Kairēhita Rohe, Kaiwhakarato DNS ranei kua pau: Kua pau te Waehere Whakaora Whakaora Rohe, DNSSEC SERVFAIL Mahanga, me te Migration Nameserver ohorere¶

Ka oho ake ki te mohio ko te paetukutuku tuatahi a to kamupene, nga tohu mutunga API (api.example.com), me te imeera umanga (MX Ko nga rekoata mo Google Workspace, Microsoft 365 ranei) kaore e taea te toro atu puta noa i te ao (DNS_PROBE_FINISHED_NXDOMAIN ranei SERVFAIL) he raruraru hanganga-pango katoa. Kaore i rite ki te tūmau tukutuku kotahi i tukituki e pa ana ki tetahi ratonga, he Pūnaha Ingoa Rohe (DNS) ko te kore rehitatanga rohe ka wehe i nga ratonga kotahi i raro i to rohe pakiaka i te wa kotahi, tae atu ki te Waitohu-Kotahi (SSO), nga tomokanga tautoko a nga kaihoko, me nga imeera urupare-whakautu. I roto i te mahi, ka ahu mai te mangumangu rohe o te ao e toru nga keu: (1) he pakenga rohe ohorere i pau ai tetahi kaari nama kei runga i te konae ka murua e te kairēhita. NS rekoata ki te tohu ki te wharangi waka utu-ia-patene 24 to 48 hours i mua i te ra paunga tuturu; (2) he whakaekea DDoS, ka mutu te wakarere-whakahaere i to kaiwhakarato DNS mana (Route 53, Cloudflare, GoDaddy, Namecheap, DNSimple, NS1); ranei (3) he pakaru DNSSEC (DS rekoata) mekameka o te whakawhirinaki i te wa e tere ana te huri i te tuumau ingoa ka puta he whakatau whakatau (8.8.8.8, 1.1.1.1, ISP solvers) to drop 100 percent of your traffic with SERVFAIL. Mena i whakararu te tangata whakaeke i o tohu whakaurunga kairēhita me te whakawhiti, te whakarereke kino ranei i to rohe, huri ki te hopu ingoa rohe, te DNS kua pau, me te tango i te paetukutuku; Mena kua pau to tiwhikete TLS, kua pakaru ranei i muri i te whakaoranga o DNS, tirohia Kua pau te tiwhikete SSL/TLS i roto i te whakaputanga, te kati i mua i te HSTS, me te whakahou ohorere a Google Workspace or Microsoft 365 rohe ritenga maukati kaiwhakahaere me te manatoko DNS. Mena ka whakakorehia e tenei mate nga korero haumanu o te hohipera, 911/112 te ararere tuku ohorere, me nga taputapu a te iwi nui, waea atu ki to nama whawhati tata (911 i te United States me Canada, 112 puta noa i te Kotahitanga o Europi, 999 i roto i te United Kingdom) tirohia ranei to maatau raarangi tau ohorere.

Mahia tenei inaianei¶

1. Tatarihia i roto i te 10 hēkona mena he Rohe Kua Pahure/Tarewa te rahunga (EPP Status), he Kaituku Whakarato DNS Mana, a DNSSEC Rahunga Whakamana:
2. Rere whois yourdomain.com | grep -iE "Status|Expiry|Name Server" a dig +trace yourdomain.com.
3. Whakamatauhia mena ka hipa ranei DNSSEC whakamana (+cd = Taki Mono) ka whakatau ano i to rohe:

   dig @8.8.8.8 yourdomain.com A
   dig @8.8.8.8 yourdomain.com A +cd
   

   Mena ka hoki mai te whakahau tuatahi status: SERVFAIL ko te whakahau tuarua (+cd) ka hoki tonu status: NOERROR me te wāhitau IP o tō tūmau, KĀORE ō tūmau DNS i raro: tō DNSSEC (DS rekoata i te rehita) kua pakaru. Peke tonu ki te Wāhanga 3 ki te muku i te maru DS tuhi i to rehita.
4. Mena kua pau to rohe (Auto-Renew Grace Period ranei Redemption Grace Period), takiuru ki to rehita o naianei ka utu i te utu whakahou/whakaora; KAUA e tatari kia "maturuturu" te rohe kia taea ai e koe te rehita ano he iti noa:
5. I roto i nga 1 ki te 45 ra tuatahi i muri i te paunga (Auto-Renew Grace Period), ko te whakahou i to papatohu rehita ka whakahoki ano i o ingoa ingoa taketake i te utu whakahou paerewa ($10 to $30).
6. I roto i te 30-ra Redemption Grace Period (RGP / redemptionPeriod), me utu e koe te utu mo te rehita rehita ($80 to $250) na roto i to rehita o naianei. Mena ka tatari koe kia mutu te rohe 5-ra Pending Delete wahanga ki te whakaora $100, karetao kaipupuhi whakaheke-hopu aunoa (DropCatch, SnapNames, NameJet) ka kapohia to rohe i roto 5 milliseconds o te tuku me te hokohoko mo nga mano taara.
7. ** KAUA rawa e huri i to ingoa ingoa (NS) mai i te kaiwhakarato DNS-whakahohea DNSSEC (pēnei i Cloudflare, Route 53, Google Cloud DNS ranei) me te kore e tango i te DS tuhi i to rehita tuatahi**: Mehemea DNSSEC kua whakahohea ka huri koe i to NS he rekoata ki tetahi kaiwhakarato DNS whakaora i te wa e paheke ana me te kore e mukua te matua DS (Delegation Signer) tuhi i roto i te .com / .org Ko te rohe o TLD i te tuatahi, ko nga kaiwhakatikatika katoa i runga i te whenua ka paopao ki nga whakautu a te kaiwhakarato DNS hou kaore i hainatia hei whakaeke whakapohehe (SERVFAIL).
8. ** Mena kua kati koe i to umanga @yourdomain.com īmēra nā tō rohe MX kei raro nga rekoata, KAUA e paato "Tukua te waehere tautuhi kupuhipa ki admin@yourdomain.com" i to rehitatanga**: I to rohe NS ranei MX kei te tuimotu nga rekoata, ka tukuna he imeera whakaū ki @yourdomain.com ka peke, ka ngaro ranei ki roto i te rarangi. Whakamahia te SMS/Authenticator MFA a to kairēhita, te imeera taapiri-a-waho (@gmail.com / @proton.me), te rere manatoko tuakiri waea ranei.
9. I muri i te whakahou i tetahi rohe kua pau, tirohia a ringa kua whakahokia mai e to Kairēhita o Tumau Ingoa Ritenga taketake (NS) hei utu mo te waiho i te rohe sedoparking.com / renewyourname.net: Ka pau te rohe, ka tuhiruatia e nga kairēhita to ritenga NS nga rekoata me nga ingoa ingoa waka (ns1.parklogic.com, dns1.name-services.com). I etahi wa ko te utu i te whakahoutanga ka whakahou i te ra paunga ki te tau e whai ake nei i te wa e waiho ana nga ingoa ingoa waka kia kaha ki te huri ano i a koe.
10. Whakapuruhia nga keteroki DNS recursive a te ao (Google 8.8.8.8, Cloudflare 1.1.1.1, OpenDNS) te tuarua to NS ranei DS kua whakahokia mai nga rekoata: Engari me tatari mo te 24 ki te 48 haora mo te keteroki NXDOMAIN wharangi waka ranei NS ka pau noa nga rekoata, ka tiimata te horoi keteroki o te ao i te Google Public DNS (developers.google.com/speed/public-dns/cache) me te Cloudflare 1.1.1.1 (one.one.one.one/purge-cache/).

Rakau whakatau: te rohe o te ao, te whakamatautau ohorere ranei a DNS¶

Whakamahia tenei tūtohi rerenga ki te tohu i te paparanga tika o te hierarchy DNS (TLD Registry, Registrar EPP Status, DNSSEC DS Chain, ranei Authoritative Nameserver) kei te rahua te whakatau:

flowchart TD
    Start["Te Paheketanga o te Ao: Tukutuku Rohe me te Īmēra Kare i Te Whakatau (NXDOMAIN / SERVFAIL)"] --> RunDiag["Whakahaere: whois domain.com ME keri @8.8.8.8 domain.com +cd"]

    RunDiag --> CheckCD{"Kei te keri @8.8.8.8 domain.com I Rahua, I te Tāpiri +cd I Angitu?"}

    CheckCD -->|"Ae: Ka mahi me te +cd, Ka Rahua te kore +cd"| DnssecBreak["Kua pakaru DNSSEC Chain of Trust: Mukua Stale DS Record i te Rehita RĀNEI Waitohu Anō Rohe -> Flush 8.8.8.8 & 1.1.1.1"]

    CheckCD -->|"Kao: Ka Rahua, Whakahoki Turanga IP ranei"| CheckWhois{"Tirotiro WHOIS EPP Rohe Tūnga me te Rā Whakamutunga"}

    CheckWhois -->|"Tūnga: clientHold or serverHold"| HoldState["Kairēhita / Whakatarewa Rehita: Whakaotia ICANN RAA Īmēra Manatokonga RĀNEI Tukino/Tikiti Pire Inamata"]

    CheckWhois -->|"Kua Paahi te Ra Whakamutunga (Tuanga: AutoRenewPeriod)"| GraceRenew["Ra 1 ki te 45 i muri i te paunga: Utu i te Whakahoutanga Paerewa i roto i te Paerewa Rehita -> Manatoko Kua Whakaorahia te NS Ritenga"]

    CheckWhois -->|"Tūnga: RedemptionPeriod (RGP)"| RgpRestore["Ra 45 ki te 75 i muri i te paunga: Whakatuwherahia te Tikiti Tautoko Kai-Rehita / Utu Utu Whakaora RGP ($80-$250) Inamata"]

    CheckWhois -->|"Tūnga: tatari Muku"| PendingDel["Maukati 5-Ra Whakamutunga: Kaore e taea te Whakahou ki te Kairhita -> Whakanohoia nga Ota Whakamuri puta noa i nga Kaihopu Whakataka Nui Inaianei"]

