I-Domain Registrar okanye iDNS Provider Outage: Ixesha eliphelelwe lixesha loKuhlengwa kweNdawo, DNSSEC SERVFAIL Umgibe, kunye neNgxaki yokuFuduka kwe-Nameserver¶

Ukuvuka ukufumanisa ukuba iwebhusayithi yenkampani yakho ephambili, i-API endpoints (api.example.com), kunye ne-imeyile yoshishino (MX Iirekhodi zeGoogle Workspace okanye iMicrosoft 365) azifumaneki ngokupheleleyo kwihlabathi jikelele (DNS_PROBE_FINISHED_NXDOMAIN okanye SERVFAIL) yingxaki yeziseko zophuhliso ezingasebenziyo kwaphela. Ngokungafaniyo nomncedisi wewebhu omnye ongqubekileyo ochaphazela inkonzo enye, iNkqubo yeGama leNdawo (DNS) okanye ukungaphumeleli kobhaliso kwisizinda seseva nganye kwinkonzo enye phantsi kwendawo yengcambu yakho ngaxeshanye, ukuquka uSayino-Olunye (SSO), ii-portals zenkxaso yabathengi, kunye nee-imeyile zempendulo zezehlo ezingenayo. Ngokwesiqhelo, ukucima kwesizinda sehlabathi kuphuma kwizinto ezibangela ezintathu ezahlukeneyo: (1) i ukuphelelwa kwesizinda ngengozi apho ikhadi letyala elikwifayile liphelelwe lixesha kwaye nombhalisi aqweqwedise NS iirekhodi zokukhomba kwiphepha lokupaka lokuhlawula-ngokuchofoza 24 to 48 hours ngaphambi kokuphela komhla wokuphelelwa; (2) a **ukuhlaselwa kweDDoS okanye ukucinywa kwenqwelomoya ** kumnikezeli wakho ogunyazisiweyo weDNS (Route 53, Cloudflare, GoDaddy, Namecheap, DNSimple, NS1); okanye (3) a **yaphukile DNSSEC (DS irekhodi) ikhonkco lokuthemba ** ngexesha lokutshintsha kwe-nameserver ekhawulezileyo ebangela ukuqinisekiswa kwezisombululi (8.8.8.8, 1.1.1.1, izisombululi ze-ISP) ukulahla i-100 yepesenti yetrafikhi yakho nge SERVFAIL. Ukuba umhlaseli uye wabeka esichengeni iziqinisekiso zokungena zombhalisi kwaye wagqithisela okanye watshintsha indawo yakho ngobubi, tshintshela ukuqweqwedisa igama lesizinda, iDNS ephelelwe lixesha, kunye nokuthathwa kwewebhusayithi; ukuba isatifikethi sakho se-TLS siphelelwe lixesha okanye saphuka emva kokuba i-DNS ibuyiselwe, bona Isatifikethi se-SSL/TLS siphelelwe lixesha kwimveliso, ukuvalelwa kwangaphambili kwe-HSTS, kunye nohlaziyo olungxamisekileyo kwaye I-Google Workspace okanye iMicrosoft 365 yesiko lolawulo lwedomeyini yokutshixa kunye noqinisekiso lweDNS. Ukuba oku kucinywa kukhubaza unxibelelwano lwezonyango esibhedlele, i-911/112 indlela yokuthumela ngokukhawuleza, okanye izinto eziluncedo zikawonke-wonke, fowunela inombolo yakho kaxakeka yendawo (911 eUnited States naseKhanada, 112 kwiManyano yaseYurophu, 999 eUnited Kingdom) okanye ujonge incwadi yethu ye amanani kaxakeka.

Yenza oku ngoku¶

1. Chonga kwimizuzwana eyi-10 ukuba ukusilela kuPheleleyo/Emisiweyo Domain (EPP Status), uMboneleli weDNS ogunyazisiweyo, okanye a DNSSEC Ukuqinisekisa ukusilela:
2. Baleka whois yourdomain.com | grep -iE "Status|Expiry|Name Server" kwaye dig +trace yourdomain.com.
3. Vavanya ukuba uyagqitha DNSSEC ukuqinisekiswa (+cd = Ukujonga kukhubazekile) kwenza indawo yakho isombulule kwakhona:

   dig @8.8.8.8 yourdomain.com A
   dig @8.8.8.8 yourdomain.com A +cd
   

   Ukuba umyalelo wokuqala ubuyisela status: SERVFAIL ngelixa umyalelo wesibini (+cd) ibuya kwangoko status: NOERROR ngedilesi ye-IP yomncedisi wakho, iiseva zakho ze-DNS AKUKHO phantsi: yakho DNSSEC (DS irekhodi kumbhalisi) yaphukile. Tsibela kwangoko kwiSigaba sesi-3 ukuze ucime ixesha elidala DS rekhoda kwirejistra yakho.
4. Ukuba indawo yakho iphelelwe lixesha (Auto-Renew Grace Period okanye Redemption Grace Period), ngena kwirejista yakho yangoku ngokukhawuleza kwaye uhlawule umrhumo wohlaziyo/wokukhulula; SUKUlinda ukuba indawo yolawulo "yilahle" ukuze ukwazi ukuyibhalisa kwakhona ngexabiso eliphantsi:
5. Ngexesha lokuqala ** 1 ukuya kwiintsuku ezingama-45 ** emva kokuphelelwa yisikhathi (Auto-Renew Grace Period), ukuhlaziya kwideshibhodi yakho yombhalisi kubuyisela amagama akho oqobo ngexabiso eliqhelekileyo lokuhlaziya ($10 to $30).
6. Ngexesha ** 30-ientsuku Redemption Grace Period (RGP / redemptionPeriod)**, kufuneka uhlawule umrhumo onyanzelekileyo wokubhalisa ($80 to $250) ngerejista yakho yangoku. Ukuba ulinda i-domain ukugqiba 5-ientsuku Pending Delete isigaba sokugcina $100, i-automated drop-catching sniper bots (DropCatch, SnapNames, NameJet) izakuhlutha isizinda sakho ngaphakathi 5 milliseconds yokuyikhupha kunye nefandesi ngamawaka eedola.
7. UNGAZE utshintshe i-Nameservers yakho (NS) kude nomboneleli weDNS onikwe amandla weDNSSEC (njenge Cloudflare, Route 53, okanye Google Cloud DNS) ngaphandle kokususa DS rekhoda kumbhalisi wakho kuqala: Ukuba DNSSEC yenziwe kwaye utshintshe eyakho NS iirekhodi zokuhlangula umboneleli we-DNS ngexesha lokucima ngaphandle kokucima umzali DS (Delegation Signer) irekhodi kwi .com / .org Indawo ye-TLD kuqala, sonke isicombululi esiqinisekisayo eMhlabeni siyakwala iimpendulo ezingabhaliswanga zomboneleli we-DNS njengohlaselo lwe-cryptographic spoofing (SERVFAIL).
8. Ukuba uvalelwe ngaphandle kweshishini lakho @yourdomain.com imeyile ngenxa yesizinda sakho MX iirekhodi ziphantsi, UNGACIFIKI "Thumela ikhowudi yokusetha kwakhona igama lokugqitha ku admin@yourdomain.com" kumbhalisi wakho: Ngelixa i-domain yakho NS okanye MX iirekhodi ngaphandle kwe-intanethi, nayiphi na i-imeyile yokuqinisekisa ithunyelwe kuyo @yourdomain.com utsiba okanye unyamalale emgceni. Sebenzisa iSMS/isiQinisekiso seMFA ye-MFA, i-imeyile egcinwe ngaphandle kwebhendi (@gmail.com / @proton.me), okanye ukuhamba kokuqinisekiswa kwesazisi sefowuni.
9. Emva kokuhlaziya i-domain ephelelwe lixesha, qinisekisa ngesandla ukuba uMbhalisi wakho ubuyisele iiSeva zamagama zakho zangaphambili (NS) endaweni yokushiya ithambeka livuliwe sedoparking.com / renewyourname.net: Xa isizinda siphelelwa, ababhalisi babhala ngaphezulu isiko lakho NS iirekhodi ezineeseva zokupaka (ns1.parklogic.com, dns1.name-services.com). Ngamanye amaxesha ukuhlawula uhlaziyo lohlaziyo umhla wokuphelelwa kunyaka ozayo ngelixa ushiya nameservers yokupaka esebenzayo de uzitshintshele ngesandla.
10. ** Gubha i-cache ye-DNS yehlabathi jikelele ephindaphindayo (Google 8.8.8.8, Cloudflare 1.1.1.1, OpenDNS) eyesibini yakho NS okanye DS iirekhodi zibuyiselwe**: Endaweni yokulinda iiyure ezingama-24 ukuya kwezingama-48 ukuze zigcinwe NXDOMAIN okanye yokupaka-iphepha NS Iirekhodi zokuphelelwa lixesha ngokwemvelo, zibangela ucociso lwe-cache yehlabathi ngoko nangoko kuGoogle Public DNS (developers.google.com/speed/public-dns/cache) kunye ne-Cloudflare 1.1.1.1 (one.one.one.one/purge-cache/).

Umthi wesigqibo: i-domain yehlabathi okanye i-DNS yenza uvavanyo olungxamisekileyo¶

Sebenzisa le tshati ukuphawula owona maleko woluhlu lweDNS (TLD Registry, Registrar EPP Status, DNSSEC DS Chain, okanye Authoritative Nameserver) apho isisombululo sisilela:

flowchart TD
    Start["IGlobal Outage: IWebhu yeDomain kunye ne-imeyile iyasilela ukuSombulula (NXDOMAIN / SERVFAIL)"] --> RunDiag["Baleka: whois domain.com AND dig @8.8.8.8 domain.com +cd"]

    RunDiag --> CheckCD{"Ngaba dig @8.8.8.8 domain.com Ayiphumelelanga, Ngelixa uFakela +cd Iphumelele?"}

    CheckCD -->|"Ewe: Isebenza nge +cd, Ayiphumelelanga Ngaphandle kwe +cd"| DnssecBreak["Ikhonkco leTrasti yeDNSSEC eyaphukileyo: Cima iRekhodi ye-DS eStale kwiRegistrar OKANYE Tyina kwakhona uMmandla -> Flush 8.8.8.8 & 1.1.1.1"]

    CheckCD -->|"Hayi: Zombini aziphumelelanga okanye zibuyisele i-IP yokuPaka"| CheckWhois{"Jonga ubume beDomain ye-WHOIS EPP kunye noMhla wokuphelelwa"}

    CheckWhois -->|"Ubume:Bamba umxhasi okanye Bamba iseva"| HoldState["Umbhalisi / uBhaliso lokuNxinywa: Gqibezela i-ICANN RAA yokuQinisekisa i-imeyile OKANYE ukuxhatshazwa / itikiti lokuBhala kwangoko"]

    CheckWhois -->|"Umhla wokuphelelwa okugqithisiweyo (Imo: autoRenewPeriod)"| GraceRenew["Usuku loku-1 ukuya kwi-45 emva kokuphela kwexesha: Hlawula uHlaziyo oluMgangatho kwiRegistrar Portal -> Qinisekisa i-NS ebuyiselweyo"]

    CheckWhois -->|"Isimo: iRedemptionPeriod (RGP)"| RgpRestore["Usuku lwe-45 ukuya kwi-75 ye-Post-Expiry: Vula iThikithi yeNkxaso yoMbhalisi oNgxamisekileyo / Hlawula uMrhumo woBuyiselo we-RGP (i-$ 80-$ 250) Ngokukhawuleza"]

    CheckWhois -->|"Isimo: isalindileCima"| PendingDel["Isitshixo seentsuku ezi-5 zokuGqibela: ayinakuHlaziywa kwiRejistra -> Beka ii-backorders kuwo wonke ama-Drop-Catchers amakhulu ngoku."]

