Isibhalisi Sesizinda noma Ukuphela Komhlinzeki we-DNS: Isikhathi Somusa Sokuhlengwa Kwesizinda Esiphelelwe yisikhathi, DNSSEC SERVFAIL I-Trap, kanye Ne-Emergency Nameserver Migration¶

Ukuvuka uthole ukuthi iwebhusayithi eyinhloko yenkampani yakho, izindawo zokugcina ze-API (api.example.com), kanye ne-imeyili yebhizinisi (MX amarekhodi e-Google Workspace noma i-Microsoft 365) awatholakali nhlobo emhlabeni wonke (DNS_PROBE_FINISHED_NXDOMAIN noma SERVFAIL) yinkinga yengqalasizinda engasebenzi ngokuphelele. Ngokungafani neseva yewebhu eyodwa ephahlazekile ethinta isevisi eyodwa, Uhlelo Lwegama Lesizinda (DNS) noma ukwehluleka kokubhaliswa kwesizinda kunqamula insizakalo ngayinye ngaphansi kwesizinda sakho sezimpande ngesikhathi esisodwa, okuhlanganisa Ukungena Okukodwa (SSO), izingosi zokwesekwa kwamakhasimende, nama-imeyili angenayo empendulo yezehlakalo. Empeleni, ukucishwa kwesizinda somhlaba wonke kubangelwa yizimbangeli ezintathu ezihlukene: (1) ukuphelelwa yisikhathi ngengozi kwesizinda lapho ikhadi lesikweletu efayeleni liphelelwe yisikhathi futhi nobhalisi entshontshe imali yakho. NS amarekhodi akhombe ekhasini lokupaka lokukhokha ngokuchofoza ngakunye 24 to 48 hours ngaphambi kosuku lwangempela lokuphelelwa yisikhathi; (2) ukuhlasela kwe-DDoS noma ukunqamuka kwendiza yokulawula* kumhlinzeki wakho we-DNS ogunyaziwe (Route 53, Cloudflare, GoDaddy, Namecheap, DNSimple, NS1); noma (3) a **ephukile DNSSEC (DS irekhodi) uchungechunge lokuthembela ** ngesikhathi sokushintshwa kwe-nameserver esheshayo ebangela izixazululi eziqinisekisayo (8.8.8.8, 1.1.1.1, izisulu ze-ISP) ukuze wehlise amaphesenti angu-100 wethrafikhi yakho nge SERVFAIL. Uma umhlaseli efake engozini iziqinisekiso zokungena zombhalisi futhi wadlulisela noma washintsha isizinda sakho ngonya, shintshela kokuthi ukudunwa kwegama lesizinda, i-DNS ephelelwe yisikhathi, nokuthathwa kwewebhusayithi; uma isitifiketi sakho se-TLS siphelelwe yisikhathi noma siphukile ngemva kokululama kwe-DNS, bheka Isitifiketi se-SSL/TLS siphelelwe yisikhathi ekukhiqizweni, ukuvala ukulayisha kuqala kwe-HSTS, nokuvuselela isimo esiphuthumayo futhi I-Google Workspace noma i-Microsoft 365 ngokwezifiso yomqondisi wesizinda nokuqinisekiswa kwe-DNS. Uma lokhu kucima kukhubaza ukuxhumana nomtholampilo wasesibhedlela, umzila wezimo eziphuthumayo we-911/112, noma izinsiza zomphakathi ezibalulekile, shayela inombolo yakho yasendaweni yezimo eziphuthumayo (911 e-United States naseCanada, 112 kwi-European Union, 999 e-United Kingdom) noma ubheke inkomba yethu ye izinombolo eziphuthumayo.

Yenza lokhu manje¶

1. Thola kumasekhondi angu-10 ukuthi ukwehluleka kuyisizinda Esiphelelwe Isikhathi/ Esimisiwe (EPP Status), Ukucisha Komhlinzeki Kwe-DNS Egunyaziwe, noma a DNSSEC Ukuhluleka Ukuqinisekisa:
2. Gijima whois yourdomain.com | grep -iE "Status|Expiry|Name Server" futhi dig +trace yourdomain.com.
3. Hlola ukuthi uyadlula yini DNSSEC ukuqinisekiswa (+cd = Ukuhlola Kukhutshaziwe) kwenza isizinda sakho sixazulule futhi:

   dig @8.8.8.8 yourdomain.com A
   dig @8.8.8.8 yourdomain.com A +cd
   

   Uma umyalo wokuqala ubuya status: SERVFAIL ngenkathi umyalo wesibili (+cd) ibuya ngokushesha status: NOERROR ngekheli le-IP leseva yakho, amaseva akho e-DNS AKUKHO phansi: yakho DNSSEC (DS irekhodi kubhalisi) liphukile. Gxumela ngokushesha esigabeni sesi-3 ukuze ususe okudala DS rekhoda kubhalisi wakho.
4. Uma isizinda sakho siphelelwe yisikhathi (Auto-Renew Grace Period noma Redemption Grace Period), ngena kumbhalisi wakho wamanje ngokushesha futhi ukhokhe imali yokuvuselela/yokuhlenga; UNGALINDI ukuthi isizinda "siwele" ukuze usibhalise kabusha ngokushibhile:
5. Phakathi kwezinsuku zokuqala ezingu-1 kuya kwezingu-45* ngemva kokuphelelwa yisikhathi (Auto-Renew Grace Period), ukuvuselela kudeshibhodi yakho yokubhalisa kubuyisela amaseva akho oqobo ngezindleko ezijwayelekile zokuvuselela ($10 to $30).
6. Phakathi* nezinsuku ezingama-30 Redemption Grace Period (RGP / redemptionPeriod)**, kufanele ukhokhe imali yokuhlengwa yokubhalisa eyisibopho ($80 to $250) ngobhalisi wakho wamanje. Uma ulinda isizinda ukuthi siqede 5-izinsuku Pending Delete isigaba sokugcina $100, i-automatic drop-catching sniper bots (DropCatch, SnapNames, NameJet) izohlwitha isizinda sakho ngaphakathi 5 milliseconds yokuyikhulula futhi ikhishwe endalini ngezinkulungwane zamaRandi.
7. ** UNGALOKOTHI uguqule ama-Nameservers akho (NS) kude nomhlinzeki we-DNS onikwe amandla i-DNSSEC (njenge-Cloudflare, Route 53, noma i-Google Cloud DNS) ngaphandle kokukhipha DS rekhoda kubhalisi wakho kuqala**: Uma DNSSEC ivuliwe futhi ushintshanisa eyakho NS irekhoda kumhlinzeki we-DNS wokuhlenga ngesikhathi sokucisha ngaphandle kokususa umzali DS (Delegation Signer) irekhodi ku .com / .org Indawo ye-TLD kuqala, sonke isixazululi esiqinisekisayo eMhlabeni sizozenqaba izimpendulo ezingasayiniwe zomhlinzeki we-DNS njengokuhlasela kwe-cryptographic spoofing (SERVFAIL).
8. Uma uvaleleke ngaphandle kwenkampani yakho @yourdomain.com i-imeyili ngenxa yesizinda sakho MX amarekhodi aphansi, UNGAQHUBI u-"Thumela ikhodi yokusetha kabusha iphasiwedi ku admin@yourdomain.com" kusibhalisi sakho: Ngenkathi isesizinda sakho NS noma MX amarekhodi awaxhunyiwe ku-inthanethi, noma iyiphi i-imeyili yokuqinisekisa ethunyelwe kuyo @yourdomain.com igxuma noma inyamalale kulayini. Sebenzisa i-SMS/Isiqinisekisi se-MFA ye-MFA, i-imeyili eyisipele engaphandle kwebhendi (@gmail.com / @proton.me), noma ukugeleza kokuqinisekisa ubunikazi befoni.
9. Ngemva kokuvuselela isizinda esiphelelwe yisikhathi, qinisekisa ngokwakho ukuthi uMbhalisi wakho ubuyisele ama-Nameservers akho Oqobo (NS) esikhundleni sokushiya isizinda sivuliwe sedoparking.com / renewyourname.net: Uma isizinda siphelelwa yisikhathi, ababhalisi babhala ngaphezulu ngokwezifiso zakho NS amarekhodi anama-nameservers okupaka (ns1.parklogic.com, dns1.name-services.com). Kwesinye isikhathi ukukhokha ukuvuselela kubuyekeza idethi yokuphelelwa yisikhathi ibe unyaka ozayo kuyilapho ushiya amaseva wokupaka esebenza uze uwashintshele emuva.
10. ** Sula izinqolobane ze-DNS eziphindaphindayo zomhlaba jikelele (Google 8.8.8.8, Cloudflare 1.1.1.1, OpenDNS) okwesibili eyakho NS noma DS amarekhodi abuyiselwe**: Esikhundleni sokulinda amahora angama-24 kuye kwangama-48 ukuze agcinwe kunqolobane NXDOMAIN noma ikhasi lokupaka NS amarekhodi azophelelwa yisikhathi ngokwemvelo, aqalise ukususwa kwenqolobane yomhlaba wonke ngokushesha ku-Google Public DNS (developers.google.com/speed/public-dns/cache) kanye ne-Cloudflare 1.1.1.1 (one.one.one.one/purge-cache/).