    CheckWhois -->|"Tūnga: ok / clientTransferProhibited AND Expired in Future"| AuthDown["Te Rehitatanga Rohe Hauora -> Kaitiaki Kaiwhakarato DNS Whaimana te Rohe Ngaro ranei"]

    AuthDown --> MigrateNS["Kawemai i te Kōnae Rohe (`BIND` / Terraform) ki te Kaiwhakarato DNS Tuarua -> Tango DS Record mena kei te DNSSEC kei te -> Whakahou NS i te Kairēhita"]

Wāhanga 1: Te ICANN Domain Expiration Lifecycle (Auto-Renew vs. Redemption vs. Pending Delete)¶

Ina he Rohe Taumata-runga whanui (gTLD penei .com, .net, .org, .io, .ai, .co, .app, .dev) ka pau na te mea i rahua te kaari nama whakahou-aunoa, i whakakorehia ranei tetahi kaari putea i muri i te wehenga atu o tetahi kaimahi, ka haere te rohe ki roto i te huringa ora maha-waahanga e whakahaerehia ana e Te Kaupapa Whakaora Rehitatanga Kua Pahemo a ICANN (ERRP) me nga whakaaetanga kaiwhakahaere rehita (Verisign mo .com/.net, PIR mo .org, Identity Digital).

Me pehea te mate o te rohe me te aha e haere tuimotu ana i mua i te ra tuatahi ranei o te paunga¶

+-------------------------------------------------------------------------+
| ICANN gTLD EXPIRATION TIMELINE (.com / .net / .org example)             |
|                                                                         |
| [Active Domain]                                                         |
|       |                                                                 |
|       v  (Expiration Date Reached: Day 0)                               |
| +---------------------------------------------------------------------+ |
| | STAGE 1: Auto-Renew Grace Period (Day 1 to Day 30-45)               | |
| | - EPP Status: ok or clientHold (Registrar swaps your NS to parking) | |
| | - Production Impact: 100% OFFLINE within 0 to 48 hours of expiry    | |
| | - Recovery: Log into registrar & pay normal renewal ($10-$30).      | |
| +---------------------------------------------------------------------+ |
|       |  (Registrar sends Delete command to Registry at Day 30-45)      |
|       v                                                                 |
| +---------------------------------------------------------------------+ |
| | STAGE 2: Redemption Grace Period [RGP] (Exactly 30 Calendar Days)   | |
| | - EPP Status: redemptionPeriod (Domain removed from TLD Root Zone)  | |
| | - Recovery: Still 100% guaranteed to original owner, MUST pay       | |
| |   Registry RGP Redemption Fee ($80-$250) + renewal via registrar.   | |
| +---------------------------------------------------------------------+ |
|       |  (30-Day RGP expires without redemption payment)                |
|       v                                                                 |
| +---------------------------------------------------------------------+ |
| | STAGE 3: Pending Delete (Exactly 5 Calendar Days)                   | |
| | - EPP Status: pendingDelete                                         | |
| | - Recovery: IMPOSSIBLE to renew or redeem at any price. Registry    | |
| |   rejects all registrar commands until public drop at Day 5 (~18:00 | |
| |   UTC for Verisign .com/.net).                                      | |
| +---------------------------------------------------------------------+ |
+-------------------------------------------------------------------------+

Whakatauritehia o motika tika, utu, me nga mahi whakaora puta noa i nga wahanga katoa o te paunga, tae atu ki nga Waehere-a-Motu Nga puni Taumata-runga (ccTLDs rite .uk, .de, .eu, .ca, .au), e **kaore e whai i te ICANN gTLD ture:

Wāhanga 2: Taahiraa-i-te-taahiraa whakaora o te kua pau ranei RedemptionPeriod rohe¶

A pee i tenei raupapa tika hei whakahoki mai i tetahi rohe kua pau ki runga ipurangi i te wa poto rawa atu:

Hipanga 1: Whakahokihia te uru ki to Kaute Rehita i te wa @yourdomain.com kua mate te imeera¶

Anei te Catch-22 matarohia o te rohe kua pau: - To rohe (company.com) kua pau, na MX rekoata mo company.com ka mutu te whakatau. - Ka ngana koe ki te takiuru ki to rehita rohe (GoDaddy, Namecheap, Cloudflare, Porkbun, Hover, Network Solutions, Gandi), a ka kii te kairēhita: "I tukuna e matou he waehere whakamana 6-mati ki admin@company.com." - No te mea company.com kua pau, e kore e tae mai taua imeera.

