Alakoso Ile-iṣẹ tabi Idaduro Olupese DNS: Akoko Irapada Aṣẹ ti pari, DNSSEC SERVFAIL Pakute, ati Iṣilọ Nameserver pajawiri¶

Titaji lati ṣawari pe oju opo wẹẹbu akọkọ ti ile-iṣẹ rẹ, awọn aaye ipari API (api.example.com), ati imeeli ile-iṣẹ (MX Awọn igbasilẹ fun Google Workspace tabi Microsoft 365) ko le de ọdọ rẹ ni gbogbo agbaye (DNS_PROBE_FINISHED_NXDOMAIN tabi SERVFAIL) jẹ idaamu amayederun-dudu lapapọ. Ko dabi olupin wẹẹbu kan ti o kọlu ti o kan iṣẹ kan, Eto Orukọ Aṣẹ kan (DNS) tabi ikuna iforukọsilẹ agbegbe pin gbogbo iṣẹ kan labẹ aaye gbongbo rẹ nigbakanna, pẹlu Wọle Kan ṣoṣo (SSO), awọn ọna abawọle atilẹyin alabara, ati awọn imeeli-idahun iṣẹlẹ ti nwọle. Ni iṣe, awọn didaku agbegbe agbaye lati awọn okunfa mẹta ọtọtọ: (1) ** ipari ipari agbegbe lairotẹlẹ kan ** nibiti kaadi kirẹditi lori faili ti pari ati ti iforukọsilẹ ti ji rẹ. NS awọn igbasilẹ lati tọka si oju-iwe idaduro isanwo-fun-tẹ 24 to 48 hours ṣaaju ọjọ ipari gangan; (2) ikọlu **DDoS tabi ijade ọkọ ofurufu ** ni olupese DNS ti o ni aṣẹ (Route 53, Cloudflare, GoDaddy, Namecheap, DNSimple, NS1); tabi (3) a ** dà DNSSEC (DS igbasilẹ) pq ti igbẹkẹle *** lakoko iyipada orukọ olupin ti o yara ti o fa awọn ipinnu afọwọsi (8.8.8.8, 1.1.1.1, ISP resolvers) lati ju 100 ogorun ti ijabọ rẹ pẹlu SERVFAIL. Ti ikọlu ba ba awọn iwe-ẹri iwọle iforukọsilẹ rẹ ti o ti gbe tabi paarọ agbegbe rẹ ni irira, yipada si jija orukọ ašẹ, DNS ti o ti pari, ati gbigba aaye ayelujara; ti ijẹrisi TLS rẹ ba pari tabi fọ lẹhin DNS ti gba pada, wo Ijẹrisi SSL/TLS ti pari ni iṣelọpọ, titiipa iṣaju iṣaju HSTS, ati isọdọtun pajawiri ati Google Workspace tabi Microsoft 365 tiipa abojuto agbegbe aṣa ati ijẹrisi DNS. Ti ijade yii ba mu awọn ibaraẹnisọrọ ile-iwosan kuro, 911/112 ipa-ọna fifiranṣẹ pajawiri, tabi awọn ohun elo ti gbogbo eniyan pataki, pe nọmba pajawiri ti agbegbe rẹ (911 ni Ilu Amẹrika ati Kanada, 112 jakejado European Union, 999 ni United Kingdom) tabi kan si wa liana ti pajawiri awọn nọmba.

Ṣe eyi ni bayi¶

1. Ṣayẹwo ni iṣẹju-aaya 10 boya ikuna jẹ Ibugbe Ti pari/IdaduroEPP Status), Ilọkuro Olupese DNS Alaṣẹ, tabi a DNSSEC Ikuna Ifọwọsi:
2. Ṣiṣe whois yourdomain.com | grep -iE "Status|Expiry|Name Server" ati dig +trace yourdomain.com.
3. Ṣe idanwo boya o kọja DNSSEC afọwọsi (+cd = Ṣiṣayẹwo Alaabo) ṣe ipinnu agbegbe rẹ lẹẹkansi:

   dig @8.8.8.8 yourdomain.com A
   dig @8.8.8.8 yourdomain.com A +cd
   

   Ti aṣẹ akọkọ ba pada status: SERVFAIL lakoko aṣẹ keji (+cd) pada lẹsẹkẹsẹ status: NOERROR pẹlu adiresi IP olupin rẹ, ** Awọn olupin DNS rẹ KO ni isalẹ: rẹ DNSSEC (DS record at the registrar) baje**. Lọ lẹsẹkẹsẹ si Ipele 3 lati paarẹ stale naa DS igbasilẹ ni rẹ Alakoso.
4. **Ti agbegbe rẹ ba ti pari (Auto-Renew Grace Period tabi Redemption Grace Period), wọle sinu Alakoso lọwọlọwọ rẹ lẹsẹkẹsẹ ki o san owo isọdọtun / irapada; MAA ṢE duro fun aaye naa lati "ju silẹ" ki o le tun forukọsilẹ ni olowo poku ***:
5. Ni akọkọ ** 1 si 45 ọjọ *** lẹhin ipari (Auto-Renew Grace Period), isọdọtun ninu dasibodu iforukọsilẹ rẹ ṣe atunṣe awọn olupin orukọ atilẹba rẹ ni idiyele isọdọtun boṣewa ($10 to $30).
6. Nigba ** 30-ọjọ Redemption Grace Period (RGP / redemptionPeriod*, o gbọdọ san owo irapada iforukọsilẹ dandan ($80 to $250) nipasẹ rẹ lọwọlọwọ Alakoso. Ti o ba duro de aaye lati pari ọjọ-5 ** Pending Delete alakoso lati fipamọ $100, aládàáṣiṣẹ bot-mimu bot sniper (DropCatch, SnapNames, NameJet) yoo já rẹ ašẹ laarin 5 milliseconds ti itusilẹ ati titaja fun ẹgbẹẹgbẹrun dọla.
7. ** MAA ṢE yi Awọn olupin Orukọ rẹ pada (NSkuro lati ọdọ olupese DNSSEC ti n ṣiṣẹ DNS (bii Cloudflare, Route 53, tabi Google Cloud DNS) laisi yiyọkuro DS igbasilẹ ni rẹ Alakoso akọkọ ***: If DNSSEC wa ni sise ati awọn ti o siwopu rẹ NS awọn igbasilẹ si olupese DNS igbala lakoko ijade laisi piparẹ obi naa DS (Delegation Signer) igbasilẹ ninu awọn .com / .org Agbegbe TLD ni akọkọ, gbogbo ipinnu ifẹsẹmulẹ lori Earth yoo kọ awọn idahun ti a ko fowo si olupese DNS tuntun bi ikọlu spoofing cryptographic (SERVFAIL).
8. ** Ti o ba wa ni titiipa kuro ni ile-iṣẹ rẹ @yourdomain.com imeeli nitori rẹ ašẹ ká MX Awọn igbasilẹ ti wa ni isalẹ, MAA ṢE tẹ “Fi koodu atunto ọrọ igbaniwọle ranṣẹ si admin@yourdomain.com" ni Alakoso rẹ ***: Lakoko ti agbegbe rẹ NS tabi MX awọn igbasilẹ jẹ offline, eyikeyi imeeli ijẹrisi ti a fi ranṣẹ si @yourdomain.com bounces tabi panu sinu isinyi. Lo SMS/Oludasilẹ MFA ti Alakoso rẹ, imeeli afẹyinti ti ko ni iye (@gmail.com / @proton.me), tabi sisan idanimọ idanimọ foonu.
9. Lẹhin ti isọdọtun agbegbe ti pari, rii daju pẹlu ọwọ pe Alakoso rẹ da pada awọn olupin Orukọ Aṣa atilẹba rẹ (NS) dipo ti nlọ ìkápá lori sedoparking.com / renewyourname.net: Nigbati agbegbe kan ba pari, awọn iforukọsilẹ tun kọ aṣa rẹ silẹ NS awọn igbasilẹ pẹlu awọn olupin orukọ pa (ns1.parklogic.com, dns1.name-services.com). Nigba miiran sisanwo isọdọtun ṣe imudojuiwọn ọjọ ipari si ọdun to nbọ lakoko ti o nlọ awọn olupin orukọ pa duro lọwọ titi iwọ o fi yi wọn pada pẹlu ọwọ.
10. ** Fọ awọn caches DNS ti gbogbo eniyan ti gbogbo agbaye (Google 8.8.8.8, Cloudflare 1.1.1.1, OpenDNS) keji re NS tabi DS igbasilẹ ti wa ni pada ***: Dipo ti a duro 24 to 48 wakati fun cache NXDOMAIN tabi pa-iwe NS awọn igbasilẹ lati pari nipa ti ara, nfa imukuro kaṣe agbaye lẹsẹkẹsẹ ni Google Public DNS (developers.google.com/speed/public-dns/cache) ati Cloudflare 1.1.1.1 (one.one.one.one/purge-cache/).

Igi ipinnu: agbegbe agbaye tabi ipadanu pajawiri didaku DNS¶

Lo iwe-iṣan ṣiṣan yii lati ṣe afihan ipele gangan ti ipo-iṣẹ DNS (TLD Registry, Registrar EPP Status, DNSSEC DS Chain, tabi Authoritative Nameserver) nibiti ipinnu ti kuna:

flowchart TD
    Start["Ilọkuro Agbaye: Oju opo wẹẹbu Aṣẹ & Imeeli Ikuna lati yanju (NXDOMAIN / SERVFAIL)"] --> RunDiag["Ṣiṣe: whois domain.com ATI ma wà @8.8.8.8 domain.com + cd"]

    RunDiag --> CheckCD{"Ṣe ma wà @8.8.8.8 domain.com Ikuna, Lakoko ti o ti ṣafikun + cd Ṣe aṣeyọri?"}

    CheckCD -->|"Bẹẹni: Nṣiṣẹ pẹlu +cd, Kuna Laisi + cd"| DnssecBreak["Baje DNSSEC Pq ti Igbekele: Pa Stale DS Gba silẹ ni Alakoso OR Tun-Agbegbe Ibuwọlu -> Flush 8.8.8.8 & 1.1.1.1"]

    CheckCD -->|"Rara: Mejeeji kuna tabi Pada Pada IP"| CheckWhois{"Ayewo WHOIS EPP Ipo-ašẹ & Ọjọ Ipari"}

    CheckWhois -->|"Ipo: clientHold tabi serverHold"| HoldState["Alakoso Alakoso / Idaduro Iforukọsilẹ: Pari ICANN RAA Imeeli Ijẹrisi Imeeli TABI ilokulo/Tiketi ìdíyelé Lẹsẹkẹsẹ"]

    CheckWhois -->|"Ọjọ Ipari Ti kọja (Ipo: autoRenewPeriod)"| GraceRenew["Ọjọ 1 si 45 Ipari-Ipari: San isọdọtun Standard ni Portal Alakoso -> Jẹrisi Imupadabọ Aṣa NS"]

    CheckWhois -->|"Ipo: Akoko irapada (RGP)"| RgpRestore["Ọjọ 45 si 75 Ipari-Ipari: Ṣii Tikẹti Atilẹyin Alakoso Amojuto ni kiakia / San owo-pada sipo RGP ($ 80-$250) Lẹsẹkẹsẹ"]

    CheckWhois -->|"Ipo: ni isunmọtosi Parẹ"| PendingDel["Titiipa Ọjọ-Marun Ipari: Ko le Ṣe Tuntun ni Alakoso -> Gbe Awọn aṣẹ Afẹyinti Kọja Gbogbo Awọn Apeja nla nla ni bayi"]