    CheckWhois -->|"Isimo: kulungile / clientTransferProhibited AND Expiry in future"| AuthDown["UBhaliso lweDomain lusempilweni -> UGunyaziso lweDNS uMboneleli wokuPhuma okanye uMmandla oLawulayo"]

    AuthDown --> MigrateNS["Ngenisa iFayile yendawo (`BIND` / Terraform) kuMboneleli weDNS weSibini -> Susa iRekhodi ye-DS ukuba iDNSSEC Ivuliwe -> Hlaziya i-NS kuMbhalisi"]

Isigaba 1: I-ICANN Domain Expiration Lifecycle (Auto-Renew vs. Redemption vs. Pending Delete)¶

Xa iDomain yeNqanaba eliPhezulu eliqhelekileyo (gTLD njenge .com, .net, .org, .io, .ai, .co, .app, .dev) iphelelwa lixesha ngenxa yokuba ikhadi letyala lokuhlaziya ngokuzenzekelayo aliphumelelanga okanye ikhadi lezemali likhanselwe emva kokuba umqeshwa ehambile, i-domain idlula kwi-lifecycle engqongqo yezigaba ezininzi ezilawulwa ** I-ICANN's Expired Registration Recovery Policy (ERRP)** kunye nezivumelwano zomsebenzisi wobhaliso (Verisign ngenxa .com/.net, PIR ngenxa .org, Identity Digital).

Indlela i-domain efa ngayo kwaye kutheni ihamba ngaphandle kwe-intanethi NGAPHAMBI okanye ngoSuku lwe-1 lokuphelelwa yisikhathi¶

+-------------------------------------------------------------------------+
| ICANN gTLD EXPIRATION TIMELINE (.com / .net / .org example)             |
|                                                                         |
| [Active Domain]                                                         |
|       |                                                                 |
|       v  (Expiration Date Reached: Day 0)                               |
| +---------------------------------------------------------------------+ |
| | STAGE 1: Auto-Renew Grace Period (Day 1 to Day 30-45)               | |
| | - EPP Status: ok or clientHold (Registrar swaps your NS to parking) | |
| | - Production Impact: 100% OFFLINE within 0 to 48 hours of expiry    | |
| | - Recovery: Log into registrar & pay normal renewal ($10-$30).      | |
| +---------------------------------------------------------------------+ |
|       |  (Registrar sends Delete command to Registry at Day 30-45)      |
|       v                                                                 |
| +---------------------------------------------------------------------+ |
| | STAGE 2: Redemption Grace Period [RGP] (Exactly 30 Calendar Days)   | |
| | - EPP Status: redemptionPeriod (Domain removed from TLD Root Zone)  | |
| | - Recovery: Still 100% guaranteed to original owner, MUST pay       | |
| |   Registry RGP Redemption Fee ($80-$250) + renewal via registrar.   | |
| +---------------------------------------------------------------------+ |
|       |  (30-Day RGP expires without redemption payment)                |
|       v                                                                 |
| +---------------------------------------------------------------------+ |
| | STAGE 3: Pending Delete (Exactly 5 Calendar Days)                   | |
| | - EPP Status: pendingDelete                                         | |
| | - Recovery: IMPOSSIBLE to renew or redeem at any price. Registry    | |
| |   rejects all registrar commands until public drop at Day 5 (~18:00 | |
| |   UTC for Verisign .com/.net).                                      | |
| +---------------------------------------------------------------------+ |
+-------------------------------------------------------------------------+

Thelekisa amalungelo akho kanye, iindleko, kunye nezenzo zokubuyisela kwixesha ngalinye lokuphelelwa, kubandakanywa ikhowudi yelizwe leDomayini yeNqanaba eliphezulu (ccTLDs njengaye .uk, .de, .eu, .ca, .au), engalandeli n i-ICANN gTLD imithetho:

Isigaba sesi-2: Inyathelo-nge-nyathelo lokubuyisela i-expired or RedemptionPeriod ithambeka¶

Landela olu landelelwano luchanekileyo ukubuyisela isizinda esiphelelwe lixesha kwi-intanethi ngelona xesha lifutshane linokwenzeka:

Inyathelo 1: Fumana kwakhona ufikelelo kwiAkhawunti yakho yoBhaliso xa @yourdomain.com I-imeyile ifile¶

Nantsi iCatch-22 yakudala yedomeyini ephelelwe lixesha: - Indawo yakho (company.com) iphelelwe, ngoko MX iirekhodi ze company.com wayeka ukusombulula. - Uzama ukungena kumbhalisi wendawo yakho (GoDaddy, Namecheap, Cloudflare, Porkbun, Hover, Network Solutions, Gandi), kwaye umbhalisi uthi: "Sithumele ikhowudi yokuqinisekisa enamanani ama-6 ku admin@company.com." - Ngokuba company.com iphelelwe lixesha, loo imeyile ayinakuze ifike.