Me pehea te wehe atu i te waahi imeera kua pau te rohe: 1. Kaua e whakawhiti, whakarereke ranei i tetahi mea: tirohia mena ka taea e koe te miro i te kaihopu mēra whawhati tata ANAKE mena kaore i pau te rohe (mehemea kua pau te rohe ki te taumata TLD, MX kaore e taea te whakatau ki hea kia whakahoutia). 2. Whakamahia te "Whakauru Īmēra Ngaro / Rohe Kua Pahemo" te Hongere Whakaora Pūkete a te Kairēhita: - Tata ki te katoa o nga kairēhita kua whakamanahia e ICANN e whakarato ana i te waea whakatapua, i te kaawanatanga-TT / rangatōpū-kaporeihana-tuhinga rerengamahi manatoko motuhake mo nga kaihoko e noho ana te imeera takiuru. @ te rohe kua pau i roto i te kaute. - Kia rite nga mea e toru i mua i te waeatanga ki te tautoko kairēhita: (a) te 4 mati whakamutunga o te kaari nama ranei PayPal tauwhitinga ID i whakamahia i runga i te nama whakahou o mua, (b) to Rehita Kaute Kaute / Kiritaki PIN, me © he whakaahua whakaahua a te kawanatanga + Tuhinga o te Kaporeihana / pire whaipainga e rite ana ki te WHOIS Registrant Organization (Tech / Admin / Registrant). 3. ** Kia takiuru, huri tonu i to wahitau imeera mo te Kaute Rehita ki tetahi rohe o waho (@gmail.com, @proton.me, he rohe whawhati tata motuhake ranei kei a koe)** ka whakahohea Kī Haumarutanga Pūmārō (FIDO2) ranei TOTP Authenticator App MFA no reira karekau e whakawhirinaki ki te takiuru @company.com īmēra anō.

Hipanga 2: Whakahaerehia te Whakahoutanga ranei RedemptionPeriod (RGP) Whakaora¶

1. Mēnā kei te wāhanga 1 te rohe (Auto-Renew Grace Period, Nga ra 1 ki te 30/45):
2. Haere ki te Billing -> Renewals or Rārangi Rohe -> Whakamutunga Tātari ka utu i te nama whakahou.
3. Tirohanga Tino 60 hēkona i muri i te utu: Whakatuwheratia nga Tumau Ingoa o te rohe (NS) i te papatohu kairēhita. Tirohia mehemea ka whakahokia aunoatia e te kairēhita ō tūmau ingoa tūturu (hei tauira, ns-123.awsdns-15.com ranei ada.ns.cloudflare.com) ka waiho ranei te rohe e tohu ana ki ona tuunga waka kua pau (ns1.sedoparking.com / dns1.registrar-servers.com). Mēnā kei te rārangi tonu ngā tūmau waka, tāurutia ā-ringatia ō tūmau ingoa whakaputa ka tiaki.
4. Mēnā kei te wāhanga 2 te rohe (Redemption Grace Period / redemptionPeriod, Nga ra 30/45 ki te 75):
5. Tirohia i roto i te ripa motuhake i roto i to papatohu kairēhita e kiia ana ko Wāhi Kua Pahemo -> Whakaoranga, Raru / Whakaora, Rarae/Whakaora Nama.
6. Utu te utu Whakaora RGP + 1-tau whakahou.
7. Me pehea te mahi whakaora RGP i te Rehita (Verisign / PIR)? Ka utua e koe te utu RGP, ka tukuna e to kairēhita he EPP <update><restore op="request"> whakahau ki te Rehita TLD. Ka huri tonu te Rehita i te mana rohe mai redemptionPeriod ki pendingRestore ka whakatakoto i to rohe NS ka rekoata ki roto i te Rohe Root TLD i roto i te 15 ki te 60 meneti i te wa e tuku ana to rehita restore op="report" te whakaū i te hanganga ture.

Hipanga 3: Whakawhitihia nga whakaroa keteroki ISP rohe ma te horoi 8.8.8.8 a 1.1.1.1¶

I te paunga o to rohe, ka keteroki e nga kaiwhakatikatika DNS huri noa i te ao nga ingoa ingoa waka, te kino ranei NXDOMAIN whakautu (e whakahaeretia ana e te TLD's SOA Minimum TTL, te tikanga 900 ki 3,600 hekona, ranei 86,400 hēkona mō NS rekoata). Ko te wa dig @a.gtld-servers.net yourdomain.com NS (e patai ana i te .com te tūmau pakiaka) ka whakaatu ano i o raarangi ingoa whakaputa: 1. Whakatuwheratia Google Public DNS Flush Cache (https://developers.google.com/speed/public-dns/cache): - Momo rere NS tuatahi mo yourdomain.com, ka horoi SOA, A, AAAA, MX, me TXT. 2. Whakatuwheratia Cloudflare 1.1.1.1 Purge Cache (https://one.one.one.one/purge-cache/): - Pure NS, A, AAAA, me MX mo yourdomain.com.

Wāhanga 3: Tūmau Ingoa ohorere (NS) Hekenga i te wa e paheke ana te Kaiwhakarato DNS (Me te DNSSEC Mahanga)¶

He aha mena he 100 paiheneti to rehitatanga rohe me te kore e pau, engari ko to Kaiwhakarato DNS Mana (Route 53, Cloudflare, GoDaddy DNS, DigitalOcean DNS, Azure DNS, DNSimple, Dyn) kei te mamae te mate kino, te whakaeke DDoS ranei, a me heke koe i nga Nameservers o to rohe (NS) ki te kaiwhakarato DNS taapiri inaianei?