    CheckWhois -->|"Ipo: ok / clientTransferLena ati ipari ni ojo iwaju"| AuthDown["Iforukọsilẹ Ile-iṣẹ Ni ilera -> Aṣẹ Olupese DNS Aṣẹ tabi Agbegbe Sonu"]

    AuthDown --> MigrateNS["Faili agbegbe gbe wọle (`BIND` / Terraform) si Olupese DNS Atẹle -> Yọ Igbasilẹ DS kuro ti DNSSEC Lori -> Ṣe imudojuiwọn NS ni Alakoso"]

Ipele 1: Igbesi aye ipari ICANN ti ibugbe (Auto-Renew vs. Redemption vs. Pending Delete)¶

Nigba ti a jeneriki Top-Level ase (gTLD bii .com, .net, .org, .io, .ai, .co, .app, .dev) dopin nitori pe kaadi kirẹditi isọdọtun adaṣe kuna tabi kaadi inawo ti fagile lẹhin ti oṣiṣẹ kan ti lọ, agbegbe naa kọja nipasẹ igbesi aye ipele-ipele pupọ ti o muna ti o ṣakoso nipasẹ Ilana Imularada Iforukọsilẹ Ipari ti ICANNERRP* ati awọn adehun oniṣẹ iforukọsilẹ (Verisign fun .com/.net, PIR fun .org, Identity Digital).

Bawo ni ìkápá kan ṣe kú ati idi ti o fi lọ ni aisinipo Ṣaaju tabi LORI Ọjọ 1 ti ipari¶

+-------------------------------------------------------------------------+
| ICANN gTLD EXPIRATION TIMELINE (.com / .net / .org example)             |
|                                                                         |
| [Active Domain]                                                         |
|       |                                                                 |
|       v  (Expiration Date Reached: Day 0)                               |
| +---------------------------------------------------------------------+ |
| | STAGE 1: Auto-Renew Grace Period (Day 1 to Day 30-45)               | |
| | - EPP Status: ok or clientHold (Registrar swaps your NS to parking) | |
| | - Production Impact: 100% OFFLINE within 0 to 48 hours of expiry    | |
| | - Recovery: Log into registrar & pay normal renewal ($10-$30).      | |
| +---------------------------------------------------------------------+ |
|       |  (Registrar sends Delete command to Registry at Day 30-45)      |
|       v                                                                 |
| +---------------------------------------------------------------------+ |
| | STAGE 2: Redemption Grace Period [RGP] (Exactly 30 Calendar Days)   | |
| | - EPP Status: redemptionPeriod (Domain removed from TLD Root Zone)  | |
| | - Recovery: Still 100% guaranteed to original owner, MUST pay       | |
| |   Registry RGP Redemption Fee ($80-$250) + renewal via registrar.   | |
| +---------------------------------------------------------------------+ |
|       |  (30-Day RGP expires without redemption payment)                |
|       v                                                                 |
| +---------------------------------------------------------------------+ |
| | STAGE 3: Pending Delete (Exactly 5 Calendar Days)                   | |
| | - EPP Status: pendingDelete                                         | |
| | - Recovery: IMPOSSIBLE to renew or redeem at any price. Registry    | |
| |   rejects all registrar commands until public drop at Day 5 (~18:00 | |
| |   UTC for Verisign .com/.net).                                      | |
| +---------------------------------------------------------------------+ |
+-------------------------------------------------------------------------+

Ṣe afiwe awọn ẹtọ rẹ gangan, awọn idiyele, ati awọn iṣe imularada ni gbogbo ipele ti ipari, pẹlu koodu orilẹ-ede Awọn ibugbe Ipele-oke (ccTLDs fẹran .uk, .de, .eu, .ca, .au), eyiti kii ṣe ** tẹle ICANN gTLD awọn ofin:

Ipele 2: Igbesẹ-nipasẹ-Igbese imularada ti ipari tabi RedemptionPeriod ibugbe¶

Tẹle ilana deede yii lati mu agbegbe ti o ti pari pada wa lori ayelujara ni akoko to kuru ju:

Igbesẹ 1: Tun wọle si Account Alakoso rẹ nigbati @yourdomain.com imeeli ti ku¶

Eyi ni Catch-22 Ayebaye ti agbegbe ti o ti pari: - Ibugbe rẹ (company.com) ti pari, bẹ MX awọn igbasilẹ fun company.com duro ipinnu. - O gbiyanju lati buwolu wọle sinu Alakoso agbegbe rẹ (GoDaddy, Namecheap, Cloudflare, Porkbun, Hover, Network Solutions, Gandi), ati awọn Alakoso wí pé: "A fi kan 6-nọmba ijerisi koodu to admin@company.com." - Nitori company.com ti pari, imeeli ko le de.