Uphuma njani kwi-loop ye-imeyile ephelelwe lixesha ngokukhawuleza: 1. SUKU gqithisela okanye ulungise nantoni na okwangoku: khangela ukuba unako ukujikelezisa isibambi semeyile sexeshana KUPHELA ukuba isizinda asiphelelwanga (ukuba isizinda ngokwaso siphelelwe lixesha kwinqanaba leTLD, MX ayinasombululo naphina de ihlaziywe). 2. Sebenzisa uMbhalisi "UFikelelo lwe-imeyile elahlekileyo / iDomain iphelelwe lixesha" iChaneli yokuBuyisa iAkhawunti: - Phantse zonke iirejistra ezivunyiweyo ze-ICANN zibonelela ngefowuni ezinikeleyo okanye i-ID karhulumente / i-corporate-incorporation-document yokuqinisekisa ukuhamba komsebenzi ngokukodwa kubathengi abane-imeyile yokungena ehlala @ idomeyini ephelelweyo ngaphakathi kweakhawunti. - Yiba nezinto ezintathu zilungile phambi kokufowunela inkxaso yombhalisi: (a) i i-4 zokugqibela amanani ekhadi letyala okanye i-ID ye-PayPal transaction esetyenziswe kwi-invoyisi yohlaziyo yangaphambili, (b) yakho I-ID yeakhawunti yoBhaliso / iPIN yoMthengi, kunye © ne ifoto yesazisi sikarhulumente + amaNqaku okuBandakanywa / ibhili yenkonzo ehambelana ne-WHOISTech / Admin / Registrant). 3. ** Nje ukuba ungene, tshintsha kwangoko idilesi ye-imeyile yeakhawunti yakho kwi-domain yangaphandle (@gmail.com, @proton.me, okanye indawo engxamisekileyo eyahlukileyo eyakho)** kwaye wenze Isitshixo soKhuseleko lweSixhobo (FIDO2) okanye TOTP Authenticator App MFA ngoko ke ukungena akuze kuxhomekeke @company.com imeyile kwakhona.

Inyathelo 2: Yenza uHlaziyo okanye RedemptionPeriod (RGP) Buyisela¶

1. Ukuba ithambeka likwiNqanaba loku-1 (Auto-Renew Grace Period, Iintsuku 1 ukuya 30/45):
2. Yiya ku-Intlawulo -> Uhlaziyo okanye uLuhlu lweDomain -> Isihluzo esiphelelwe lixesha kwaye uhlawule i-invoyisi yokuhlaziya.
3. Jonga ngokuKhethekileyo imizuzwana engama-60 emva kokuhlawula: Vula isizinda se-Nameservers (NS) useto kwideshibhodi yombhalisi. Jonga ukuba ngaba ubhalisi uzibeke umva ngokuzenzekelayo abancedisi bakho bokwenyani (umzekelo, ns-123.awsdns-15.com okanye ada.ns.cloudflare.com) okanye ushiye ithambeka elambe kwiiseva zayo zokupaka eziphelelwe lixesha (ns1.sedoparking.com / dns1.registrar-servers.com). Ukuba iiseva zokupaka zisadwelisiwe, phinda ufake ngesandla iiseva zakho zemveliso kwaye ugcine.
4. Ukuba i-domain ikwiNqanaba 2 (Redemption Grace Period / redemptionPeriod, Iintsuku 30/45 ukuya 75):
5. Jonga ithebhu eyahlukileyo ngaphakathi kwideshibhodi yakho yombhalisi ehlala ibhalwe **Iindawo Eziphelelwe lixesha -> Intlawulelo **, Inkunkuma / Buyisela, okanye Intlawulo yobabalo/yokukhulula.
6. Hlawula umrhumo woBuyiselo we-RGP + unyaka omnye wohlaziyo.
7. Ukubuyiselwa kwe-RGP kusebenza njani kwiRejistri (Verisign / PIR)? Xa uhlawula umrhumo we RGP, umbhalisi wakho uthumela i EPP <update><restore op="request"> umyalelo kwi-TLD yoBhaliso. IRejistri itshintsha kwangoko imo yesizinda ukusuka redemptionPeriod ukuya pendingRestore ** kwaye ibeka indawo yakho NS urekhoda ubuyele kwi-TLD Root Zone ngaphakathi kwe-15 ukuya kwimizuzu engama-60** ngelixa umbhalisi wakho engenisa restore op="report" isiqinisekiso sokuthobela.

Inyathelo lesi-3: Yigqitha ulibaziseko lwe-ISP yendawo ngokucocwa 8.8.8.8 kwaye 1.1.1.1¶

Xa ithambeka lakho liphelelwe lixesha, izisombululi ze-DNS eziphinda-phindayo kwihlabathi jikelele zigcine indawo yokupaka iiseva okanye ezingalunganga. NXDOMAIN impendulo (ilawulwa ziiTLD's SOA Minimum TTL, ngokuqhelekileyo 900 ukuya 3,600 imizuzwana, okanye 86,400 imizuzwana ye NS iirekhodi). Umzuzu dig @a.gtld-servers.net yourdomain.com NS (ebuza i .com umncedisi weengcambu ngokuthe ngqo) ubonisa iiseva zakho zemveliso yokwenyani kwakhona: 1. Vula Google Public DNS Flush Cache (https://developers.google.com/speed/public-dns/cache): - Uhlobo lokugungxula NS kuqala kuba yourdomain.com, emva koko gungxula SOA, A, AAAA, MX, kwaye TXT. 2. Vula Cloudflare 1.1.1.1 Hlanza iCache (https://one.one.one.one/purge-cache/): - Hlanza NS, A, AAAA, kwaye MX ye yourdomain.com.

Inqanaba lesi-3: Umncedisi wegama likaxakeka (NS) Ukufuduka Ngexesha lokuPhuma koMboneleli we-DNS (kunye ne DNSSEC Umgibe)¶

Kuthekani ukuba ubhaliso lwakho lwesizinda luyi-100 yeepesenti esebenzayo kwaye ayiphelelwa yisikhathi, kodwa yakho ** uMboneleli weDNS ogunyazisiweyo ** (Route 53, Cloudflare, GoDaddy DNS, DigitalOcean DNS, Azure DNS, DNSimple, Dyn) ijongene nokucima okuyingozi okanye uhlaselo lweDDoS, kwaye kufuneka ufuduse i-Nameservers yendawo yakho (NS) kumnikezeli we-DNS yogcino ngoku?

