Go tseelwa leina la kgolagano ya dikhomphiutha ka dikgoka, go tsenngwa botlhole mo DNS, le go tswalelwa mokwadisi¶

Go latlhegelwa ke taolo ya leina la kgolagano ya dikhomphiutha la mokgatlho wa gago kgotsa kgaolo ya Authoritative DNS ke nngwe ya maemo a tshoganyetso a a senyang thata a dijithale a kgwebo, bookelo, setheo sa mmasepala, kgotsa kgatiso ya mo inthaneteng e ka nnang le one. Ka gonne leina la gago la domain ke modi wa go tshepana ga tsamaiso nngwe le nngwe mo inthaneteng, motlhasedi yo o tseelang akhaonto ya gago ya mokwadisi wa domain ka dikgoka kgotsa yo o tsenyang direkoto tsa gago tsa DNS botlhole ga a senye webosaete ya gago fela. Mo metsotsong e se kae fela morago ga go fetola NS (Sefara ya maina), A/AAAA (IP ya Webo), kgotsa MX (Mail Exchange) direkoto, motlhasedi a ka thibela ka tidimalo imeile nngwe le nngwe e e tsenang ya khamphani le ya bareki, a feta ka go itirisa A re Encrypt Domain Validation (DV) e tlhola go dira disetifikeiti tsa go tsenya khoutu tsa TLS/SSL tse di amogelesegang mo leineng la gago, go tshwara dikhunololamoraba tsa Single Sign-On (SSO) tsa badiri, le go tlhotlheletsa diimeile tsa go seta sešwa dikhunololamoraba tsa mafaratlhatlha a gago a kwa marung, di-portal tsa banka, le diakhaonto tsa madi. Tota le go palelwa go go seng kotsi, jaaka kgolagano ya dikhomphiutha e e feletsweng ke nako e e welang mo AutoRenewGracePeriod kgotsa RedemptionPeriod (clientHold), e tlisa pharakano ya webo, di-backend tsa selulafouno tsa API, le imeile ya khamphani go ema ka bonako go ralala lefatshe.

Fa go tseelwa dikhomphiutha ka dikgoka kgotsa go kgaoga ga DNS go dira gore go se ka ga nna le tsela ya molwetse wa bookelo, ditlhaeletsano tsa thomelo ya tshoganyetso, thelemeteri ya ditirelo tsa setšhaba, kgotsa tsamaiso e e dirang ya pabalesego ya botshelo, leletsa nomoro ya gago ya tshoganyetso ya lefelo leo (911 kwa United States le kwa Canada, . 112 go kgabaganya Yunione ya Yuropa, 999 kwa United Kingdom) kgotsa leba lenaane la rona la dibuka tsa boditšhabatšhaba dinomoro tsa tshoganyetso mme o itsise setlhopha sa gago sa bosetšhaba sa go tsibogela ditiragalo tsa inthanete (jaaka CISA kwa United States mo 1-844-SAY-CISA kgotsa NCSC kwa United Kingdom) ka bonako. Bakeng sa mathata ohle a kgwebo, a sa etseng phaello, le a domeine ya botho, phethahatsa dikgato tsa ho kgetholla tse ka tlase ka tatelano e nepahetseng.

Dira se jaanong¶

1. Tlhomamisa mo metsotswaneng e le 30 gore a kgolagano ya dikhomphiutha ya gago e feletswe ke nako, direkoto tsa gago tsa DNS di fetotswe, kgotsa kgolagano ya dikhomphiutha e fetiseditswe kwa mokwadisi wa kwa ntle: Tsamaisa tlhamalalo RDAP kgotsa WHOIS patlisiso le patlisiso ya DNS e e nang le taolo go tswa mo theminaleng (rdap yourdomain.com kgotsa whois yourdomain.com, le dig +trace yourdomain.com). Tlhola Leina la Mokwadisi, Dikhoutu tsa Seemo sa EPP (jaaka clientHold go duela/netefatso kgatlhanong le. ok ka disefara tsa maina tse di sa tlwaelegang), le Disefara tsa Maina tse di Nang le Taolo (NS).
2. Freeze all outbound password resets and lock down your Identity Provider (Okta, Microsoft Entra ID, Google Workspace) immediately: If an attacker controls your domain's MX records or NS servers, they receive every single email sent to *@yourdomain.com. Immediately instruct your IT administrators to disable "Forgot Password via Email" self-service resets across all corporate tools, revoke active sessions for users whose email addresses might be used to reset external vendor accounts, and switch administrative logins to hardware FIDO2 security keys or internal .onmicrosoft.com fallback domains.
3. Preserve full forensic snapshots of RDAP/WHOIS, DNS zones, and Certificate Transparency (CT) logs before anything changes: Save the output of dig ANY yourdomain.com @8.8.8.8, whois yourdomain.com, and check crt.sh/?q=%25.yourdomain.com immediately. Searching crt.sh reveals every unauthorized SSL/TLS certificate the attacker just minted for your subdomains (mail., vpn., login., api.) so you know exactly which internal services they are actively impersonating via Adversary-in-the-Middle (AitM) proxies.
4. Contact the Losing Registrar's dedicated Emergency Abuse / Security Operations Team (not Tier-1 chat support) to trigger an ICANN Unauthorized Transfer Dispute (IRTP) or Registry Lock reversal: If your domain was pushed to another account at the same registrar or transferred via a stolen Auth-Info (EPP) code to a foreign registrar, contact your original registrar's Domain Abuse / High-Risk Security Escalation Desk and request an immediate Registrar Undo / Emergency Transfer Dispute under the ICANN Transfer Policy (Section I.A le Transfer Dispute Resolution Policy), citing unauthorized credential compromise.
5. Tlhatlogela ka tlhamalalo kwa Modirising wa Kwadiso ya Domain ya Maemo a a Kwa Godimo (TLD) fa mokwadisi a sa tsiboge: Gakologelwa tatelano ya maemo: Bakwadisi (jaaka GoDaddy, Namecheap, Cloudflare, MarkMonitor, Ditharabololo tsa Neteweke, Gandi, Porkbun) ke barekisi ba ba rekisang gape fela; Modirisi wa Kwadiso (jaaka Verisign ya .com/.net, Public Interest Registry (PIR) for .org, Nominet for .uk, CIRA for .ca, DENIC for .de, or auDA for .au) runs the master root zone database. Country-code (ccTLD) dikwadiso le dikwadiso di le mmalwa tsa gTLD di ka tlhagisa maemo a tshoganyetso serverHold kgotsa serverUpdateProhibited notlela ka tlhamalalo mo maemong a modi ka nako ya ditiragalo tsa bosenyi jwa inthanete tse di netefaditsweng.
6. Tlhagisa bareki, barekisi, le balekane ba banka ka ditšhanele tse di kwa ntle ga setlhopha tse di @yourdomain.com imeile e tsentswe mo kotsing: Fa motlhasedi a tsere imeile ya gago ka dikgoka MX direkoto, ba tla hang-hang araba ho bula akhaonteng dikgwele le fosahetseng phetiso terata ditaelo. Itsise bareki ka mogala, SMS, LinkedIn, tsebe ya maemo mo kgolaganong e e farologaneng ya bekapo, kgotsa diakhaonto tsa semmuso tsa media wa botsalano gore ba se ka ba tshepa imeile epe kgotsa portal ya go tsena mo kgolaganong e e amegang go fitlha go netefadiwa go busediwa.