Bii o ṣe le jade kuro ni loop imeeli-ašẹ ti o ti pari lẹsẹkẹsẹ: 1. Maṣe gbe tabi yipada ohunkohun sibẹsibẹ: ṣayẹwo boya o le yi apeja meeli pajawiri igba diẹ NIKAN ti agbegbe ko ba pari (ti agbegbe naa ba pari ni ipele TLD, MX ko le yanju nibikibi titi tunse). 2. ** Lo Alakoso ti “Wiwọle Imeeli ti o padanu / Iṣe-išẹ ti pari” ikanni Imularada iroyin *: - O fẹrẹ to gbogbo awọn iforukọsilẹ ti ICANN ti o ni ifọwọsi n pese foonu iyasọtọ tabi ID-ijọba-iṣiro-ifọwọsi-iṣiro iwe-ifọwọsi pataki fun awọn alabara ti imeeli wiwọle wọle joko @ ašẹ ti pari inu akọọlẹ naa. - Ṣe awọn ohun mẹta ti o ṣetan ṣaaju pipe atilẹyin iforukọsilẹ: (a) awọn nọmba ** 4 kẹhin ti kaadi kirẹditi *** tabi ID idunadura PayPal ti a lo lori risiti isọdọtun iṣaaju, (b) ID Account Alakoso / PIN alabara ** rẹ, ati © ID Fọto ijọba kan + Awọn nkan ti Inkoporesonu / iwe-aṣẹ IwUlO ** ti o baamu WHOIS Registrant Organisation (Tech / Admin / Registrant). 3. Ni kete ti o wọle, lẹsẹkẹsẹ yi adirẹsi imeeli Account Account rẹ pada si agbegbe ita (@gmail.com, @proton.me, tabi agbegbe pajawiri lọtọ ti o ni) ati mu ṣiṣẹ ** Key Aabo Hardware (FIDO2 tabi ** Ohun elo Ijeri TOTP ** MFA nitorinaa iwọle ko da lori @company.com imeeli lẹẹkansi.

Igbesẹ 2: Ṣiṣe Isọdọtun tabi RedemptionPeriod (RGP) pada¶

1. ** Ti agbegbe ba wa ni Ipele 1 (Auto-Renew Grace Period, Ọjọ 1 si 30/45) ***:
2. Lọ si ** Ìdíyelé -> Awọn isọdọtun *** tabi ** Akojọ-ašẹ -> Ajọ ti o pari ** ki o san owo-owo isọdọtun naa.
3. ** Ṣayẹwo pataki ni iṣẹju 60 lẹhin isanwo **: Ṣii awọn olupin orukọ ti NS awọn eto ni Dasibodu Alakoso. Ṣayẹwo boya Alakoso yoo da awọn olupin orukọ gidi pada laifọwọyi (fun apẹẹrẹ, ns-123.awsdns-15.com tabi ada.ns.cloudflare.com) tabi fi aaye naa silẹ ti n tọka si awọn olupin ti o duro si ibikan ti o ti pari (ns1.sedoparking.com / dns1.registrar-servers.com). Ti a ba tun ṣe akojọ awọn olupin paati, tun-tẹ awọn olupin iṣelọpọ rẹ sii pẹlu ọwọ ki o fipamọ.
4. ** Ti agbegbe ba wa ni Ipele 2 (Redemption Grace Period / redemptionPeriod, Ọjọ 30/45 si 75) ***:
5. Wo taabu ti o yatọ si inu dasibodu iforukọsilẹ rẹ nigbagbogbo ti a samisi ** Awọn ibugbe ti o ti pari -> irapada ***, ** idọti / pada sipo **, tabi **Ore-ọfẹ/Idiyewo Irapada ***.
6. San owo-pada sipo RGP + isọdọtun ọdun 1.
7. Bawo ni atunṣe RGP ṣe n ṣiṣẹ ni Iforukọsilẹ (Verisign / PIR)? Nigbati o ba san owo RGP, Alakoso rẹ firanṣẹ EPP <update><restore op="request"> pipaṣẹ si iforukọsilẹ TLD. Awọn iforukọsilẹ lẹsẹkẹsẹ yi awọn ìkápá ipo lati redemptionPeriod si pendingRestore ** ki o si fi awọn ibugbe rẹ NS ṣe igbasilẹ pada sinu TLD Root Zone laarin awọn iṣẹju 15 si 60 ** lakoko ti Alakoso rẹ fi silẹ restore op="report" ìmúdájú ibamu.

Igbesẹ 3: Fori awọn idaduro kaṣe ISP agbegbe nipasẹ ṣiṣe mimọ 8.8.8.8 ati 1.1.1.1¶

Nigbati ašẹ rẹ ti pari, awọn olupinnu DNS loorekoore ni ayika agbaye ṣafipamọ awọn olupin orukọ pa tabi odi NXDOMAIN idahun (iṣakoso nipasẹ TLD's SOA Minimum TTL, deede 900 si 3,600 aaya, tabi 86,400 aaya fun NS awọn igbasilẹ). Akoko naa dig @a.gtld-servers.net yourdomain.com NS (ibeere awọn .com olupin gbongbo taara) ṣafihan awọn olupin orukọ iṣelọpọ gidi rẹ lẹẹkansi: 1. Ṣii ** Kaṣe Flush DNS gbangba Google *** (https://developers.google.com/speed/public-dns/cache): - Iru omi ṣan NS akọkọ fun yourdomain.com, lẹhinna fọ SOA, A, AAAA, MX, ati TXT. 2. Ṣii ** Cloudflare 1.1.1.1 Kaṣe Purge ** (https://one.one.one.one/purge-cache/): - Yọọ NS, A, AAAA, ati MX fun yourdomain.com.

Ipele 3: Olupin orukọ pajawiri (NS) Iṣiwa lakoko ijade Olupese DNS (Ati awọn DNSSEC Pakute)¶

Kini ti iforukọsilẹ agbegbe rẹ ba wulo ni ogorun 100 ati pe ko pari, ṣugbọn ** Olupese DNS Aṣẹ Aṣẹ *** (Route 53, Cloudflare, GoDaddy DNS, DigitalOcean DNS, Azure DNS, DNSimple, Dyn) n jiya ijakadi ajalu tabi ikọlu DDoS, ati pe o nilo lati jade lọ si awọn olupin Nameservers (NS) si olupese DNS afẹyinti ni bayi?