Umbulali wokufuduka we-#1: Ukutshintsha NS Ngelixa DNSSEC (DS Record) Ivuliwe¶

Ngaphambi kokutshintsha enye NS Rekhoda kumbhalisi wakho, sebenzisa lo myalelo ukujonga ukuba DNSSEC yenziwe kwindawo yakho kumzali wobhaliso weTLD:

dig +short yourdomain.com DS @8.8.8.8

+-------------------------------------------------------------------------+
| WHY CHANGING NS RECORDS WITH AN ACTIVE DS RECORD BREAKS THE INTERNET    |
|                                                                         |
| 1. Parent TLD (.com) holds your old DNS provider's DS Record (Key #2371)|
| 2. Old DNS Provider goes down. You import zone to New DNS Provider      |
|    (unsigned, or signed with a brand-new Key #9910) and swap NS.        |
| 3. Validating Resolver (8.8.8.8 / 1.1.1.1 / Comcast / ISP) queries      |
|    New DNS Provider, sees signature does NOT match DS Key #2371.        |
| 4. Resolver assumes an active MITM Spoofing Attack -> Returns SERVFAIL  |
| 5. RESULT: Your domain stays 100% dead worldwide even though the new    |
|    DNS servers are up and answering cleanly.                            |
+-------------------------------------------------------------------------+

Uluhlu lokuFudukela lweNqanaba likaXakeka oluKhuselekileyo (Zero SERVFAIL Inkqubo)¶

1. Yakha kwakhona okanye ungenise iFayile yakho yeNdawo yeDNS epheleleyo kumnikezeli omtsha weDNS kuqala:
2. Ungaze uqikelele iirekhodi zakho zeDNS kwimemori (@, www, kwaye api kunqabile ukuba ibe ziirekhodi kuphela; ukulibala MX, SPF/TXT, DKIM, _dmarc, autodiscover, okanye CAA ukwaphula ukuhanjiswa kwe-imeyile kunye nokuhlaziywa kwe-TLS).
3. Ungayifumana phi indawo yakho epheleleyo yeDNS xa ideshibhodi yomboneleli wakho weDNS iphantsi:
   • Jonga i-Infrastructure-as-Code (Terraform, Pulumi, OctoDNS, DNSControl) kwindawo yakho yokugcina iGit.
   • Jonga ukuthunyelwa ngaphandle kwendawo yamva nje (BIND .zone iifayile) okanye khangela imbali yedatha yeDNS (SecurityTrails, ViewDNS.info, DNSDumpster, okanye Censys / crt.sh yesubdomains).
   • Iirekhodi ezigciniweyo zombuzo zihleli ngaphakathi kwizisombululi zoluntu eziphinda-phindayo (dig @8.8.8.8 yourdomain.com MX, dig @1.1.1.1 yourdomain.com TXT, dig @9.9.9.9 api.yourdomain.com A) ngaphambi kokuba ii-TTL zabo ziphelelwe lixesha.
4. Qinisekisa ukuba umboneleli omtsha we-DNS uphendula ngokugunyazisiweyo kuyo yonke irekhodi ebalulekileyo PHAMBI kokuba uchukumise umbhalisi wakho: Masithi umboneleli wakho omtsha ukwabele ns1.rescuedns.com kwaye ns2.rescuedns.com. Zivavanye ngokuthe ngqo nge dig:

   dig @ns1.rescuedns.com yourdomain.com SOA +norecurse
   dig @ns1.rescuedns.com yourdomain.com A +norecurse
   dig @ns1.rescuedns.com yourdomain.com MX +norecurse
   

   Linda de i flags: umgca kwi dig okubhalwe ngasentla kubandakanya ngokucacileyo aa (Authoritative Answer) kunye neembuyekezo status: NOERROR.
5. Ukuba dig +short yourdomain.com DS ubuyile a DS irekhodi, isiphatho DNSSEC kumbhalisi:
6. Ngexesha lokucinywa okusebenzayo apho umboneleli weDNS omdala engenakufikeleleka ngokupheleleyo: Ngena kwi-i-Domain Registrar yakho (apho uthenge khona i-domain), yiya kwi-DNSSEC / DS Records icandelo, kwaye ** cima zonke DS iirekhodi** ngoko idomeyini ibuyela ekubeni ingatyikitywanga (Insecure) indlela kwindawo yomzali yeTLD. Linda de dig +short yourdomain.com DS @a.gtld-servers.net ibuyisela ingenanto (kwaye gungxula DS kwi 8.8.8.8 / 1.1.1.1), okanye yongeza i entsha umnikezeli weDNS DS irekhodi ecaleni kwendala ukuba wenza umfuduko ocwangcisiweyo wababhali abaninzi.
7. Hlaziya iiSeva zamagama (NS) kwiDomain Registrar yakho: Faka endaweni yeeseva ezifileyo nge ns1.rescuedns.com kwaye ns2.rescuedns.com kumbhalisi wakho Iphaneli yeSiko laMagama (qaphela: ukutshintsha NS iirekhodi ngaphakathi kumhleli wendawo ayenzi nto xa iiseva ezindala zifile; kufuneka utshintshe Iglu / iMisebenzi yokuThunywa koMzali kwinqanaba loBhaliso).
8. ** Hlanza NS kwaye DS Ugcino kuGoogle (8.8.8.8) kunye ne-Cloudflare (1.1.1.1)**: Sebenzisa izixhobo zokucoca i-cache yoluntu ukusuka kwiSigaba sesi-2 iNyathelo lesi-3 ukunyanzela ukwamkelwa kwangoko kwamagama amatsha.

Inqanaba lesi-4: Ukusinda kwi-60-Day ye-ICANN yokuTshintshela iRegistra yokuTshixa ngexesha likaxakeka¶

Kuthekani ukuba ufuna ukudlulisela indawo yakho kumbhalisi omtsha (ICANN Inter-Registrar Transfer), kuphela ukuvalelwa ngu Domain Status: clientTransferProhibited kunye nomyalezo othi: "Lo mmandla uphantsi kwe-60-day Transfer Lock ye-ICANN kuba ulwazi loqhagamshelwano lusanda kuhlaziywa"?