Ko te #1 Migration Killer: Whakawhiti NS Ahakoa DNSSEC (DS Record) Kua Whakahohea¶

I mua i te huri i te kotahi NS tuhi i to rehita, whakahaere i tenei whakahau ki te tirotiro mena DNSSEC kua whakahohea ki to rohe i te rehita matua TLD:

dig +short yourdomain.com DS @8.8.8.8

+-------------------------------------------------------------------------+
| WHY CHANGING NS RECORDS WITH AN ACTIVE DS RECORD BREAKS THE INTERNET    |
|                                                                         |
| 1. Parent TLD (.com) holds your old DNS provider's DS Record (Key #2371)|
| 2. Old DNS Provider goes down. You import zone to New DNS Provider      |
|    (unsigned, or signed with a brand-new Key #9910) and swap NS.        |
| 3. Validating Resolver (8.8.8.8 / 1.1.1.1 / Comcast / ISP) queries      |
|    New DNS Provider, sees signature does NOT match DS Key #2371.        |
| 4. Resolver assumes an active MITM Spoofing Attack -> Returns SERVFAIL  |
| 5. RESULT: Your domain stays 100% dead worldwide even though the new    |
|    DNS servers are up and answering cleanly.                            |
+-------------------------------------------------------------------------+

Te Rarangi Arowhai Migration Migration Tūmau Ingoa ohorere (Zero SERVFAIL Tikanga)¶

1. Whakahoutia, kawemai ranei i to Kōnae Rohe DNS katoa ki te kaiwhakarato DNS hou i te tuatahi:
2. Kaua rawa e pohehe i o rekoata DNS mai i te mahara (@, www, a api he iti noa nga rekoata; wareware MX, SPF/TXT, DKIM, _dmarc, autodiscover, ranei CAA ka pakaru te tuku imeera me nga whakahoutanga TLS).
3. Kei hea e kitea ai to rohenga DNS katoa ina kua heke te papatohu o to kaiwhakarato DNS tuatahi:
   • Tirohia te Hanganga-hei-Waehere (Terraform, Pulumi, OctoDNS, DNSControl) kei roto i to putunga Git.
   • Tirohia nga kaweake rohe tata nei (BIND .zone nga konae) rapua ranei nga papaunga korero DNS o mua (SecurityTrails, ViewDNS.info, DNSDumpster, ranei Censys / crt.sh mo nga roheroto).
   • Uiui nga rekoata keteroki e noho tonu ana i roto i nga kaiwhakatakoto whakaaro mo te iwi whanui (dig @8.8.8.8 yourdomain.com MX, dig @1.1.1.1 yourdomain.com TXT, dig @9.9.9.9 api.yourdomain.com A) i mua i te paunga o o ratou TTL.
4. Whakamana kei te whakahoki mana te kaiwhakarato DNS hou mo ia rekoata nui i mua i te pa ki to rehita: Mehemea na to kaiwhakarato hou koe i tuku ns1.rescuedns.com a ns2.rescuedns.com. Whakamatautau tika ratou ki dig:

   dig @ns1.rescuedns.com yourdomain.com SOA +norecurse
   dig @ns1.rescuedns.com yourdomain.com A +norecurse
   dig @ns1.rescuedns.com yourdomain.com MX +norecurse
   

   Tatari tae noa ki te flags: raina i roto i te dig kei roto i te pane aa(Authoritative Answer) ka hoki mai status: NOERROR.
5. Mehemea dig +short yourdomain.com DS whakahokia a DS record, kakau DNSSEC i te kairēhita:
6. I te wa e paheketanga kaha ana kaore e taea te toro atu ki te kaiwhakarato DNS tawhito: Takiuru ki to Kaihita Rohe (i hokona e koe te rohe), haere ki te waahanga DNSSEC / DS Records, ka muku katoa DS rekoata na ka hoki te rohe ki te kore haina (Insecure) aratau i te rohe matua TLD. Tatari kia tae ra ano dig +short yourdomain.com DS @a.gtld-servers.net ka hoki kau (me te horoi DS i roto 8.8.8.8 / 1.1.1.1), taapirihia ranei te hou DNS kaiwhakarato DS tuhi ki te taha o te tawhito mena ka mahia he hekenga haina maha kua whakamaheretia.
7. Whakahoutia nga Tumau Ingoa (NS) i to Rehita Rohe: Whakakapihia nga ingoa ingoa mate ki te ns1.rescuedns.com a ns2.rescuedns.com kei roto i to rehitatanga Tumau Ingoa Ritenga (tohu: huri NS ko nga rekoata kei roto i te ētita rohe kaore he mahi ina mate nga kaitoro tawhito; me huri e koe te Kapia / Maatua Tukunga Ingoa Kaituku i te taumata Rehita).
8. ** Pure NS a DS keteroki i runga i a Google (8.8.8.8) me Cloudflare (1.1.1.1)**: Whakamahia nga taputapu horoi keteroki a te iwi mai i te Wāhanga 2 Hipanga 3 hei akiaki i te tango wawe i nga ingoa ingoa hou.