Awọn # 1 Migration Killer: Yipada NS Lakoko DNSSEC (DS Gbigbasilẹ) Ti ṣiṣẹ¶

Ṣaaju ki o to yipada ẹyọkan NS gbasilẹ ni Alakoso rẹ, ṣiṣe aṣẹ yii lati ṣayẹwo boya DNSSEC Ti ṣiṣẹ lori agbegbe rẹ ni iforukọsilẹ TLD obi:

dig +short yourdomain.com DS @8.8.8.8

+-------------------------------------------------------------------------+
| WHY CHANGING NS RECORDS WITH AN ACTIVE DS RECORD BREAKS THE INTERNET    |
|                                                                         |
| 1. Parent TLD (.com) holds your old DNS provider's DS Record (Key #2371)|
| 2. Old DNS Provider goes down. You import zone to New DNS Provider      |
|    (unsigned, or signed with a brand-new Key #9910) and swap NS.        |
| 3. Validating Resolver (8.8.8.8 / 1.1.1.1 / Comcast / ISP) queries      |
|    New DNS Provider, sees signature does NOT match DS Key #2371.        |
| 4. Resolver assumes an active MITM Spoofing Attack -> Returns SERVFAIL  |
| 5. RESULT: Your domain stays 100% dead worldwide even though the new    |
|    DNS servers are up and answering cleanly.                            |
+-------------------------------------------------------------------------+

Atokọ Iṣilọ Nameserver pajawiri ailewu (Odo SERVFAIL Ilana)¶

1. ** Tun ṣe tabi gbe wọle ni pipe faili agbegbe DNS rẹ ni olupese DNS tuntun ni akọkọ ***:
2. Maṣe gboju awọn igbasilẹ DNS rẹ lati iranti (@, www, ati api jẹ ṣọwọn awọn igbasilẹ nikan; igbagbe MX, SPF/TXT, DKIM, _dmarc, autodiscover, tabi CAA fọ ifijiṣẹ imeeli ati awọn isọdọtun TLS).
3. Nibo ni lati wa agbegbe DNS ni kikun nigbati dasibodu olupese DNS akọkọ rẹ wa ni isalẹ:
   • ** Ṣayẹwo Awọn amayederun-bi koodu (Terraform, Pulumi, OctoDNS, DNSControl*** ninu ibi ipamọ Git rẹ.
   • ** Ṣayẹwo awọn okeere agbegbe aipẹ (BIND .zone awọn faili)** tabi wa awọn ibi ipamọ data DNS itan (SecurityTrails, ViewDNS.info, DNSDumpster, tabi Censys / crt.sh fun subdomains).
   • ** Awọn igbasilẹ ipamọ ibeere ṣi joko ni inu awọn ipinnu atunṣe ti gbogbo eniyan *** (dig @8.8.8.8 yourdomain.com MX, dig @1.1.1.1 yourdomain.com TXT, dig @9.9.9.9 api.yourdomain.com A) ṣaaju ki awọn TTL wọn pari.
4. ** Rii daju pe olupese DNS tuntun n dahun ni aṣẹ fun gbogbo igbasilẹ to ṣe pataki ṣaaju ki o to kan Alakoso rẹ ***: Ṣebi olupese iṣẹ tuntun rẹ yàn ọ ns1.rescuedns.com ati ns2.rescuedns.com. Idanwo wọn taara pẹlu dig:

   dig @ns1.rescuedns.com yourdomain.com SOA +norecurse
   dig @ns1.rescuedns.com yourdomain.com A +norecurse
   dig @ns1.rescuedns.com yourdomain.com MX +norecurse
   

   Duro titi ti flags: ila ninu awọn dig akọsori ni gbangba pẹlu aa (Authoritative Answer) ati ki o pada status: NOERROR.
5. **Ti o ba dig +short yourdomain.com DS pada a DS igbasilẹ, mu DNSSEC ni Alakoso ***:
6. ** Lakoko ijade ti nṣiṣe lọwọ nibiti olupese DNS atijọ ko le de ọdọ ***: Wọle sinu ** Alakoso Alakoso *** (nibiti o ti ra aaye naa), lọ si apakan **DNSSEC / DS Records **, ati **pa gbogbo rẹ kuro. DS awọn igbasilẹ *** nitorinaa agbegbe naa tun pada si ti ko forukọsilẹ (Insecure) mode ni agbegbe obi TLD. Duro titi dig +short yourdomain.com DS @a.gtld-servers.net pada sofo (ati ki o danu DS ninu 8.8.8.8 / 1.1.1.1), tabi ṣafikun **tuntun *** ti olupese DNS DS ṣe igbasilẹ lẹgbẹẹ ti atijọ ti o ba n ṣe iṣilọ olona-ami ti a gbero.
7. ** Ṣe imudojuiwọn awọn olupin orukọ (NS) ni Alakoso Alakoso rẹ ***: Ropo oku nameservers pẹlu ns1.rescuedns.com ati ns2.rescuedns.com ninu igbimọ Alakoso rẹ ** Awọn olupin Orukọ Aṣa *** (akọsilẹ: iyipada NS awọn igbasilẹ inu olootu agbegbe ko ṣe * nkankan * nigbati awọn olupin atijọ ti ku; o gbọdọ yi awọn olupin orukọ ** Lẹ pọ / Aṣoju obi ** ni ipele Alakoso).
8. ** Fifọ NS ati DS awọn caches lori Google (8.8.8.8) ati Cloudflare (1.1.1.1***: Lo awọn irinṣẹ imukuro kaṣe ti gbogbo eniyan lati Ipele 2 Igbesẹ 3 lati fi ipa mu isọdọmọ lẹsẹkẹsẹ ti awọn olupin orukọ tuntun.

Ipele 4: Iwalaaye Titii Gbigbe Gbigbe Alakoso ICANN Ọjọ 60-ọjọ lakoko pajawiri¶

Kini ti o ba nilo lati gbe agbegbe rẹ lọ si Alakoso tuntun (ICANN Inter-Registrar Transfer), nikan lati ni idinamọ nipasẹ Domain Status: clientTransferProhibited ati ifiranṣẹ ti o nwipe: "Agbegbe yii wa labẹ titiipa Gbigbe ICANN ọjọ 60 nitori alaye olubasọrọ ti ni imudojuiwọn laipe"?

