESULT: Your domain stays 100% dead worldwide even though the new    |
|    DNS servers are up and answering cleanly.                            |
+-------------------------------------------------------------------------+

Mukanda wa tshikebelu tshia dishintuluka dia mêna a tshimpitshimpi (Zero SERVFAIL Tshilumbu)¶

1. Kulongolola anyi kubueja DNS Zone File webe mujima kudi mufidi wa DNS mupiamupia kumpala:
2. Kuena ne bua kuela meji bua malu audi mufunde mu DNS to (@, www, ne api ki mmalu adibu bafunda nkayawu to; kupua muoyo MX, SPF/TXT, DKIM, _dmarc, autodiscover, anyi CAA udi unyanga dituma dia e-mail ne dipingaja dia TLS).
3. Mmuaba kayi uudi mua kupeta tshitupa tshieba tshia DNS padi tshibuelelu tshia mufidi wa DNS wa kumpala katshiyi tshienza mudimu:
   • Tangila Infrastructure-as-Code (Terraform, Pulumi, OctoDNS, DNSControl) mu tshilaminu tshieba tshia Git.
   • Tangila bintu bia matuku mashale aa (BIND .zone mikanda) anyi kukeba mikanda ya kale ya DNS (SecurityTrails, ViewDNS.info, DNSDumpster, anyi Censys / crt.sh bua bitupa bikese).
   • Dilomba dia malu adibu balame adi anu munda mua biamu bia dijikija nabi bilumbu bia bantu bonso (dig @8.8.8.8 yourdomain.com MX, dig @1.1.1.1 yourdomain.com TXT, dig @9.9.9.9 api.yourdomain.com A) kumpala kua TTL yabu kujika.
4. Ujadike ne: mufidi wa DNS mupiamupia udi wandamuna bimpe ku malu onso adi ne mushinga KUMPALA kua wewe kulenga mufundi webe: Fuanyikijabi ne: mufidi webe mupiamupia mmukupeshe mudimu ns1.rescuedns.com ne ns2.rescuedns.com. Teta buludiludi ne dig:

   dig @ns1.rescuedns.com yourdomain.com SOA +norecurse
   dig @ns1.rescuedns.com yourdomain.com A +norecurse
   dig @ns1.rescuedns.com yourdomain.com MX +norecurse
   

   Bindile too ne padi flags: mulongo mu dig mutu wa bualu udi ne aa (Authoritative Answer) ne udi upingana status: NOERROR.
5. Biobi dig +short yourdomain.com DS wakapingaja DS kufunda, kukuata DNSSEC ku mufundi:
6. Mu tshikondo tshia dipanga dia mudimu mudi mufidi wa DNS wa kale kayi mua kufika to: Buela mu Domain Registrar webe (muaba uudi musumbe domain), ndaku mu tshitupa tshia DNSSEC / DS Records, ne umbusha bionso DS mikanda nunku domaine udi upingana ku unsigned (Insecure) mu tshitupa tshia TLD. Bindile too ne dig +short yourdomain.com DS @a.gtld-servers.net udi upingana munda mutupu (ne usukula DS mu 8.8.8.8 / 1.1.1.1), anyi weja mupiamupia wa mufidi wa DNS DS funda ku luseke lua tshia kale pikala wenza dishintuluka dia bantu ba bungi.
7. Kulongolola Nameservers (NS) ku Domain Registrar webe: Pingana pa muaba wa nameservers mifue ne ns1.rescuedns.com ne ns2.rescuedns.com mu tshitupa tshia Custom Nameservers tshia mufundi webe (tshimanyinu: tshidi tshishintuluka NS mikanda idi munda mua tshiamu tshia zone kayena yenza tshintu nansha tshimue padi biamu bia kale bifua; udi ne tshia kushintulula Glue / Parent Delegation Nameservers ku tshidiidi tshia Registrar).
8. Kusukula NS ne DS tshilaminu tshia bintu mu Google (8.8.8.8) ne Cloudflare (1.1.1.1): Wenza mudimu ne biamu bia mudimu bia dilengeja dia tshisokomenu bia mu tshitupa 2 tshitupa 3 bua kuenzeja diakamue dianyisha dia nameservers mipiamipia.