Setlhare sa tshwetso: go sekaseka le go nna le kgolagano ya dikhomphiutha kgotsa go kgaoga ga DNS¶

Follow this rapid diagnostic flowchart to pinpoint the exact layer of the Domain Name System that has failed or been hijacked:

flowchart TD
    A["Website Down, TLS Certificate Warning, or Corporate Email Halted"] --> B["Run RDAP/WHOIS & dig +trace from External Network"]
    B --> C{"What do RDAP Status & Registrar Fields Show?"}
    C -->|"Status: clientHold, autoRenewPeriod, or redemptionPeriod"| D["Accidental Expiration or ICANN Whois Verification Suspension"]
    D --> E["Log into Registrar Immediately: Pay Renewal / Redemption Fee or Click RAA Verification Link; Request Emergency TTL Flush"]
    C -->|"Registrar Name or Registrant Account Changed Without Authorization"| F["Go Utswa Akhaonto e e Tletseng ya Mokwadisi kgotsa Phetiso ya EPP e e sa Dumelelwang"]
    F --> G["Lotlela Motlamedi wa Boitshupo (Entra/Google), Faela Thekete ya Tiriso e e sa Siamang ya Mokwadisi wa Tshoganyetso + Kganetsano ya Phetiso ya ICANN, Tlhola crt.sh go bona Ditifikeiti tsa Boferefere"]
    C -->|"Mokwadisi le NS Ga di a fetolwa, mme Direkoto tsa A / CNAME / MX di Supa di-IP tse di sa itsiweng"| H["Go Laolwa ga Motlamedi wa DNS (Cloudflare / Route53 / Senotlolo sa API sa NS1 kgotsa Tlolo ya Akhaonto)"]
    H --> I["Phimola Dithokene tsa DNS API tse di Tsenyegileng, Busetsa Faele ya Lefelo le le Itsiweng le le Molemo, Phimola Ditifikeiti tsa TLS tse di sa Siamang, Dikolosa Dintlha Tshupo tse di Bontshitsweng"]
    C -->|"Mokwadisi, NS, le Direkoto tsa Kgaolo di Lebega di Tlwaelegile, mme Lefelo le a Palelwa ka SERVFAIL"| J["Ketane ya Terasete ya DNSSEC e e thubegileng (Go sa Tshwane ga Rekoto ya DS kgotsa RRSIG e e Fedileng Nako)"]
    J --> K["Tsamaisa Tlhotlhomiso ya DNSViz.net: Tlosa Rekoto ya DS e e sa tlholeng e le teng kwa Mokwadisi kgotsa Lefelo la Saena Gape kwa Moamogeding wa DNS"]

Kgato 1: Dipatlisiso tsa setegeniki tsa go bona tlhaselo¶

Fa domeine e emisa go rarabolola ka tshoganyetso kgotsa e simolola go direla tsebe ya phishing kgotsa tsietso ya cryptocurrency, motsotso mongwe le mongwe o o dirisiwang go fopholetsa o senya nako e e botlhokwa ya go boela mannong. Go na le ditiragalo di le nne tse di farologaneng gotlhelele tse di lebegang di tshwana le modirisi wa bofelo mo sebatling sa webo, mme nngwe le nngwe ya tsone e tlhoka go baakanngwa go go farologaneng gotlhelele.