Wāhanga 4: Te ora i te 60-Day ICANN Rehita Whakawhiti Maukati i te wa ohorere¶

Ka aha mena ka hiahia koe ki te whakawhiti i to rohe ki tetahi kairēhita hou (ICANN Inter-Registrar Transfer), kia araia noa e Domain Status: clientTransferProhibited me tetahi karere e kii ana: "Kei raro tenei rohe i te 60-ra ICANN Whakawhiti Maukati no te mea kua whakahoutia nga korero whakapā"?

1. He aha te raka 60-ra i puta ai: I raro i te ** Kaupapa Whakawhiti ICANN (Wahanga II.C.1)**, ka tuu nga kairēhita he raka whakawhiti mo te 60 ra i nga wa katoa ka rehitatia hou tetahi rohe, ka whakawhitia i waenga i nga kairēhita, ka tukuna ranei he "Huringa o te Kai-Rehita" (whakahou i te Ingoa Tuatahi, Ingoa Whakamutunga, Ingoa Whakahaere Rehita, Wāhitau imeera ranei).
2. Me pehea te karo, te whakaputa ranei i te raka Huri-o-Rēhita 60-ra:
3. I mua i te whakatika i nga taipitopito whakapā a WHOIS: Tata ki te katoa o nga kairēhita nui e whakarato pouakataki tika i runga i te mata whakatika whakapā kua tapaina: "Whakaputaina mai i te raka whakawhiti 60-ra i muri i tenei whakahou whakapā." Ma te tirotiro i taua pouaka ka taea e koe te whakahou i to wahitau imeera kaiwhakahaere/kairehita me te whakaputa tonu EPP Auth-Code (Transfer Secret) ki te whakawhiti i te rohe i taua ra ano.
4. Kia mahara kaore koe e hiahia ki te whakawhiti i te rehitatanga rohe ki te huri i nga kaiwhakarato DNS: Ahakoa ka maukati tetahi rohe mo nga ra 60 ki te Whakawhiti Rehita (clientTransferProhibited), ka taea tonu e koe te huri i ona Tumau Ingoa (NS rekoata) i te kairēhita o naianei i nga wa katoa kaore he wa tatari; Ko te huri i te DNS he meneti, engari ko te whakawhitinga katoa o te kairēhita ka roa ki te 5 ki te 7 ra ki te kore te kairēhita ngaro ka pao tonu Whakaaetia te Whakawhiti Putaatu (FOa) pātene.

Wāhanga 5: Whakapakeke i nga rehitatanga rohe me te DNS ki te whakakore i nga wa kei te heke mai¶

Kia 100 paiheneti te whakahoki mai o to rohe me to whakataunga DNS, whakaotia tenei rarangi arowhai manahau:

• ** Whakahohe Registry Lock (serverDeleteProhibited, serverUpdateProhibited, serverTransferProhibited) i runga i nga rohe whakaputa miihana-nui**: Paerewa Registrar Lock (clientTransferProhibited) ka taea te takahuri ma te paato kotahi mena ka hopukia e te kaitukino to takiuru rehita. Maka Rēhita (na Verisign, PIR, Cloudflare, CSC, MarkMonitor, Gandi, me Porkbun/Namecheap mo nga rohe hinonga) ka maukati tika te rohe ki te taumata Rehita TLD, e hiahia ana kia whakamanahia te reo-tangata maha-tangata-ma-waho i mua i tetahi. NS Ka taea te whakarereke i te rekoata, ka mukua ranei te rohe.
• Whakahouhia nga rohe whakaputa mo te 5 ki te 10 tau i mua atu (ICANN maximum horizon is 10 years): Kaua rawa e waiho he rohe whakahirahira pakihi i runga i te whakahoutanga o ia tau ki te tau ka taea e te kaari nama umanga kotahi kua pau te pau te paheketanga. Utu-mua 5 ki te 10 tau i te wa kotahi.
• ** Kaua rawa e whakamahia he @yourdomain.com te wahitau imeera hei whakapā atu ki te takiuru, ki te whakamohiotanga nama nama ranei i te kairēhita whakahaere yourdomain.com**: Whakamahia he rarangi tohatoha haumarutanga i runga i te rohe whakahaere motuhake, i te kaute o waho ranei, me te aroturuki RDAP / WHOIS nga ra paunga na roto i nga kaitirotiro Prometheus o waho aunoa / Uptime (domain_expiry_days < 60).
• ** Raro NS a DS TTLs (300 ki 3600 hekona) 48 haora i mua i te hekenga DNS kua whakamaheretia**: Ko te whakaheke i nga TTL i mua ka whakarite ka huri nga kaiwhakatau i roto i te 5 meneti o te tapahi kua whakaritea.