1. **Kutheni i-lock yeentsuku ze-60 iqalile **: Ngaphantsi kwe-I-ICANN Transfer Policy (Icandelo II.C.1), ababhalisi babeka isitshixo sokudlulisa iintsuku ezingama-60 nanini na i-domain isanda kubhaliswa, idluliswa phakathi kwababhalisi, okanye ingena "uTshintsho loBhaliso" (ukuhlaziya igama lokuQala, iGama loBhaliso, iGama loBhaliso, idilesi ye-imeyile
2. Ugqitha njani okanye uphume njani kuTshintsho-loBhaliso lweentsuku ezingama-60:
3. Ngaphambi kokuhlela iinkcukacha zoqhagamshelwano ze-WHOIS: Phantse zonke iirejistra ezinkulu zibonelela ngebhokisi yokukhangela ekunene kwiscreen sokuhlela umfowunelwa esibhalwe: "Phuma kwi-60-day lock yotshintshiselwano emva kolu hlaziyo lomfowunelwa." Ukukhangela loo bhokisi kukuvumela ukuba uhlaziye idilesi yakho ye-imeyile yomlawuli/obhalisiweyo kwaye uvelise idilesi ye-imeyile. EPP Auth-Code (Transfer Secret) ukudlulisa idomeyini kwangolo suku lunye.
4. **Khumbula ukuba awudingi ukudlulisa ukubhaliswa kwesizinda ukuze utshintshe ababoneleli be-DNS **: Nokuba i-domain ivaliwe ngeentsuku ze-60 ngokuchasene noBhaliso loBhaliso (clientTransferProhibited), usenako ukuyitshintsha Nameservers (NS iirekhodi) kwirejista ekhoyo nangaliphi na ixesha kunye nexesha lokulinda elinguziro; ukutshintsha i-DNS kuthatha imizuzu, ngelixa ukudluliselwa kwerejistra epheleleyo kuthatha ukuya kwi-5 ukuya kwiintsuku ze-7 ngaphandle kokuba umbhalisi olahlekileyo ucofa ngokukhawuleza Vumela uTshintsho oluphumayo (FOa) iqhosha.

Isigaba sesi-5: Ukwenza lukhuni ukubhaliswa kwesizinda kunye ne-DNS ngokuchasene nokuphuma kwexesha elizayo¶

Nje ukuba isizinda sakho kunye nesisombululo se-DNS sibuyiselwe ipesenti ezili-100, gqibezela olu luhlu lokujonga ukomelela:

• Vumela Registry Lock (serverDeleteProhibited, serverUpdateProhibited, serverTransferProhibited) kwi-mission-critical production domains: Umgangatho Registrar Lock (clientTransferProhibited) inokukhutshwa ngokucofa kanye ukuba umhlaseli uqweqwedisa igama lakho lobhaliso. **I-Registry Lock ** (enikezelwa yi-Verisign, i-PIR, i-Cloudflare, i-CSC, i-MarkMonitor, i-Gandi, kunye ne-Porkbun / i-Namecheap yeendawo zezoshishino) itshixa isizinda ngokuthe ngqo kwinqanaba le-TLD yoBhaliso, ifuna ngaphandle kwe-band-of-band ukuqinisekiswa kwezwi / i-cryptographic phambi kwayo nayiphi na into. NS irekhodi inokutshintshwa okanye i-domain icinywe.
• ** Hlaziya imimandla yemveliso ye-5 kwiminyaka eyi-10 kwangaphambili (ICANN maximum horizon is 10 years)**: Ungaze ushiye indawo ebaluleke kakhulu kwishishini ekuhlaziyweni konyaka nonyaka apho ikhadi letyala letyala eliphelelwe lixesha linokubangela ukuphela kwexesha. Hlawula kwangaphambili iminyaka emi-5 ukuya kweli-10 kanye.
• ** Ungaze usebenzise i @yourdomain.com idilesi ye-imeyile njengegama lokungena okanye isaziso soqhagamshelwano lokuhlawula kumbhalisi olawulayo yourdomain.com**: Sebenzisa uluhlu olunikezelweyo lokuhambisa ukhuseleko kwi-domain yolawulo ezimeleyo okanye i-akhawunti yangaphandle eqinile, kwaye ubeke iliso RDAP / WHOIS imihla yokuphelelwa ngokusebenzisa iPrometheus yangaphandle/iimonitha zexesha elipheleleyo (domain_expiry_days < 60).
• Ngaphantsi NS kwaye DS TTLs (300 ukuya 3600 imizuzwana) Iiyure ezingama-48 phambi kwayo nayiphi na imfuduko ye-DNS ecwangcisiweyo: Ukwehliswa kwe-TTLs kwangaphambili kuqinisekisa ukuba abasombululi bayatshintsha phakathi kwemizuzu emi-5 yokunqunyulwa okucwangcisiweyo.