1. ** Kini idi ti titiipa ọjọ-ọjọ 60 ṣe okunfa ***: Labẹ Ilana Gbigbe ICANN (Abala II.C.1) ***, awọn iforukọsilẹ gbe titiipa gbigbe ọjọ 60 silẹ nigbakugba ti agbegbe kan ba forukọsilẹ tuntun, gbe laarin awọn iforukọsilẹ, tabi gba “Iyipada Alakoso” (imudojuiwọn Orukọ Akọkọ, Orukọ idile, Adirẹsi Olubasọrọ ti Imeeli).
2. ** Bii o ṣe le fori tabi jade kuro ni Iyipada-Forukọsilẹ-Titiipa ọjọ 60 ***:
3. ** Ṣaaju ki o to ṣatunkọ awọn alaye olubasọrọ WHOIS ***: Fere gbogbo awọn iforukọsilẹ pataki pese apoti kan ni ọtun lori iboju atunṣe olubasọrọ ti a samisi: ***“Jade kuro ni titiipa gbigbe ọjọ 60 lẹhin imudojuiwọn olubasọrọ yii.” *** Ṣiṣayẹwo apoti naa ngbanilaaye lati ṣe imudojuiwọn adiresi imeeli alabojuto / iforukọsilẹ ati tun ṣe agbekalẹ ohun kan. EPP Auth-Code (Transfer Secret) lati gbe agbegbe naa ni ọjọ kanna.
4. ** Ranti pe o ko nilo lati gbe iforukọsilẹ agbegbe lati yi awọn olupese DNS pada ***: Paapa ti agbegbe kan ba wa ni titiipa fun awọn ọjọ 60 lodi si * Awọn gbigbe Alakoso * (clientTransferProhibited), o tun le yi awọn olupin orukọ rẹ pada *NS awọn igbasilẹ) *** ni Alakoso lọwọlọwọ nigbakugba pẹlu akoko idaduro odo; yi pada DNS gba iṣẹju diẹ, lakoko ti gbigbe Alakoso ni kikun gba to 5 si awọn ọjọ 7 ayafi ti Alakoso ti o padanu ba tẹ lẹsẹkẹsẹ Fọwọsi Gbigbe Ti njadeFOa bọtini.

Ipele 5: Awọn iforukọsilẹ agbegbe lile ati DNS lodi si awọn ijade ọjọ iwaju¶

Ni kete ti agbegbe rẹ ati ipinnu DNS ti jẹ atunṣe 100 ogorun, pari atokọ ayẹwo resilience yii:

• ** Muu ṣiṣẹ Registry Lock (serverDeleteProhibited, serverUpdateProhibited, serverTransferProhibited) lori ise-lominu ni gbóògì ibugbe ***: Standard Registrar Lock (clientTransferProhibited) le yipada ni pipa pẹlu titẹ ẹyọkan ti ikọlu ba ji iwọle iforukọsilẹ rẹ. ** Titiipa iforukọsilẹ *** (ti a funni nipasẹ Verisign, PIR, Cloudflare, CSC, MarkMonitor, Gandi, ati Porkbun/Namecheap fun awọn ibugbe ile-iṣẹ) tilekun ašẹ taara ni ipele iforukọsilẹ TLD, to nilo ohun olona-eniyan pupọ / ijẹrisi cryptographic ṣaaju eyikeyi. NS igbasilẹ le yipada tabi parẹ agbegbe naa.
• ** Tunse awọn ibugbe iṣelọpọ fun ọdun 5 si 10 ni ilosiwaju (ICANN maximum horizon is 10 years***: Maṣe fi aaye-iṣẹ pataki ti iṣowo silẹ ni isọdọtun ọdun-si-ọdun nibiti kaadi kirẹditi ajọ kan ti pari le fa ijakadi ipari. Ṣaaju-sanwo 5 si 10 ọdun ni ẹẹkan.
• ** Maṣe lo ohun kan @yourdomain.com adirẹsi imeeli bi iwọle tabi olubasọrọ iwifunni ìdíyelé ni Alakoso Alakoso yourdomain.com**: Lo atokọ pinpin aabo igbẹhin lori agbegbe iṣakoso ominira tabi akọọlẹ ita lile, ati atẹle RDAP / WHOIS awọn ọjọ ipari nipasẹ awọn alabojuto Prometheus / Uptime ti ita adaṣe (domain_expiry_days < 60).
• ** Isalẹ NS ati DS Awọn TTL (300 si 3600 iṣẹju-aaya) Awọn wakati 48 ṣaaju eyikeyi iṣilọ DNS ti a gbero ***: Isalẹ awọn TTL ni ilosiwaju ṣe idaniloju awọn olupinnu yipada laarin awọn iṣẹju 5 ti gige ti a gbero.

Awọn nọmba pajawiri agbegbe ati awọn ilana ile-ibẹwẹ¶

Nigbati agbegbe kan tabi ijade DNS kan ni ipa lori awọn ohun elo ilera, awọn iṣẹ pajawiri, awọn ohun elo ilu, tabi awọn amayederun ijọba, tẹle awọn ikanni igbesoke agbegbe wọnyi:

• **Amẹrika ati Kanada *: Kiakia 911 ti agbegbe kan/DNS ijade npa telemetry ile-iwosan ile-iwosan, fifiranṣẹ ọkọ alaisan, tabi awọn eto aabo-aye. Jabọ awọn ikọlu DDoS lori awọn amayederun DNS tabi jija BGP/DNS si CISA (1-844-Say-CISA / cisa.gov/report, awọn FBI IC3 (ic3.gov, tabi ** Ile-iṣẹ Ilu Kanada fun Aabo Cyber (1-833-CYBER-88). Fun .gov awọn ibugbe, olubasọrọ ** CISA .gov Alakoso Helpdesk ***.
• ** United Kingdom *: Kiakia 999 fun awọn eewu si igbesi aye tabi awọn idalọwọduro NHS nla. Jabọ awọn ijade DNS to ṣe pataki tabi awọn jija agbegbe si NCSC (ncsc.gov.uk, ati olubasọrọ ** Nominet (01865 332244 taara fun amojuto .uk / .gov.uk / .nhs.uk awọn oran iforukọsilẹ.
• **European Union *: Kiakia 112 kọja gbogbo awọn orilẹ-ede ọmọ ẹgbẹ EU. Awọn olupese iṣẹ DNS ati awọn iforukọsilẹ orukọ TLD jẹ ofin labẹ ** EU NIS2 šẹ (Directive 2022/2555 ati pe o gbọdọ jabo awọn iṣẹlẹ wiwa pataki si CSIRT orilẹ-ede wọn laarin awọn wakati 24.
• ** Australia ati Ilu Niu silandii *: Kiakia 000 ni Australia tabi 111 ni Ilu Niu silandii; jabo DNS pataki tabi awọn iṣẹlẹ agbegbe si ACSC (1300 CYBER1 **aA (fun .au), tabi ** Aṣẹ Orukọ Igbimọ NZ *** (fun .nz).
• **India ati Asia-Pacific **: Kiakia 112 ni India fun esi pajawiri; jabo DNS/awọn ikọlu amayederun agbegbe si CERT-In (incident@cert-in.org.in laarin 6 wakati tabi ** NIXI *** fun .in escalations iforukọsilẹ.

Awọn ibeere ti a beere nigbagbogbo¶

Kini idi ti agbegbe mi fi duro lati ṣiṣẹ awọn wakati 24 ṣaaju ki o to osise WHOIS akoko ipari ipari rẹ?¶

Ni akọkọ, ṣayẹwo awọn agbegbe aago: WHOIS `Registry Expiry Date` ti wa ni titẹ nigbagbogbo ni **UTC (`Z`***, eyiti o jẹ awọn wakati 4 si 8 ṣaaju awọn agbegbe akoko Ariwa Amẹrika (itumọ agbegbe ti o pari ni `2026-11-01T04:00:00Z` kosi dopin ni `8:00 PM PDT` ni Oṣu Kẹwa 31). Keji, ti o ba wa `NS` awọn igbasilẹ ní a `24-hour` tabi `48-hour` TTL ati Alakoso paarọ wọn ni `00:00 UTC` ni ọjọ ipari, awọn olumulo ti awọn olupinnu wọn ṣe itunu ni kutukutu kọlu oju-iwe paati lẹsẹkẹsẹ lakoko ti awọn miiran wa ni ipamọ fun awọn wakati.

Alakoso mi ko ni iṣowo patapata tabi ko dahun (Dead / De-accredited Registrar), ati pe agbegbe mi n pari. Bawo ni MO ṣe le gba a silẹ?¶

Nigbati ICANN ba fopin si tabi yọkuro iwe-aṣẹ iforukọsilẹ ti o kuna labẹ Ilana Iyipada Alakoso Alakoso **De-Ifọwọsi (Ilana)`DARTP`***, ICANN laifọwọyi olopobobo-gbigbe gbogbo awọn ibugbe si gbigba olutọju oluṣakoso ni idiyele odo si awọn iforukọsilẹ. Ṣayẹwo `whois yourdomain.com` (tabi `lookup.icann.org`) lati wo iru ** Alakoso *** ati ** IANA ID *** di agbegbe rẹ lọwọlọwọ, tabi ṣe faili iyara kan ** Isọdọtun-ašẹ / Ẹdun Gbigbe ** taara pẹlu Ijẹmu Ibamu ICANN (`icann.org/compliance/complaint`)**.

Kini idi ti oju opo wẹẹbu mi n ṣiṣẹ fun diẹ ninu awọn alabara lori data cellular, ṣugbọn tun n ṣafihan oju-iwe idaduro ti o pari lori Wi-Fi ọfiisi wa Awọn wakati 6 lẹhin Mo tunse agbegbe naa?¶

Nẹtiwọọki ọfiisi rẹ tabi oluṣatunṣe DNS isọdọtun ISP agbegbe ti ṣafipamọ oju-iwe gbigbe ti iforukọsilẹ `NS` ati `A` awọn igbasilẹ lakoko ti agbegbe naa ti pari, ati awọn olupin orukọ ti o pa mọto ṣeto awọn TTL giga (`3,600` si `86,400` iṣẹju-aaya / wakati 24) nitorinaa awọn oju-iwe ipolowo wa ni ipamọ to gun. Pa Google (`8.8.8.8`) ati Cloudflare (`1.1.1.1`) lilo awọn irinṣẹ fifọ wẹẹbu wọn, lẹhinna lori ṣiṣe kọnputa agbegbe rẹ `ipconfig /flushdns` (Windows), `sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder` (macOS), tabi `sudo resolvectl flush-caches` (Linux).