Nga nama ohorere a rohe me nga tikanga umanga¶

Ina pa ana tetahi rohe, DNS ranei ki nga whare hauora, ratonga ohorere, taputapu taone, me nga hanganga kawanatanga ranei, whai i enei hongere pikinga rohe:

• Te Hononga o Amerika me Kanata: Waea 911 mena ka whakakorehia e te rohe/DNS te mate waea a te hohipera haumanu, te tuku waka tūroro, nga punaha haumaru-ora ranei. Panuitia nga whakaekenga DDoS mo nga hanganga DNS, te kahakina BGP/DNS ranei ki CISA (1-844-Say-CISA / cisa.gov/report), te FBI IC3 (ic3.gov), ranei te Canadian Center for Cyber Security (1-833-CYBER-88). Mo .gov rohe, whakapā atu ki te CISA .gov Rehita Awhina.
• United Kingdom: Waea 999 mo nga whakatuma ki te ora, ki nga raru NHS kaha ranei. Tukuna atu nga pakarutanga DNS tino nui, kahaki rohe ranei ki te NCSC (ncsc.gov.uk), ka whakapā atu ki a Tautaki (01865 332244) tika mo te ohorere .uk / .gov.uk / .nhs.uk take rehita.
• Uniana Pākehā: Waea 112 puta noa i nga whenua mema EU katoa. Ko nga kaiwhakarato ratonga DNS me nga rehita ingoa TLD kei raro i te EU NIS2 Directive (Directive 2022/2555) a me whakaatu i nga maiki nui e waatea ana ki to ratou CSIRT motu i roto i te 24 haora.
• Ahitereiria me Aotearoa: Waea 000 i Ahitereiria ranei 111 kei Aotearoa; tuku korero mo nga DNS kino, nga maiki rohe ranei ki te ACSC (1300 CYBER1), auDA (mo .au), ranei Domain Name Commission NZ (mo .nz).
• India me Ahia-Kiwa: Waea 112 i Inia mo te urupare ohorere; ripoata nga whakaekenga hanganga DNS/rohe ki CERT-In (incident@cert-in.org.in) i roto i nga haora 6 ranei NIXI mo .in pikinga rehitatanga.

Pātai auau¶

He aha taku rohe i mutu ai te mahi 24 haora i mua i tana tohu tohu wa paunga WHOIS?¶

Tuatahi, tirohia nga waahi waahi: WHOIS `Registry Expiry Date` ka taia i nga wa katoa ki **UTC (`Z`)**, e 4 ki te 8 haora i mua i nga rohe waahi o Amerika Te Taitokerau (te tikanga he rohe ka pau i te `2026-11-01T04:00:00Z` mooni pau i `8:00 PM PDT` i te Oketopa 31). Tuarua, mena ko to `NS` rekoata i a `24-hour` ranei `48-hour` TTL me te kairēhita i whakawhitia ki `00:00 UTC` i te ra paunga, ko nga kaiwhakamahi na ratou nga kaiwhakatikatika i whakaora moata ka pa ki te wharangi waka waka i etahi wa ka noho keteroki mo etahi haora.

Kua kore rawa taku kairēhita i te pakihi, kaore ranei i te aro (Dead / De-accredited Registrar), a kei te pau taku rohe. Me pehea taku whakaora?¶

Ina whakamutua, ka whakakorehia ranei e te ICANN tetahi kairēhita karekau i raro i te **Hakarere Whakawhiti Rehita Kua Whakamana (De-Accredited Registrar Transition Procedure) (`DARTP`)**, Ka whakawhiti aunoa a ICANN i nga rohe katoa ki tetahi kairēhita kaitiaki me te kore utu ki nga kairēhita. Takitaki `whois yourdomain.com` (ranei `lookup.icann.org`) kia kite ko wai **Karehita** me **IANA ID** kei te pupuri i to rohe i tenei wa, ki te tuku ranei i tetahi **Whakahou Rohe / Whakawhiti Aramatanga** tika me ** ICANN Contractual Compliance (`icann.org/compliance/complaint`)**.

He aha taku paetukutuku e mahi ana mo etahi o nga kaihoko i runga i nga raraunga pūkoro, engari kei te whakaatu tonu i te wharangi waka kua pau i runga i to maatau tari Wi-Fi 6 haora i muri i taku whakahou i te rohe?¶

Ko to whatunga tari, ko to ISP recursive DNS ranei i keteroki te wharangi waka a te kairēhita `NS` a `A` nga rekoata i te wa i pau ai te rohe, me nga tuunga ingoa waka i tino whakatuu i nga TTL teitei (`3,600` ki `86,400` hekona / 24 haora) no reira ka noho keteroki tonu nga whaarangi panui. Purihia a Google (`8.8.8.8`) me Cloudflare (`1.1.1.1`) ma te whakamahi i a raatau taputapu horoi tukutuku, katahi ka whakahaere i to rorohiko rohe `ipconfig /flushdns` (Windows), `sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder` (macOS), ranei `sudo resolvectl flush-caches` (Linux).