Tsela ya go Buisa RDAP, WHOIS, le dig Dipholo Jaaka Motsibogi wa Tiragalo¶

Bula theminale ya ditaelo mo Linux, macOS, kgotsa Windows (o dirisa WSL kgotsa nslookup) le go dira ditshekatsheko tse tharo tse di latelang tsa go tlhatlhoba bolwetse o dirisa sedirisiwa se se sa tseyeng letlhakore sa tharabololo ya botlhe (8.8.8.8 kgotsa 1.1.1.1):

1. Tlhola Boemo jwa Boemo jwa Kwadiso (dig +trace le RDAP):

   dig +trace yourdomain.com NS @1.1.1.1
   

   • Look at the step right after the TLD root servers (for example, a.gtld-servers.net. for .com). Which NS (Nameserver) hostnames are returned by the TLD Registry itself?
   • Fa Kwadiso ya TLD e busetsa disefara tsa gago tsa maina tse di tlwaelegileng (ns1.yourdnsprovider.com) ka seemo NOERROR, go tseelwa dithoto ka dikgoka go diragala ka fa gare ga moabi wa gago wa kamogelo ya DNS (kgotsa ke go thubega ga DNSSEC).
   • Fa Kwadiso ya TLD e busetsa disefara tsa maina tse di sa tlwaelegang gotlhelele (kgotsa fa whois yourdomain.com shows a new Registrar: name and an Updated Date: within the last few hours or days), the hijack happened at the Domain Registrar level.
2. Decode the ICANN EPP Domain Status Codes: Leba Domain Status: lines in your WHOIS kgotsa RDAP dipholo. Dikhoutu tseno tse di tlhomamisitsweng tsa Porothokholo ya Tlamelo e e Atolosiwang (EPP) di go bolelela gore ke eng fa kgolagano ya dikhomphiutha e palelwa kgotsa e notletswe:

Kgato 2: Go boela morago ga go tseelwa kgolagano ya dikhomphiutha ka kotsi kgotsa go fetisediwa kwa go mokwadisi yo o sa letlelelweng¶

Batlhasedi ba tsaya ka dikgoka dikarolo tsa boleng jo bo kwa godimo tsa dikhamphani, Web3/DeFi, tsa madi, le tsa bobegakgang ba dirisa mekgwa e meraro ya konokono: 1. Go Tseela Akhaonto ya Mokwadisi (Go Tsenya Ditshupo, Serweboleta se se Kotsi sa Infostealer, kgotsa Go Ananya SIM): Motlhasedi o tsena mo GoDaddy ya gago, Namecheap, Dikgaolo tsa Google/Squarespace, kgotsa dasheboto ya Ditharabololo tsa Neteweke, o a tima clientTransferProhibited, e fetola NS direkoto go supa akhaonto ya Cloudflare e e laolwang ke motlhasedi, kgotsa e tlhagisa Auth-Info (EPP) khoutu ya go fetisetsa domeine kwa ntle. 2. Boenjenere jwa Loago jwa Tshegetso ya Mokwadisi: Motlhasedi o romela ditokomane tsa bofora tsa go tsenngwa ga khamphani, di-ID tsa puso tsa maaka, kgotsa tlhogo ya makwalo e e fosagetseng kwa tafoleng ya go busetsa akhaonto ya mokwadisi a bolela gore motsamaisi wa ntlha wa IT o tlhokafetse kgotsa o tlogetse khamphani. 3. Go Tsewa ga Kgaolopotlana (Dangling CNAME / Dangling NS: Kgaolo ya dikhomphiutha ya gago e kgolo ga e ise e amiwe, mme kgolagano ya dikhomphiutha ya bogologolo (promo.yourdomain.com kgotsa status.yourdomain.com) e sa ntse e na le CNAME rekoto e e supang kgamelo ya AWS S3 e e sa tlholeng e dirisiwa, Tirelo ya Tiriswa ya Azure, repo ya Ditsebe tsa GitHub, tiriswa ya Heroku, kgotsa sekai sa Zendesk se o se phimotseng dikgwedi tse di fetileng. Motlhasedi o kwadisa leina leo la motswedi wa maru le le tlogetsweng mo AWS/Azure/GitHub mme ka bonako o direla diteng tse di kotsi go tswa mo karolongpotlana ya gago ya semmuso.

Kgato 1: Leleka Motlhasedi mo Motlameding wa Gago wa Boitshupo jwa kwa Marung le mo Tsamaisong ya Imeile¶

Pele ga o fetsa go tlatsa foromo ya go busetsa mokwadisi, tsaya gore motlhasedi o bala imeile nngwe le nngwe e e rometsweng kwa kgolaganong ya dikhomphiutha ya gago ka tlhagafalo mme o leka go tsena mo mafaratlhatlheng a gago a ka fa gare a kwa marung:

1. Fetola Microsoft 365 / Lefelo la Tiro la Google go nna Dikgaolo tsa Dikgaolo tsa Boemo le MFA ya Serweboleta:
   • Mo ID ya Microsoft Entra (e e kileng ya bo e le Azure AD), mohiri mongwe le mongwe o na le kgolagano ya dikhomphiutha ya leruri, e e sa tseweng (yourcompany.onmicrosoft.com). Batsamaisi ba ka tsena ka admin@yourcompany.onmicrosoft.com le fa yourdomain.com DNS e tserwe ka dikgoka gotlhelele.
   • Thibela SMS yotlhe, go leletsa mogala, le mekgwa e mengwe ya go seta sešwa nomoro ya sephiri ya imeile mo Entra ID / Okta / Lefelotiro la Google (Authentication Methods Policy). Tlhoka Dinotlolo tsa tshireletso tsa serwethata sa FIDO2/WebAuthn kgotsa dikitsiso tsa go kgarametsa tsa Motlhomamisi tse di tshwanang le dinomoro.
2. Boruni jwa Dipegelo tsa Imeile tse di Tswang le tse di Tsenang tsa Fesetere e e Tlhomameng ya go Ineela:
   • Fa e le gore MX direkoto di fetotswe ka 02:14 UTC, ga go na diimeile tsa kwa ntle tse di kafa molaong tse di fitlheletseng disefara tsa gago tsa mmatota tsa poso fa e sale ka 02:14 UTC; imeile nngwe le nngwe ya kwa ntle e e rometsweng kwa badiring ba gago ka nako ya fensetere eo e ne ya tsewa ka mokwalo o o feletseng ke sefara ya poso ya boferefere ya motlhasedi (moreetsi wa Postfix/Exim).
   • Ka bonako fela goga lenaane la polatefomo nngwe le nngwe ya SaaS ya motho wa boraro, banka, akhaonto ya modi ya AWS/GCP, mokgatlho wa GitHub, le portal ya morekisi e e bofilweng mo @yourdomain.com diaterese tsa imeile, mme o hlahlobe hore na mohlaseli o tsositse di-reset tsa phasewete dipolatefomong tseo tsa kantle nakong ya fensetere ya ho utswa.