Ohun ti o ṣẹlẹ si awọn apamọ ti a firanṣẹ si @yourdomain.com Lakoko ti Aṣẹ wa tabi DNS ti pari fun Awọn wakati 18? Ṣé Wọ́n Pàdánù Títí láé bí?¶

Ni ọpọlọpọ igba, Awọn imeeli t’olofin ti a firanṣẹ lakoko awọn wakati 12 si 48 akọkọ ti ijade DNS ko padanu: wọn wa ni isinyi lori olupin meeli olufiranṣẹ ati pe yoo de laifọwọyi ni awọn wakati diẹ to nbọ.. Labẹ **`RFC 5321` (Ilana Gbigbe Ifiranṣẹ ti o rọrun, Abala 4.5.4.1)**, nigbati olupin ifiweranṣẹ ranṣẹ (`Gmail`, `Microsoft Exchange Online`, `Postfix`gba ikuna wiwa DNS igba diẹ (`SERVFAIL`) tabi ko le sopọ si ẹya `MX` agbalejo, o gbe ifiranṣẹ si inu isinyi igbiyanju fun **4 si 5 ọjọ (5)`96 to 120 hours`***, tun gbiyanju pẹlu ifẹhinti ipari. Sibẹsibẹ, ti o ba jẹ pe oju-iwe idaduro akoko ti Alakoso ti o wa pẹlu ** asan kaadi egan `MX` igbasilẹ (`0 .`*** tabi olupin meeli ti o pa mọto ti o kọ meeli pẹlu lile kan `550 5.1.1 User Unknown` agbesoke yẹ, awọn olufiranṣẹ naa gba ifitonileti agbesoke lẹsẹkẹsẹ ati pe wọn gbọdọ tun fi imeeli ranṣẹ.

Ṣe MO le ṣeto awọn olupese DNS meji ni akoko kanna (Cloudflare + Route 53) nìkan nipa kikojọ meji Cloudflare NS awọn igbasilẹ ati ọna meji 53 NS igbasilẹ ni mi Alakoso?¶

Bẹẹni, bi gun bi `DNSSEC` jẹ alaabo (tabi tunto daradara pẹlu `RFC 8901` Multi-Signer DNSSEC) ati awọn olupese mejeeji sin awọn igbasilẹ DNS kanna. Recursive resolvers ìbéèrè gbogbo obi akojọ `NS` awọn igbasilẹ nipa lilo yiyan lairi yika-robin/RTT (`SRTT`). Ti o ba ṣe akojọ `ns1.providerA.com`, `ns2.providerA.com`, `ns1.providerB.com`, ati `ns2.providerB.com` ninu Awọn olupin Orukọ Aṣa ti Alakoso rẹ ki o jẹ ki awọn agbegbe mejeeji ṣiṣẹpọ ni lilo **OctoDNS ***, ** Iṣakoso DNS ***, **Terraform**, tabi `AXFR / IXFR` awọn gbigbe agbegbe, agbegbe rẹ wa laaye laifọwọyi ni ijade ida ọgọrun 100 ti boya olupese DNS.

Kini iyato laarin clientHold ati serverHold ninu WHOIS?¶

Awọn koodu ipo EPP ti o bẹrẹ pẹlu **`client...`** (`clientHold`, `clientTransferProhibited`) ti ṣeto nipasẹ ** Alakoso ile-iṣẹ ** (alataja nibiti o ti ṣakoso akọọlẹ rẹ, gẹgẹbi Namecheap tabi GoDaddy) ati pe o le yọkuro lẹsẹkẹsẹ nipasẹ atilẹyin iforukọsilẹ tabi eto isanwo. Awọn koodu ipo ti o bẹrẹ pẹlu **`server...`** (`serverHold`, `serverTransferProhibited`) ti ṣeto taara nipasẹ oniṣẹ ẹrọ iforukọsilẹ TLD ** (`Verisign`, `PIR`, `Nominet`) nitori awọn aṣẹ ile-ẹjọ, awọn ariyanjiyan UDRP, awọn idadoro ilokulo ipele iforukọsilẹ, tabi hardware ** Titiipa iforukọsilẹ ***, ati pe o nilo kikan si iforukọsilẹ nipasẹ Alakoso rẹ lati gbe soke.

Jẹmọ awọn itọsọna¶

• Ifijiṣẹ orukọ agbegbe, DNS ti pari, ati gbigba aaye ayelujara
• Iwe-ẹri SSL/TLS ti pari ni iṣelọpọ, titiipa iṣaju iṣaju HSTS, bulọki igbasilẹ CA CAA, ati isọdọtun pajawiri
• Google Workspace tabi Microsoft 365 tiipa abojuto agbegbe aṣa, ijẹrisi DNS TXT, ati igbala agbatọju
• Ifilelẹ DNS, atunto olulana ISP WAN, ati sisọ ẹnu abawọle igbekun
• Idaamu alejo gbigba wẹẹbu, ijira, ati imupadabọ afẹyinti
• Awọn nọmba pajawiri nipasẹ orilẹ-ede

Awọn orisun ati osise itoni¶

• Ile-iṣẹ Intanẹẹti fun Awọn orukọ ti a yàn ati Nọmba (ICANN): * Ilana Imularada Iforukọsilẹ ti pari (ERRP), Ilana Iparẹ-ašẹ ti pari (EDDP), Ilana Gbigbe Alakoso-Aarin (Titiipa Iyipada-ọjọ 60), ati Itọkasi Awọn koodu Ipo EPP (clientHold, redemptionPeriod, pendingDelete)*.
• Agbofinro Imọ-ẹrọ Intanẹẹti (IETF): RFC 6781 (DNSSEC Awọn adaṣe Iṣiṣẹ: Key Rollovers ati Pajawiri DS Yiyọ) & RFC 8901 (Olopo-Afọwọsi DNSSEC Awọn awoṣe fun Olupilẹṣẹ Olona-Aṣẹ DNS).
• National Institute of Standards and Technology (NIST) (Amẹrika): *Atọjade Pataki 800-81-2: Eto Orukọ Ibugbe to ni aabo (DNS) Itọsọna imuṣiṣẹ *.
• Aabo Cyber ati Ile-iṣẹ Aabo Awọn amayederun (CISA) (United States): Itọnisọna Pajawiri 19-01: Mitigating DNS Infrastructure Tampering.
• Ile-iṣẹ European Union fun Cybersecurity (ENISA): * Itọsọna Imọ-ẹrọ NIS2 fun Awọn olupese Iṣẹ DNS ati Awọn iforukọsilẹ Orukọ TLD *.