He aha te mea ka puta ki nga imeera i tukuna ki @yourdomain.com I te wa i pau ai to maatau rohe, DNS ranei mo nga haora 18? Kua ngaro ratou mo ake tonu atu?¶

I te nuinga o nga wa, KORE e ngaro nga imeera tika i tukuna i roto i nga haora 12 ki te 48 tuatahi o te mate DNS: kua tutirahia ki runga i te tūmau mēra a te kaituku, ka tae aunoa mai i roto i nga haora e whai ake nei. Kei raro **`RFC 5321` (Kawa Whakawhiti Mēra Maamaa, Wāhanga 4.5.4.1)**, ina he tūmau mēra (`Gmail`, `Microsoft Exchange Online`, `Postfix`) ka rahua te rapu DNS rangitahi (`SERVFAIL`) kaore ranei e taea te hono atu ki tetahi `MX` Kaihautu, ka waiho te karere ki te rarangi ngana ano mo **4 ki te 5 ra (`96 to 120 hours`)**, ka ngana ano me te whakamuri taupū. Heoi, mena kei roto i te wharangi waka waka a te kairēhita he **wildcard null `MX` tuhi (`0 .`)** he tūmau mēra waka ranei i paopao ki te mēra me te uaua `550 5.1.1 User Unknown` te tāwhana pūmau, i whiwhi whakamōhiotanga tāwhana tonu aua kaituku me tuku anō ā rātou īmēra.

Ka taea e au te whakarite kia rua nga kaiwhakarato DNS i te wa kotahi (Cloudflare + Route 53) ma te whakarārangi e rua Cloudflare NS nga rekoata me nga huarahi e rua 53 NS rekoata i taku rehita?¶

Ae, rite te roa `DNSSEC` kua monoa (he tika te whirihora me `RFC 8901` Maha-Waitohu DNSSEC) me nga kaiwhakarato e rua e mahi ana i nga rekoata DNS rite. Ka uiuia e nga kaiwhakatau recursive nga matua kua whakarārangihia `NS` nga rekoata e whakamahi ana i te whiriwhiringa toroa-roobin/RTT (`SRTT`). Mena ka rarangi koe `ns1.providerA.com`, `ns2.providerA.com`, `ns1.providerB.com`, a `ns2.providerB.com` i roto i nga Pumau Ingoa Ritenga a to kairēhita me te pupuri i nga rohe e rua kia tukutahi ma te whakamahi **OctoDNS**, **DNSControl**, **Terraform**, ranei `AXFR / IXFR` Ko nga whakawhitinga rohe, ka ora tonu to rohe i te 100 paiheneti te mate o tetahi kaiwhakarato DNS.

He aha te rereketanga o clientHold a serverHold i roto i a WHOIS?¶

Waehere mana EPP timata ki **`client...`**(`clientHold`, `clientTransferProhibited`) ka whakatauhia e to **Kaihita Rohe** (te kaihokohoko e whakahaere ana koe i to putea, penei i a Namecheap, GoDaddy ranei) ka taea te tango tonu e te tautoko a to kairēhita, te punaha nama. Waehere tūnga timata ki **`server...`**(`serverHold`, `serverTransferProhibited`) he mea whakarite tika e te **TLD Registry Operator** (`Verisign`, `PIR`, `Nominet`) na nga ota a te kooti, nga tautohetohe UDRP, te whakatārewatanga o te rehita-rehita, he taputapu ranei **Maka Rēhita**, me te whakapā atu ki te Rēhita ma to kairēhita ki te hiki.

Nga kaiarahi e pa ana¶

• Kahaki ingoa rohe, DNS kua pau, me te tango i te paetukutuku
• Kua pau te tiwhikete SSL/TLS i roto i te whakaputanga, te kati HSTS i mua i te utaina, te poraka rekoata CA CAA, me te whakahou ohorere.
• Google Workspace or Microsoft 365 rohe ritenga maukati kaiwhakahaere, manatoko DNS TXT, me te whakaoranga kairëti
• Ko te kaipahua DNS, te whirihora WAN pouara ISP, me te tinihanga i te tomokanga mauhere
• Nga raruraru manaaki Tukutuku, te hekenga, me te whakaora whakaora
• Ko nga nama ohorere ma te whenua

Nga puna me nga aratohu whai mana¶

• Kaporeihana Ipurangi mo nga Ingoa me nga Nama kua tohua (ICANN): Kua Pahu Rehitatanga Kaupapa Whakaora (ERRP), Kaupapa Whakamutunga Rohe Kua Pahemo (EDDP), Kaupapahere Whakawhiti Waa-Rehita (60-Ra Huri-o-Rehita Maukati), me nga Waehere Tikanga EPP Tohutoro (clientHold, redemptionPeriod, pendingDelete).
• Ope Mahi Hangarau Ipurangi (IETF):RFC 6781 (Nga Mahi Mahi DNSSCEC: Nga Huringa Matua me te Ohotata DS Tango) & RFC 8901 (Tauira DNSSEC Waitohu Maha mo te DNS Mana Kaituku Maha).
• National Institute of Standards and Technology (NIST) (Te Hononga o Amerika): Whakaputa Motuhake 800-81-2: Pūnaha Ingoa Rohe Haumaru (DNS) Aratohu Tukunga.
• Pokapü Haumaru Haumaru me te Hanganga Hangarau (CISA) (Te Hononga o Amerika): *Arataki ohorere 19-01: Te Whakararuraru i nga Hanganga DNS *.
• Te Roopu Uniana a Europi mo te Haumaru Haumaru (ENISA): Arahi Hangarau NIS2 mo nga Kaituku Ratonga DNS me nga Rehita Ingoa TLD.