Kgato 2: Diragatsa Porothokholo ya Pusetso ya Maemo a Tshoganyetso ya Mokwadisi le Kwadiso¶

O se ka wa bula puisano ya tshegetso ya "Webosaete ya me ga e dire". O tshwanetse go dirisa mareo a a tlhomameng a taolo le a semolao a a tlhotlheletsang go tlhatlogela kwa Mokwadisi wa Tshireletso ya Tier-3 / Mogakolodikakaretso / Setlhopha sa Kobamelo sa ICANN:

1. Kgetse A: Domain e sa ntse e le kwa Mokwadisi wa Gago wa Ntlha (Go Tsewa ga Akhaonto kgotsa "Go Kgoromeletsa Akhaonto" ya ka fa Gare):
   • Batlhasedi ba le bantsi ga ba emele malatsi a le 5 go bona phetiso ya EPP ya gare ga bakwadisi; go na le moo, ba dirisa tshupo ya mokwadisi ya ka bonako ya "Push Domain to Another Account" go sutisetsa domeine ya gago mo akhaontong ya burner kwa mokwadisi yo o tshwanang mo metsotswaneng e le 3.
   • Leletsa le go romela imeile kwa Lefapha la Tsietso / Go Utswa Akhaonto / Tirisobotlhaswa la mokwadisi ka bonako. Bolela ka tlhamalalo: "TIRAGALO E E POTLAKILENG YA TSHIRELETSO: Phitlhelelo ya Akhaonto e e sa Letlelelwang le Push ya Domain ya ka Fa Gare / Phetolo ya DNS ya [yourdomain.com]. Go kopa go gatsediwa ga domeine ka bonako ka fa tlase ga serverHold/clientUpdateProhibited le go busetsa morago diphetogo tsa DNS/Akhaonto tse di sa letlelelweng."
   • Kgobokanya Pakete ya Bosupi jwa Gago jwa Bong jwa Hisitori ka Gonefela: Ditlhopha tsa tshireletso tsa mokwadisi di tlhoka bosupi jo bo ka se ganediweng jwa gore ke wena mokwadisi wa pele yo o kafa molaong pele ga ba ka goga kgolagano ya dikhomphiutha morago go tswa mo akhaontong e nngwe. Kgobokanya ditokomane tseno tse 5 go nna PDF e le nngwe ka bonako:
     1. Ditshupamolato tsa Hisitori tsa Mokwadisi le Bosupi jwa Tuelo: Dirasiti tsa PDF le ditatamente tsa karata ya sekoloto / terata ya banka tse di bontshang gore mokgatlho wa gago o duelela go ikwadisa le go ntšhwafatsa yourdomain.com mo dingwageng di le 1 go ya go di le 10 tse di fetileng (go akaretsa dinomoro di le 4 tsa bofelo tsa karata ya tuelo kgotsa tshupiso ya mogala).
     2. Kwadiso ya Kgwebo e e Ntshitsweng ke Puso le ID ya Motlhankedi: Setifikeiti sa Semmuso sa go Tsenngwa / Diathikele tsa Kgwebo tse di tsamaelanang le WHOIS ya hisitori Registrant Organization, mmogo le ID ya puso e e nang le senepe sa motlhankedi wa khamphani yo o saenneng afidafiti.
     3. Faele ya Kgaolo ya DNS ya Hisitori le Bosupi jwa Bong jwa Sefara: Dikhopi tsa faele ya gago ya kgaolo ya DNS ya pele, dinepe tsa hisitori tsa WHOIS, kgotsa bosupi jwa gore setheo sa gago ke sa tsamaiso e e ikemetseng (ASN) kgotsa diboloko tsa IP (A direkoto) tse domain e neng e di supa dingwaga di le dintsi pele ga phetogo ya gompieno.
     4. Imeile ya go Tlhama Akhaonto ya Ntlha / Hisitori ya Thekete: Ditlhogo tsa diimeile tse di amogetsweng go tswa go mokwadisi ka nako ya fa kgolagano ya dikhomphiutha e ne e kwadisitswe kgotsa e ntšhwafadiwa kwa tshimologong.
     5. Nomoro ya Pegelo ya Semmuso ya Tiragatso ya Molao: FBI IC3 (ic3.gov) nomoro ya ngongorego (United States), Tsietso ya Tiro nomoro ya tshupiso (United Kingdom), kgotsa nomoro ya pegelo ya bosetšhaba ya bosenyi jwa inthanete ya mapodisi. Bakwadisi ba dira ka bonako jo bo gakgamatsang fa ba newa nomoro ya kgetsi e e tlhomameng ya ba tiragatso ya molao e e tlhomamisang gore go tseneletse khomphiutha ka bokebekwa kafa tlase ga 18 U.S.C. § 1030 (CFAA) kgotsa Molao wa Tiriso e e sa Siamang ya Khomphiutha wa UK wa 1990.