Iinombolo zengingqi zikaxakeka kunye neeprothokholi ze-arhente¶

Xa idomeyini okanye ukucima kwe-DNS kuchaphazela amaziko okhathalelo lwempilo, iinkonzo zikaxakeka, eziluncedo zikamasipala, okanye iziseko zoncedo zikarhulumente, landela la majelo okunyuka kommandla:

• I-United States neKhanada: Cofa 911 ukuba i-domain/DNS outage ikhubaza i-telemetry yesibhedlele sekliniki, ukuthunyelwa kwe-ambulensi, okanye iinkqubo zokhuseleko lobomi. Xela ukuhlaselwa kwe-DDoS kwiziseko ezingundoqo ze-DNS okanye i-BGP/DNS ukuqweqwedisa kwi-CISA (1-844-Say-CISA / cisa.gov/report), i FBI IC3 (ic3.gov), okanye iZiko laseKhanada loKhuseleko lweCyber (1-833-CYBER-88). Kuba .gov iindawo, qhagamshelana ne CISA .gov Idesika yoNcedo yoMbhalisi.
• United Kingdom: Cofa 999 kwizoyikiso zobomi okanye ukuphazamiseka okukhulu kwe-NHS. Xela ukucinywa kwe-DNS ebalulekileyo okanye ukuqweqwediswa kwesizinda kwi-*NCSC (ncsc.gov.uk)**, kwaye uqhagamshelane umtyunjwa (01865 332244) ngqo ngokungxamisekileyo .uk / .gov.uk / .nhs.uk imiba yobhaliso.
• I-European Union: Cofa 112 kuwo onke amazwe angamalungu e-EU. Ababoneleli ngenkonzo ye-DNS kunye nerejista yegama le-TLD ilawulwa phantsi kwe-EU NIS2 Directive (Directive 2022/2555) kwaye kufuneka baxele iziganeko ezibalulekileyo zokufumaneka kwi-CSIRT yabo yesizwe kwiiyure ezingama-24.
• Ostreliya neNew Zealand: Cofa 000 eOstreliya okanye 111 eNew Zealand; xela iDNS ebalulekileyo okanye iziganeko zesizinda kwi ACSC (1300 CYBER1), auDA (for .au), okanye Domain Name Commission NZ (for .nz).
• I-Indiya kunye ne-Asia-Pacific: Cofa 112 eIndiya impendulo kaxakeka; xela iDNS/uhlaselo lweziseko ezingundoqo kwi-CERT-In (incident@cert-in.org.in)* kwiiyure ezi-6 okanye NIXI ye .in ukunyuka kwerejista.

Imibuzo edla ngokubuzwa¶

Kutheni le nto i-domain yam iyekile ukusebenza iiyure ezingama-24 PHAMBI kwesitampu sayo sokuphelelwa lixesha se-WHOIS?¶

Okokuqala, jonga amaxesha emimandla: WHOIS `Registry Expiry Date` isoloko iprintwa kwi **UTC (`Z`)**, eziiyure ezi-4 ukuya kwezisi-8 ngaphambi kwemimandla yexesha laseMntla Merika (ithetha ukuba indawo ephelelwa lixesha `2026-11-01T04:00:00Z` ngokwenene iphelelwa ngo `8:00 PM PDT` ngo-Oktobha 31). Okwesibini, ukuba wakho `NS` iirekhodi zine-a `24-hour` okanye `48-hour` I-TTL kunye nombhalisi batshintshiselana nabo `00:00 UTC` Ngomhla wokuphelelwa, abasebenzisi abasonjululi babo bahlaziye kwangoko babetha iphepha lokupaka ngokukhawuleza ngelixa abanye behlala bevalelwe iiyure.

Umbhalisi wam akasebenzi kwaphela okanye akaphenduli (Dead / De-accredited Registrar), kwaye indawo yam iyaphelelwa. Ndiyihlangula njani?¶

Xa i-ICANN iphelisa okanye icikica irejistra engaphumeleliyo phantsi kwe- **Inkqubo yoTshintsho loBhaliso oluVunyiweyo (De-Accredited Registrar Transition Procedure)`DARTP`)**, i-ICANN ngokuzenzekelayo ihambisa isambuku kuzo zonke iindawo kwi-registrar efumana umlondolozi ngexabiso elinguziro kubabhalisi. Khangela `whois yourdomain.com` (okanye `lookup.icann.org`) ukubona ukuba yeyiphi **uMbhalisi** kunye ne **ID ye-IANA** okwangoku ebambe indawo yakho, okanye ufake ifayile engxamisekileyo **Uhlaziyo lweDomain / Isikhalazo sokuGqithisela ** ngokuthe ngqo nge **UkuThotyelwa kweKhontrakthi ye-ICANN (`icann.org/compliance/complaint`)**.

Kutheni iwebhusayithi yam isebenzela abanye abathengi kwidatha yeselula, kodwa isabonisa iphepha lokupaka eliphelelwe lixesha kwiofisi yethu ye-Wi-Fi iiyure ezi-6 emva kokuba ndihlaziye isizinda?¶

Uthungelwano lweofisi yakho okanye i-ISP yasekuhlaleni ephindiweyo ye-DNS isombululi igcine kwindawo yokupaka yombhalisi `NS` kwaye `A` iirekhodi ngelixa i-domain iphelelwe lixesha, kwaye ii-nameservers zokupaka zisete kakhulu ii-TTL eziphezulu (`3,600` ukuya `86,400` imizuzwana / iiyure ezingama-24) ke amaphepha entengiso ahlala egcinwe ixesha elide. Gubha uGoogle (`8.8.8.8`) kunye ne-Cloudflare (`1.1.1.1`) besebenzisa izixhobo zabo zokucoca iwebhu, emva koko kwikhompyuter yakho yendawo `ipconfig /flushdns` (iiWindows), `sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder` (macOS), okanye `sudo resolvectl flush-caches` (Linux).