Tshitupa 4: Kupanduka ku tshikondo tshia matuku 60 tshia ICANN mu tshikondo tshia njiwu¶

Netuambe tshinyi wewe musue kutuma domaine webe kudi mufundi mupiamupia (ICANN Inter-Registrar Transfer), anu bua kuikala mupangile kudi Domain Status: clientTransferProhibited ne mukenji udi wamba ne: "Domaine eu udi muinshi mua ICANN Transfer Lock wa matuku 60 bualu mbashintulule malu a kumanyangana nende matuku mashale aa"?

1. Bua tshinyi dikanga dia matuku 60 diakatuadija: Muinshi mua ICANN Transfer Policy (Tshitupa II.C.1), bafundi ba mikanda batu bateka dikanga dia matuku 60 dîba dionso didi domaine mupiamupia mufundisha, mupitshishibua pankatshi pa bafundi, anyi wenza "Dishintuluka dia mufundi" (dishintulula dia dina dia kumpala, dina dia ndekelu, dia adrese wa bulongolodi, anyi adrese ya e-mail Muntu udi udifundisha).
2. Mushindu kayi wa kupita anyi kupatuka mu tshikondo tshia matuku 60 tshia dishintuluka dia mufundi:
3. Kumpala kua kushintulula malu a WHOIS: Pabuipi ne bafundi bonso banene batu bateka kazubu ka dianyisha pa tshiamu tshia kulongolola natshi bantu tshidi ne: "Kupatuka mu tshikondo tshia matuku 60 tshia dituma dia bintu kunyima kua dishintulula dia malu a dibikila edi." Kuteka tshimanyinu pa kazubu aka kudi kukuambuluisha bua kushintulula adrese webe wa e-mail wa admin/registrant ne kuenza kabidi EPP Auth-Code (Transfer Secret) bua kufila tshitupa tshia buloba dituku dimue adi.
4. Vuluka ne, kuena dijinga ne kufila difunda dia domaine bua kushintulula bafidi ba DNS to: Nansha domaine muikale mukanga matuku 60 kumpala kua Registrar Transfers (clientTransferProhibited), udi mua kushintulula Nameservers (NS mikanda) kudi mufundi wa mpindieu dîba kayi dionso kakuyi tshikondo tshia kuindila; kushintulula DNS kudi kuangata minite mikese, kadi dishintulula dijima dia mufundi didi diangata matuku 5 too ne ku 7 pa kumbusha padi mufundi udi mujimije wela diakamue Approve Outgoing Transfer (FOa) buto.

Tshitupa 5: Kukolesha difunda dia domaine ne DNS bua kuluisha dinyanguka dia matuku atshilualua¶

Padibu bapingaja tshitupa tshieba ne DNS 100 pa lukama, kumbaja liste wa malu a ditantamena edi:

• Kulekela Registry Lock (serverDeleteProhibited, serverUpdateProhibited, serverTransferProhibited) pa malu a mushinga mukole a dienza dia bintu: Standard Registrar Lock (clientTransferProhibited) udi mua kujimijibua ne dikuma dimue pikala muntu udi ukubunda mukuate tshibuelelu tshieba tshia registrar. Registry Lock (mufila kudi Verisign, PIR, Cloudflare, CSC, MarkMonitor, Gandi, ne Porkbun/Namecheap bua enterprise domains) udi ukanga domain buludiludi ku tshipiminu tshia TLD Registry, udi ulomba dijadika dia dîyi dia bantu ba bungi dia pambelu pa tshisumbu kumpala kua tshionso NS difunda didi mua kushintuluka anyi kujimija domaine.
• **Kupingaja bintu bia mudimu bidimu 5 too ne ku 10 kumpala (ICANN maximum horizon is 10 years). Futa kumpala kua bidimu 5 too ne ku 10 musangu umua.
• Kuenza mudimu nansha kakese @yourdomain.com adrese wa e-mail bu muaba wa kubuela anyi wa dimanyisha dia difuta dia bitadi kudi mufundi udi ulombola yourdomain.com: Enza mudimu ne liste wa diabanya dia malu a bukubi pa tshitupa tshia mbulamatadi tshidi tshidisunguile anyi pa konte wa pambelu mukole, ne kutangila RDAP / WHOIS matuku a ndekelu ku diambuluisha dia biamu bia Prometheus/Uptime bia pambelu (domain_expiry_days < 60).
• Muinshi NS ne DS TTLs (300 ku 3600 tusunsa) mêba 48 kumpala kua dishintuluka dia DNS didibu balongolole: Kupuekesha TTLs kumpala kua dîba kudi kuenza bua ba-resolver bashintuluke mu minite 5 ya tshikondo tshidibu balongolole bua kujikija.