2. Kgetse B: Domain e Fetiseditswe kwa Mokwadisi yo o Farologaneng (Go Utswa ga Bakwadisi):
   • Ka fa tlase ga Pholisi ya Phetiso ya ICANN (e e kileng ya bo e le IRTP), phetiso ya bakwadisi ba ba farologaneng e tlhoka Auth-Info (EPP) khoutu mme e tshwanetse go thibelwa malatsi a le 60 morago ga diphetogo tse di rileng tsa mokwadisi ntle le fa e tlogetswe. Fa motlhasedi a thubile akhaonto ya gago kwa Mokwadisi A ("Mokwadisi yo o Latlhegelwang") mme a fetisetsa domeine kwa go Mokwadisi B ("Mokwadisi yo o Bonang"):
   • Ikgolaganye le Mokwadisi yo o Latlhegetsweng le Mokwadisi yo o Bonang ka bonako, mme o beye kwa pele Setlhopha sa Kganetsano ya Phetiso ya Mokwadisi yo o Latlhegetsweng / Tshireletso. Ka fa tlase ga Pholisi ya Tharabololo ya Dikgotlhang tsa Phetiso (TDRP) ya ICANN, Mokwadisi yo o Latlhegetsweng ke setheo se se nang le direkoto tsa gago tsa hisitori tsa go duela le dipego tsa go tsena tse di supang gore phetiso e ne e sa letlelelwa. Mokwadisi yo o Latlhegetsweng a ka ikgolaganya semmuso le motlhankedi wa kobamelo wa Mokwadisi yo o Bonang go diragatsa tirisanommogo Phiroloso ya Phetiso ya Mokwadisi, kgotsa go faela tsweletso ya semmuso ya TDRP.
   • Ka nako e le nngwe romela pakete ya gago ya bosupi jwa mong le pegelo ya mapodisi kwa Lefelong la Tirisodikgoka ya Mokwadisi yo o Bonang o batla gore ba tsenye pegelo ya ka bonako clientTransferProhibited le clientUpdateProhibited notlela mo domain gore motlhasedi a se ka a kgona go tlola mo domain ka ketane ya bakwadisi ba bangwe ba le bararo ba kwa ntle ga naga ("go tlola mokwadisi").
3. Faela Koketsego ya Maemo a Tshoganyetso le ICANN (ya di-gTLD tse di tshwanang le .com, .net, .org, .io fa e le gTLD) kgotsa Kwadiso ya ccTLD:
   • Fa mokwadisi a gana go batlisisa phetiso e e sa letlelelweng kgotsa a palelwa ke go tsiboga ka nako ya go tseelwa ka dikgoka go go matlhagatlhaga, romela ka bonako Nngongorego ya Phetiso e e sa Letlelelwang / Go Tseelwa ga Domeine ka dikgoka ka ICANN Contractual Compliance Portal (icann.org/compliance/complaint).
   • Fa kgolagano ya dikhomphiutha ya gago e dirisa Khoutu ya Naga ya Kgolagano ya Dikhoutu ya Maemo a a kwa Godimo (ccTLD), jaaka .uk, .ca, .au, .de, .fr, .nl, .ch, kgotsa .jp, o na le kgetho e e bonako le go feta: dikwadiso tsa ccTLD di laolwa ke balaodi ba bosetšhaba ba tlhokomelo go na le ICANN mme mo e ka nnang ka metlha di tlhokomela Ditlhopha tsa Tshireletso ya Tshoganyetso ya Kwadiso ka tlhamalalo (ka sekai, Nominet kwa UK ka 0330 236 9470, CIRA kwa Canada, DENIC kwa Jeremane, AFNIC kwa Fora) e e ka gatsetsang domeine e e tserweng ka dikgoka ka tlhamalalo kwa maemong a bosetšhaba a kwadiso mo diureng di se kae fa e netefatsa boitshupo jwa khamphani.

Kgato 3: Go namola kgolagano ya dikhomphiutha e e feletsweng ke nako (clientHold, RedemptionPeriod, le PendingDelete)¶

Ga se go kgaoga ga motlakase ka tshoganyetso gongwe le gongwe mo lefatsheng lotlhe e leng tlhaselo ya inthanete. Letsatsi le letsatsi, dikhamphani tse dikgolo, dikhamphani tse di simololang tsa SaaS, le borakonteraka ba puso ba nna lefifi gotlhelele ka gonne karata ya sekoloto e e mo faeleng kwa mokwadisi wa bone wa domain e ne ya felelwa ke nako, mme diimeile tsa kgopotso ya go ntšhafatsa di ne tsa romelwa kwa go . former-founder@company.com yo o tlogetseng feme eno dingwaga di le tharo tse di fetileng.