Kwenzeka ntoni kwii-imeyile ezithunyelwe kuzo @yourdomain.com Ngelixa i-Domain yethu okanye i-DNS iphelelwe lixesha kwiiyure ze-18? Ngaba Balahlekile Ngonaphakade?¶

Kwiimeko ezininzi, Ii-imeyile ezisemthethweni ezithunyelwe ngexesha lokuqala le-12 ukuya kwiiyure ezingama-48 zokucinywa kwe-DNS AKULAHLWAYO: zibekwe emgceni kumncedisi weposi womthumeli kwaye ziya kufika ngokuzenzekelayo kwiiyure ezimbalwa ezizayo.. Ngaphantsi **`RFC 5321` (IProtokholi yokuGqithisela ngemeyile elula, iCandelo 4.5.4.1)**, xa umncedisi weposi ethumela (`Gmail`, `Microsoft Exchange Online`, `Postfix`) ifumana ukusilela kokujonga iDNS okwethutyana (`SERVFAIL`) okanye ayikwazi ukuqhagamshela kwi `MX` umamkeli, ibeka umyalezo kumgca wokuzama kwakhona **4 ukuya kwiintsuku ezi-5 (`96 to 120 hours`)**, iyazama kwakhona nge-exponential backoff. Nangona kunjalo, ukuba iphepha lokupaka lombhalisi eliphelelwe lixesha liquka i **wildcard null `MX` irekhodi (`0 .`)** okanye iseva yemeyile yokupaka eyale imeyile ngehard `550 5.1.1 User Unknown` i-bounce esisigxina, abo bathumeli bafumene isaziso ngokukhawuleza kwaye kufuneka bathumele kwakhona ii-imeyile zabo.

Ngaba ndingamisela ababoneleli beDNS ababini ngexesha elinye (Cloudflare + Route 53) ngokulula ngokudwelisa i-Cloudflare ezimbini NS iirekhodi kunye neendlela ezimbini ze-53 NS iirekhodi kumbhalisi wam?¶

Ewe, okoko `DNSSEC` ivaliwe (okanye iqwalaselwe kakuhle nge `RFC 8901` I-Multi-Signer DNSSEC) kwaye bobabini ababoneleli bakhonza iirekhodi zeDNS ezifanayo. Izisombululi eziphindaphindayo zibuza bonke abazali abadwelisiweyo `NS` iirekhodi usebenzisa umjikelo-robin/RTT ukhetho lokulinda (`SRTT`). Ukuba udwelisa `ns1.providerA.com`, `ns2.providerA.com`, `ns1.providerB.com`, kwaye `ns2.providerB.com` kuMgcini-magama wesiko lombhalisi wakho kwaye ugcine iindawo zombini zingqamaniswe usebenzisa **OctoDNS**, **DNSControl**, **Terraform**, okanye `AXFR / IXFR` ukudluliselwa kwendawo, i-domain yakho isinda ngokuzenzekelayo kwi-100 yepesenti yokucinywa nokuba ngumboneleli we-DNS.

Yintoni umahluko phakathi clientHold kwaye serverHold KUBANI?¶

Iikhowudi zobume beEPP ziqala nge **`client...`** (`clientHold`, `clientTransferProhibited`) zisetwe ngu *Domain Registrar** yakho (umthengisi apho ulawula khona iakhawunti yakho, njengeNamecheap okanye iGoDaddy) kwaye inokususwa ngokukhawuleza ngenkxaso yombhalisi wakho okanye inkqubo yokuhlawula. Iikhowudi zesimo eziqala ngo **`server...`** (`serverHold`, `serverTransferProhibited`) zicwangciswe ngqo yi **TLD Registry Operator** (`Verisign`, `PIR`, `Nominet`) ngenxa yemiyalelo yenkundla, iimbambano ze-UDRP, ukunqunyanyiswa kwenqanaba lobhaliso, okanye ihardware **I-Registry Lock**, kwaye ifuna ukuqhakamshelana noBhaliso ngokusebenzisa umbhalisi wakho ukuze uphakamise.

Izikhokelo ezinxulumeneyo¶

• Ukuqweqwediswa kwegama lesizinda, iDNS ephelelwe lixesha, kunye nokuthathwa kwewebhusayithi
• Isatifikethi se-SSL/TLS siphelelwe lixesha kwimveliso, ukutshixwa kwangaphambili kwe-HSTS, ibhloko yerekhodi ye-CA CAA, kunye nohlaziyo olungxamisekileyo
• I-Google Workspace okanye i-Microsoft 365 yesiko lolawulo lwedomeyini evaliweyo, uqinisekiso lwe-DNS TXT, kunye nokuhlangula umqeshi
• Ukuqweqwediswa kwe-DNS, uhlengahlengiso lwe-ISP umzila we-WAN, kunye nokubanjwa kwe-portal spoofing
• Ingxaki yokubamba iwebhu, ukufuduka, kunye nokubuyiselwa kogcino
• Amanani kaxakeka ngokwelizwe

Imithombo kunye nezikhokelo ezisemthethweni¶

• Umbutho we-Intanethi wamagama anikiweyo kunye namanani (ICANN): Ipolisi yoBuyiselo yoBhaliso ephelelwe lixesha (ERRP), UMgaqo-nkqubo wokuCima iNdawo ePheleleyo (EDDP), i-Inter-Registrar Transfer Policy (i-60-Day Change-of-Registrant Lock), kunye neNgcaciso yeeKhowudi zesimo se-EPP (clientHold, redemptionPeriod, pendingDelete).
• Umsebenzi wobuNjineli be-Intanethi (IETF): RFC 6781 (IiNdlela zokuSebenza ze-DNSSEC: Ii-Rollovers eziphambili kunye noNgxamiseko DS Ukususwa) & RFC 8901 (IiModeli ze-DNSSEC ze-Multi-Signer ze-Multi-Provider Authoritative DNS).
• Iziko leSizwe leMigangatho kunye neTekhnoloji (NIST) (eUnited States): Ushicilelo olukhethekileyo 800-81-2: INkqubo eKhuselekileyo yeGama leDomain (DNS) Isikhokelo sokusasaza.
• I-Arhente yoKhuseleko lwe-Cybersecurity kunye ne-Infrastructure Security Agency (CISA) (eUnited States): I-Emergency Directive 19-01: Ukunciphisa i-DNS Infrastructure Tampering.
• I-Arhente yeManyano yaseYurophu yoKhuseleko kwiCybersecurity (ENISA): * I-NIS2 IsiKhokelo soBuchule kuBaboneleli beNkonzo ye-DNS kunye neeRejistri zegama le-TLD *.