Nomba ya tshimpitshimpi ya mu tshijengu ne mikenji ya bibambalu¶

Padi domaine anyi DNS unyanguka udi unyanga nzubu ya luondapu, midimu ya njiwu, midimu ya mu tshimenga, anyi nzubu ya mbulamatadi, londesha mishindu eyi ya dikolesha dia malu:

• États-Unis ne Canada: Ela 911 pikala dinyanguka dia domaine/DNS dipangisha telemetrie wa lupitadi lua lupitadi, dituma dia ambulanse, anyi mishindu ya bukubi bua muoyo. Umanyishe bilumbu bia DDoS pa tshiamu tshia DNS anyi dikuata dia BGP/DNS kudi CISA (1-844-Say-CISA / cisa.gov/report), FBI IC3 (ic3.gov), anyi Tshibambalu tshia bukubi bua malu a ordinatere tshia mu Canada (1-833-CYBER-88). Bua .gov malu, yukila ne CISA .gov Tshibambalu tshia diambuluisha dia bafundi.
• Royaume-Uni: Ela 999 bua njiwu ya muoyo anyi dinyanguka dia NHS. Umanyishe NCSC (ncsc.gov.uk), ne yukila ne Nominet (01865 332244) buludiludi bua lukasa .uk / .gov.uk / .nhs.uk malu a difunda dia mêna.
• Union européenne: Ela 112 mu matunga onso adi mu UE. Bafidi ba midimu ya DNS ne mikanda ya mêna a TLD badi balombodibua kudi EU NIS2 Directive (Directive 2022/2555) ne badi ne tshia kumanyisha malu manene adi atangila dikalaku kudi CSIRT wabu wa ditunga mu mêba 24.
• Australie ne Nouvelle-Zélande: Ela 000 mu Australie anyi 111 mu Nouvelle-Zélande; manyisha malu makole a DNS anyi a domaine kudi ACSC (1300 CYBER1), auDA (bua .au), anyi Domain Name Commission NZ (bua .nz).
• India ne Asia-Pacifique: Dial 112 mu India bua diandamuna dia lukasa; luapolo lua DNS/domain infrastructure kudi CERT-In (incident@cert-in.org.in) mu meba 6 anyi NIXI bua .in dibandisha dia registre.

Nkonko itubu bela misangu ya bungi¶

Bua tshinyi tshitupa tshianyi tshiakalekela kuenza mudimu mêba 24 KUMPALA kua tshikondo tshia WHOIS tshia kujika?¶

Tshia kumpala, tangila mêba: WHOIS `Registry Expiry Date` udi misangu yonso mufunda mu **UTC (`Z`)**, udi mêba 4 too ne ku 8 kumpala kua mêba a mu Amerike wa ku Nord (adi umvuija ne: domaine udi ujika pa `2026-11-01T04:00:00Z` mu bulelela udi ujika pa `8:00 PM PDT` mu dia matuku 31 ngondo wa dikumi). Tshibidi, shi `NS` mikanda ivua ne `24-hour` anyi `48-hour` TTL ne mufundi wa mikanda bakashintakaja ku `00:00 UTC` mu dituku dia dijika, bena mudimu badi ne biamu biabu bia kujikija nabi mudimu bipiabipia kumpala kua dîba badi babuela mu dibeji dia parking diakamue eku bakuabu bashala balame mêba a bungi.