Go tlhaloganya Molanako wa Sediko sa Botshelo sa Domain e e Fedileng ke Nako ya ICANN¶

Mo Dikgaolo tsa Maemo a a kwa Godimo tsa kakaretso (.com, .net, .org, .biz, .info), Pholisi ya ICANN ya go Busetsa Kwadiso e e Fedileng Nako (ERRP) e gapeletsa modikologo wa botshelo o o gagametseng wa dikgato tse dintsi morago ga gore letlha la go felelwa ke nako le fete:

1. Kgato 1: Paka ya Mohau ya go Ntšhwafatsa ka Boitiriso (Malatsi 1 go ya go ~30/45 morago ga go Felelwa ke Nako):
   • Ka bonako fela morago ga go felelwa ke nako (gantsi mo lobakeng lwa diura di le 24 go ya go di le 72), mokwadisi o fetola kgolagano ya dikhomphiutha NS direkoto mo Tsebeng ya Splash ya Ntšhwafatso e e Phakilweng / e e Fedileng Nako kgotsa e baya kgolagano ya dikhomphiutha mo clientHold.
   • Impact: Your website and corporate email stop working immediately (DNS_PROBE_FINISHED_NXDOMAIN or parking ads).
   • Go boela gape: Tsena mo akhaontong ya mokwadisi mme o duele tuelo e e tlwaelegileng ya go ntšhwafatsa ya ngwaga o le 1 ($10 go ya go $30 USD). Mokwadisi o busetsa lekwalo la gago la ntlha ka bonako NS records.
2. Stage 2: Redemption Grace Period (redemptionPeriod, 30 Days Duration):
   • Fa go se ope yo o ntšhwafatsang kgolagano ya dikhomphiutha ka nako ya Kgato 1 (gantsi morago ga letsatsi la 30 go ya go la 42 go ikaegile ka Melawana ya Tirelo ya mokwadisi), mokwadisi o phimola kgolagano ya dikhomphiutha kwa Kwadisong, mme Kwadiso e e tsenya mo malatsing a a gapelediwang a 30 redemptionPeriod (ntle le fa mokwadisi a fantisitse domeine e e feletsweng ke nako ka polatefomo ya fantisi ya domeine e e feletsweng ke nako ya ka fa gare jaaka GoDaddy Auctions kgotsa NameJet, tlhola nako e e tlhomameng ya fantisi ya mokwadisi wa gago ya letsatsi-30 ka bonako).
   • Go boela gape: O sa ntse o ka pholosa kgolagano ya dikhomphiutha ka tlhomamiso ya diperesente di le 100 ka nako ya redemptionPeriod, only through the original Losing Registrar. You must contact their billing/support desk and pay the Registry Redemption Restore Fee (typically $80 to $250 USD) plus a 1-year renewal.
3. Stage 3: Pending Delete (pendingDelete, Final 5 Calendar Days):
   • Once the 30-day redemptionPeriod expires, the domain enters pendingDelete for exactly 5 days (120 hours).
   • Impact: During pendingDelete, the Registry rejects all standard EPP restore commands from the registrar. At the end of day 5 (for .com/.net Verisign drops, between 18:00 and 19:15 UTC), the domain is released to the public and snatched within 10 milliseconds by automated drop-catching networks.
   • Emergency Action if Caught in pendingDelete or Registrar Expired Auction:
     • If the domain was sold via the registrar's day-30 expired auction before entering Registry redemptionPeriod, check if your registrar offers a short post-auction redemption window or contact the winning bidder/broker immediately.
     • If the domain is truly in the 5-day Registry pendingDelete phase, simultaneously place high-tier backorders across all three major drop-catching networks (DropCatch.com, SnapNames.com, le NameJet.com) so that if the domain drops to the public pool on Day 5, your backorder captures it or enters you into the closed bidder auction to buy your domain back.

Why Does My Website Still Fail for Hours After I Renewed an Expired Domain? (Fixing Negative DNS Caching)¶

When your domain expires, the registrar replaces your NS records with temporary parking nameservers that often carry a 24-hour to 48-hour TTL (Time-To-Live) (86400 kgotsa 172800 seconds). Even after you pay the renewal bill and your registrar restores your real NS records in the root zone within 5 minutes, public recursive DNS resolvers around the world (Google 8.8.8.8, Cloudflare 1.1.1.1, Quad9 9.9.9.9, and ISP resolvers) may keep serving the cached expired parking page until that 48-hour TTL expires.

How to Force an Instant Global DNS Cache Flush in 60 Seconds: Do not wait 48 hours for recursive caches to expire naturally. Manually flush your domain from the three largest global public DNS providers right now using their free web cache-purge portals: 1. Flush Google Public DNS (8.8.8.8 / 8.8.4.4): Visit developers.google.com/speed/public-dns/cache, type yourdomain.com, select record type NS (and then repeat for A, AAAA, MX, and DS), and click Flush Cache. This clears your domain across every Google DNS data center worldwide in less than 10 seconds. 2. Flush Cloudflare Public DNS (1.1.1.1 / 1.0.0.1): Visit one.one.one.one/purge-cache/, enter yourdomain.com, select NS, A, AAAA, and MX, and click Purge Cache. 3. Flush OpenDNS / Cisco Umbrella (208.67.222.222): Visit cachecheck.opendns.com, enter yourdomain.com, check the results across global nodes, and click Refresh the Cache at the bottom of the table.

Phase 4: Fixing broken DNSSEC (SERVFAIL) after a migration or hijack¶

Domain Name System Security Extensions (DNSSEC) cryptographically signs your DNS records (RRSIG records signed by a Zone Signing Key ZSK and Key Signing Key KSK) and publishes a matching Delegation Signer (DS) hash in the parent TLD zone at your registrar.

While DNSSEC prevents cache poisoning, a broken DNSSEC configuration causes an instant, total global outage (SERVFAIL) on every validating resolver (including 8.8.8.8, 1.1.1.1, Comcast, and major mobile carriers). This most commonly happens during an emergency migration: an administrator moves yourdomain.com's nameservers from Cloudflare to AWS Route 53 (or vice versa) without first deleting the old provider's DS record at the domain registrar.