Mufundi wanyi udi kayi wenza mudimu anyi kena wandamuna to (Dead / De-accredited Registrar), ne tshitupa tshianyi tshidi tshijika. Mmunyi mundi mua kutshisungila?¶

Padi ICANN ujikija anyi ujimija dianyisha dia mufundi udi kayi wenza mudimu bimpe muinshi mua **De-Accredited Registrar Transition Procedure (`DARTP`)**, ICANN udi ufila bintu bionso bia bungi kudi muena mudimu udi wenda upeta makuta kayi ne mushinga kudi badi badifundisha. Kutangila `whois yourdomain.com` (anyi `lookup.icann.org`) bua kumona **Mufundi** ne **IANA ID** udi ne domaine webe mpindieu, anyi funda **Dilomba dia dipingaja dia domaine / Difila dia domaine** buludiludi kudi **ICANN Contractual Compliance (`icann.org/compliance/complaint`)**.

Bua tshinyi site wanyi udi wenzela bamue bantu badi basumba bintu ku telefone, kadi udi anu uleja dibeji dia parking didi dijika pa Wi-Fi wa biro bietu mêba 6 kunyima kua meme mumane kupingaja domaine?¶

Tshibambalu tshieba tshia mudimu anyi ISP wa muaba uudi musombele tshidi tshilama dibeji dia parking dia mufundi `NS` ne `A` mikanda pavua tshikondo tshia domaine tshijika, ne biamu bia mudimu bia mashinyi bivua bimanyike bikole bua kuteka TTL mibandile (`3,600` ku `86,400` tusunsa / mêba 24) nunku mabeji a ngumu ashala mu tshilaminu tshia matuku a bungi. Sukula Google (`8.8.8.8`) ne Cloudflare (`1.1.1.1`) wenza mudimu ne biamu biabu bia dilengeja nabi bintu bia ku Enternete, pashishe kuenza mudimu ne ordinatere webe `ipconfig /flushdns` (Windows), `sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder` (macOS), anyi `sudo resolvectl flush-caches` (Linux).

Tshidi tshienzekela mikanda ya ku Enternete itumina @yourdomain.com Pavua Domain wetu anyi DNS wetu mujike munkatshi mua mêba 18 anyi? Mbajimine bua kashidi anyi?¶

Misangu ya bungi, ma e-mail malelela atuma mu meba 12 too ne ku 48 a kumpala a dipanga dia DNS kaena ajimina to: adi mu mulongo pa tshilaminu tshia mail tshia muntu udi mutume ne neafike nkayawu mu meba makese adi alonda. Muinshi **`RFC 5321` (Simple Mail Transfer Protocol, Section 4.5.4.1)**, padi tshiamu tshia mudimu tshidi tshituma (`Gmail`, `Microsoft Exchange Online`, `Postfix`) udi upeta dipanga dia DNS dia tshitupa tshîpi (`SERVFAIL`) anyi kena mua kudisangisha ne `MX` host, udi uteka mukenji mu mulongo wa kuteta kabidi bua matuku **4 too ne ku 5 (`96 to 120 hours`)**, kuteta kabidi ne dipingana dia exponentiel. Ino, shi dibeji dia muaba wa kutekela mashinyi dia mufundi wa mikanda didi dijika didi ne **wildcard null `MX` kufunda mena (`0 .`)** anyi tshilaminu tshia mesaje tshia mashinyi tshidi tshibenga mesaje ne tshikole `550 5.1.1 User Unknown` dipingana dia kashidi, batumi aba bapeta dimanyisha dia dipingana dia lukasa ne badi ne tshia kutuma kabidi mikanda yabu ya e-mail.