Diagnosing and Repairing a DNSSEC SERVFAIL Lockout in 5 Minutes¶

1. Confirm DNSSEC Is the Culprit: Run two dig commands back-to-back: one normal query, and one query with the +cd (Checking Disabled) flag, which tells the recursive resolver to ignore DNSSEC cryptographic validation:

   dig yourdomain.com @8.8.8.8
   dig yourdomain.com @8.8.8.8 +cd
   

   • If the first command fails with status: SERVFAIL and zero answers, while the second command (+cd) immediately succeeds with status: NOERROR and returns your A record IP address, 100 percent of your outage is a broken DNSSEC chain of trust.
2. Inspect the Exact Breakage with DNSViz.net kgotsa Verisign DNSSEC Debugger:
   • Open dnsviz.net or dnssec-debugger.verisignlabs.com and enter yourdomain.com.
   • It will draw a visual diagram showing whether the DS record published at your registrar fails to match the DNSKEY served by your current DNS host, or whether your zone signatures (RRSIG) have expired.
3. Emergency Remediation:
   • If you just changed DNS providers: Log into your Domain Registrar, navigate to the DNSSEC / DS Records section, and delete the old stale DS record (or replace it with the new DS record generated by your new DNS host).
   • Flush the DS record cache: Immediately visit Google Public DNS Cache Flush (developers.google.com/speed/public-dns/cache) and Cloudflare Purge Cache (one.one.one.one/purge-cache/) and purge the DS and DNSKEY record types for yourdomain.com so validating resolvers stop checking the deleted DS hash immediately.

Phase 5: Post-recovery clean-up, TLS certificate revocation, and hardening¶

Getting your domain registrar account and DNS records back under your control is only half the battle. During the hours or days that the attacker controlled your domain's DNS, they had complete authority to prove "Domain Control Validation" (DCV) to every Certificate Authority (CA) on the planet.

1. Audit Certificate Transparency Logs (crt.sh) and Revoke Rogue TLS Certificates¶

When an attacker points your A kgotsa NS records to their server, they immediately run certbot (Let's Encrypt, ZeroSSL, Google Trust Services, or Sectigo) to generate valid, browser-trusted TLS certificates for yourdomain.com, *.yourdomain.com, vpn.yourdomain.com, le mail.yourdomain.com. Even after you restore your DNS records, the attacker still holds the valid Private Key (.key) and signed Public Certificate (.crt) for your domain, which they can use to stage captive-portal Wi-Fi attacks, BGP hijacks, or internal network spoofing for the next 90 days.

1. Query Certificate Transparency Logs:
   • Go to crt.sh/?q=%25.yourdomain.com or Censys Certificate Search (search.censys.io/certificates).
   • Sort by Logged At / Not Before date and inspect every single certificate issued during the hijack window (and in the 24 hours after recovery, due to cached DCV authorizations).
2. Force Immediate Certificate Revocation:
   • Identify the issuing Certificate Authority (Issuer Name) on every unauthorized certificate.
   • Every publicly trusted CA is required under the CA/Browser Forum Baseline Requirements (Section 4.9.1.1) to revoke a fraudulent or unauthorized certificate within 24 hours of confirming that the applicant was not authorized by the true domain owner.
   • If you already regained DNS control over the domain, you can revoke unauthorized Let's Encrypt or ACME certificates yourself in 60 seconds without even needing the attacker's private key: simply install certbot on a server you control, pass a fresh DNS-01 or HTTP-01 challenge for the exact same domain name using a brand-new ACME account key, and run:

     certbot revoke --cert-path downloaded_rogue_cert_from_crt_sh.pem --reason keycompromise
     

   • Alternatively, submit the Certificate Serial Numbers directly to the CA's emergency revocation portal (for example, Let's Encrypt's revocation instruction page, DigiCert's /revoke portal, or Sectigo's SSL Abuse reporting form).

2. Lock Down Your Domain Permanently So It Can Never Be Hijacked Again¶

Once operations are restored, implement these five enterprise domain-hardening controls:

1. Enable Registry Lock (serverUpdateProhibited, serverDeleteProhibited, serverTransferProhibited):
   • For mission-critical production domains, upgrade to a registrar that offers true Registry Lock (supported by Verisign on .com/.net, PIR mo .org, mme e fiwa ka bakwadisi ba dikgwebo jaaka MarkMonitor, Ditirelo tsa Letshwaokgwebo la Dijithale la CSC, Kgwebo ya Cloudflare, Dikarolo tsa Lock ya Kwadiso ya Porkbun / Gandi / Namecheap). Ka Registry Lock e dira, le fa motlhasedi a ka utswa login ya gago ya mokwadisi le MFA, Registry ya TLD e gana tsotlhe . NS kgotsa phetiso ya diphetogo ntle le fa motlhankedi wa tshireletso ya batho a wetsa moletlo wa cryptographic/mogala o o kwa ntle ga setlhopha.
2. Phasalatsa CAA (Tetla ya Bothati jwa Setifikeiti) Direkoto tsa DNS:
   • Tsenya CAA gatisa (RFC 8659) go ya kwa kgaolong ya gago ya DNS e e tlhalosang gore ke Bathati ba Ditifikeiti ba ba letleletsweng go ntsha disetifikeiti tsa TLS tsa kgolagano ya dikhomphiutha tsa gago (ka sekai, 0 issue "letsencrypt.org" kgotsa 0 issue "digicert.com", le 0 iodef "mailto:security@yourdomain.com"). Fa motlhasedi yo o laolang kgaolo yotlhe ya gago ya DNS a ka phimola CAA rekoto, a CAA rekoto e thibela batho ba ba tsewang ka dikgoka ba BGP kgotsa dintlha tsa CNAME tsa subdomain tse di tsenngwang mo kotsing go dirisa di-CA tse di sa letlelelweng.
3. Kgaoganya Mokwadisi wa Kgaolo ya Gago le Motlamedi wa Gago wa Letsatsi le Letsatsi wa DNS:
   • Boloka ikwadiso ya gago ya kgolagano ya dikhomphiutha e notletswe mo teng ga akhaonto ya mokwadisi wa tshireletso e e kwa godimo e e leng fela batlhankedi ba le 2 ba khamphani ba ba ka e fitlhelelang ba dirisa Dinotlolo tsa tshireletso tsa serweboleta sa FIDO2 (YubiKey), mme o neele taolo ya rekoto ya DNS ya letsatsi le letsatsi (A, CNAME, TXT) go ya go tirelo e e farologaneng ya DNS e e laolwang e e nang le Taolo ya Phitlhelelo e e Theilweng mo Seabeng (RBAC) le dithokene tsa API tse di nang le bogolo.
4. Tlhatlhoba le go Fedisa Karolopotlana e e Lepeletseng CNAME le NS Direkoto:
   • Dira sekene sa kgwedi le kgwedi sa faele yotlhe ya gago ya kgaolo ya DNS (subzy, nuclei -t takeovers/, kgotsa OWASP Amass) go supa CNAME, ALIAS, kgotsa karolopotlana NS rekoto e e supang motswedi wa kwa ntle wa maru o o sa kwadisiwang kgotsa domeine e e feletsweng ke nako, mme o phimole rekoto ya DNS pele o tlosa tiriso ya sefara ya maru.
5. Seta Tlhokomelo ya RDAP ya Kwa Ntle e e Itirisang, DNS, le CT Log:
   • Rulaganya monithara wa kwa ntle (jaaka CertSpotter, Cloudflare Tlhokomelo ya go Bonala ga Setifikeiti, kgotsa go tlhola sekwalwa sa cron sa ura le ura dig NS le whois) e e tsibosang kanale e e kgethegileng ya Slack/PagerDuty le aterese ya SMS/imeile e e seng mo kgolaganong ya dikhomphiutha ka motsotso o o tlhomameng o setifikeiti se sesha sa TLS se tsenngwang mo go Ponatshegelo ya Setifikeiti kgotsa mo NS/MX/DS diphetogo tsa rekoto.

Dipotso tse di bodiwang kgapetsakgapetsa¶

Metswedi e tlhotlhomisitswe¶

• Setheo sa Tshireletso ya Inthanete le Tshireletso ya Mafaratlhatlha (CISA, United States): Taelo ya Maemo a Tshoganyetso 19-01: Fokotsa go Tsenngwa ga Mafaratlhatlha a DNS (Ditaelo tsa CISA ka ga Lock ya Kwadiso, MFA ya DNS/Bakwadisi, boruni jwa pego ya Setifikeiti sa go Bonala, le netefatso ya DNSSEC ()cisa.gov/news-events/directives/emergency-directive-19-01).
• Koporasi ya Inthanete ya Maina le Dinomoro tse di Abilweng (ICANN, Boditšhabatšhaba): Pholisi ya Phetiso (Pholisi ya Phetiso ya Bakwadisi ba ba Fa gare / IRTP), Pholisi ya Tharabololo ya Dikgotlhang tsa Phetiso (TDRP), Pholisi ya go Busetsa Kwadiso e e Fedileng Nako (ERRP), le *Boemo jwa CoRefericann.org/resources/pages/epp-status-codes-2014-06-16-en).
• Setheo sa Bosetšhaba sa Maemo le Thekenoloji (NIST, United States): Kgatiso e e Kgethegileng 800-81-2, Kaelo ya go Dirisa Tsamaiso ya Leina la Kgaolo e e Sireletsegileng (DNS) (csrc.nist.gov).
• Setheo sa Bosetšhaba sa Tshireletsego ya Inthanete (NCSC, United Kingdom): Go Sireletsa Tshedimosetso ya Botho ka Bontsi le Tshireletsego ya Domeine: Selotlolo sa Kwadiso, Direkoto tsa CAA, le Thibelo ya go Tsewa ga Domeinepotlana (ncsc.gov.uk).
• Foramo ya CA/Browser (ya Boditšhabatšhaba): Ditlhokego tsa Motheo tsa go Rebola le go Laola Ditifikeiti tsa Sefara ya TLS tse di Ikanyegang ke Setšhaba (Karolo 4.9.1.1: Phimolo e e Tlamang ya Diura di le 24 ya go Tsenngwa ga Domain) (cabforum.org).
• Setlhopha sa Tiro sa Boenjenere jwa Inthanete (IETF, Boditšhabatšhaba): RFC 4033/4034/4035 (DNSSEC), RFC 8659 (Thebolo ya Bothati jwa Setifikeiti sa DNS / Rekoto ya Didirisiwa tsa CAA), le RFC 9083 ( Porothokholo ya Phitlhelelo ya Tshedimosetso ya Kwadiso / RDAP ) (datatracker.ietf.org).

Dikaedi tse di tsamaelanang¶

• Mathata a go amogela webosaete, go fuduga, le go busetsa bekapo
• Phishing le diakhaonto tse di tsenngwang mo kotsing
• Go tsietsa ga MFA le go tlola mmaba yo o fa gare
• Data breach response and password leaks
• Ransomware ya kgwebo le go thubega ga sefara
• Go ananya SIM