Ndi mua kuteka bafidi ba DNS babidi musangu umue (Cloudflare + Route 53) anu pa kutela Cloudflare ibidi NS mikanda ne ibidi ya Njila 53 NS mikanda ku mufundi wanyi anyi?¶

Eyowa, patshidi `DNSSEC` udi mupangisha (anyi mulongolola bimpa ne `RFC 8901` Multi-Signer DNSSEC) ne bafidi bonso babidi badi bafila mikanda ya DNS ya muomumue. Recursive resolvers udi ulomba baledi bonso badibu bafunde `NS` bifunda ku diambuluisha dia round-robin/RTT latency selection (`SRTT`). Shi udi mufunda `ns1.providerA.com`, `ns2.providerA.com`, `ns1.providerB.com`, ne `ns2.providerB.com` mu Custom Nameservers ya muena mudimu weba ne ikala ne zone yonso ibidi milongolola ku diambuluisha dia **OctoDNS**, **DNSControl**, **Terraform**, anyi `AXFR / IXFR` zone transfers, domaine webe udi upanduka nkayende ku 100 pa lukama wa DNS provider.

Ndishilangana kayi didi pankatshi pa clientHold ne serverHold mu WHOIS?¶

EPP udi utuadija ne **`client...`** (`clientHold`, `clientTransferProhibited`) idi milongolola kudi **Mufundi wa tshitupa** (mupanyi udi ulombola konte webe, bu mudi Namecheap anyi GoDaddy) ne idi mua kumbushibua diakamue kudi diambuluisha dia mufundi webe anyi kudi bulongolodi bua difuta dia bitadi. Kode ya nsombelu idi ituadija ne **`server...`** (`serverHold`, `serverTransferProhibited`) badi bateka buludiludi kudi **TLD Registry Operator** (`Verisign`, `PIR`, `Nominet`) bua mikenji ya ku kabadi, bilumbu bia UDRP, dipangisha dia malu mabi mu tshibambalu tshia difunda, anyi tshiamu tshia **Registry Lock**, ne bidi bikengela kuyukila ne tshibambalu tshia difunda ku diambuluisha dia mufundi webe bua kumbusha.

Malu adi apetangana¶

• Dikuata dia dina dia kazubu, DNS mufue, ne dikuata dia site
• Mukanda wa SSL/TLS udi mujika mu mudimu, HSTS preload lockout, CA CAA record block, ne emergency renewal
• Google Workspace anyi Microsoft 365 custom domain admin lockout, DNS TXT verification, and tenant rescue
• DNS hijack, ISP router WAN reconfiguration, ne captive portal spoofing
• Tshilumbu tshia dilama dia site, dishintuluka, ne dipingaja dia bintu bia kulama
• Nomba ya njiwu bilondeshile ditunga

Miaba ne buludiki bua mbulamatadi¶

• Tshibambalu tshia ku Enternete tshia mêna ne nomba mifila (ICANN): Mukenji wa dipingaja dia difunda dia matuku (ERRP), Mikenji ya dijimija dia domaine mimane kujika (EDDP), Mukenji wa dishintulula dia bafundi (Matuku 60 a Dishintulula dia bafundi), ne EPP Status Codes Reference (clientHold, redemptionPeriod, pendingDelete).
• Tshisumbu tshia bena mudimu ba malu a Enternete (IETF): RFC 6781 (DNSSEC Operational Practices: Key Rollovers and Emergency DS Kumbusha) & RFC 8901 (Multi-Signer DNSSEC Models for Multi-Provider Authoritative DNS).
• Tshilongelu tshia ditunga tshia mikenji ne bia mudimu (NIST) (États-Unis): Mukanda wa pa buawu 800-81-2: Nsombelu wa mêna a tshilaminu tshia bukubi (DNS) Mukanda wa dituma.
• Tshibambalu tshia bukubi bua ku Enternete ne tshia bintu bia mudimu (CISA) (United States): Emergency Directive 19-01: Mitigating DNS Infrastructure Tampering.
• Tshibambalu tshia malu a bukubi bua ku Enternete tshia matunga masanga a ku Mputu (ENISA): NIS2 Technical Guidance for DNS Service Providers and TLD Name Registries.