Isihlahla sesinqumo: isizinda somhlaba noma i-DNS blackout triage eziphuthumayo¶

Sebenzisa leli shidi lokugeleza ukuze ukhombe ungqimba oluqondile lwesigaba se-DNS (TLD Registry, Registrar EPP Status, DNSSEC DS Chain, noma Authoritative Nameserver) lapho isixazululo sihluleka khona:

flowchart TD
    Start["Ukunqamuka Kwembulunga yonke: Iwebhu Yesizinda Ne-imeyili Iyahluleka Ukuxazulula (NXDOMAIN / SERVFAIL)"] --> RunDiag["Gijimani: whois domain.com AND dig @8.8.8.8 domain.com +cd"]

    RunDiag --> CheckCD{"Ingabe dig @8.8.8.8 domain.com Iyahluleka, Ngenkathi Ukungeza +cd Kuphumelela?"}

    CheckCD -->|"Yebo: Isebenza nge-+cd, Iyahluleka Ngaphandle Kwe-+cd"| DnssecBreak["I-DNSSEC Chain of Trust Ephukile: Susa Irekhodi le-Stale DS ku-Registrar NOMA Phinda Usayine Indawo -> Flush 8.8.8.8 & 1.1.1.1"]

    CheckCD -->|"Cha: Kokubili Ukuhluleka noma Ukubuyisela IP Yokupaka"| CheckWhois{"Hlola Isimo Sesizinda Se-WHOIS EPP Nosuku Lokuphelelwa Isikhathi"}

    CheckWhois -->|"Isimo: iklayentiBamba noma isevaBamba"| HoldState["Isibhalisi / Ukumiswa Kwesibhalisi: Qedela Ukuqinisekiswa Kwe-imeyili kwe-ICANN RAA NOMA Ukuhlukumeza/Ithikithi Lokukhokhisa Ngokushesha"]

    CheckWhois -->|"Idethi yokuphelelwa yisikhathi (Isimo: autoRenewPeriod)"| GraceRenew["Usuku 1 kuya ku-45 Ngemuva Kokuphelelwa yisikhathi: Khokha Ukuvuselelwa Okujwayelekile Kuphothali Yokubhalisa -> Qinisekisa I-NS Yangokwezifiso Ibuyiselwe"]

    CheckWhois -->|"Isimo: redemptionPeriod (RGP)"| RgpRestore["Usuku 45 kuya ku-75 Ngemva Kokuphelelwa yisikhathi: Vula Ithikithi Lokusekela Lokubhalisa Okuphuthumayo / Khokha Imali Yokubuyisela I-RGP ($80-$250) Ngokushesha"]

    CheckWhois -->|"Isimo: kusalindileSusa"| PendingDel["Ukhiye Wokugcina Wezinsuku Eziyi-5: Ngeke Uvuselelwe Kwaregistrar -> Beka I-Backorders Kuwo Wonke Ama-Drop-Catchers Amakhulu Manje"]

    CheckWhois -->|"Isimo: kulungile / iklayentiTransferProhibited FUTHI Iphelelwa Isikhathi Ngokuzayo"| AuthDown["Ukubhaliswa Kwesizinda Kunempilo -> Ukucisha Umhlinzeki We-DNS Egunyaziwe noma Indawo engekho"]

    AuthDown --> MigrateNS["Ngenisa Ifayela Lendawo (`BIND` / Terraform) Kumhlinzeki Wesibili we-DNS -> Susa Irekhodi le-DS uma i-DNSSEC Ivuliwe -> Buyekeza i-NS kuMbhalisi"]

Isigaba 1: I-ICANN Domain Expiration Lifecycle (Auto-Renew vs. Redemption vs. Pending Delete)¶

Lapho isizinda sezinga eliphezulu esijwayelekile (gTLD njenge .com, .net, .org, .io, .ai, .co, .app, .dev) iphelelwa yisikhathi ngoba ikhadi lesikweletu lokuvuselela ngokuzenzakalela lihlulekile noma ikhadi lezezimali likhanselwe ngemva kokuthi isisebenzi sihambile, isizinda sidlula umjikelezo oqinile wezigaba eziningi obuswa Inqubomgomo Yokubuyiswa Kokubhaliswa Okuphelelwe yisikhathi ye-ICANN (ERRP) kanye nezivumelwano zomsebenzisi wokubhalisa (Verisign okwe .com/.net, PIR okwe .org, Identity Digital).

Ukuthi isizinda sifa kanjani nokuthi kungani singaxhunyiwe ku-inthanethi NGAPHAMBI noma NGOSUKU 1 lokuphelelwa yisikhathi¶

+-------------------------------------------------------------------------+
| ICANN gTLD EXPIRATION TIMELINE (.com / .net / .org example)             |
|                                                                         |
| [Active Domain]                                                         |
|       |                                                                 |
|       v  (Expiration Date Reached: Day 0)                               |
| +---------------------------------------------------------------------+ |
| | STAGE 1: Auto-Renew Grace Period (Day 1 to Day 30-45)               | |
| | - EPP Status: ok or clientHold (Registrar swaps your NS to parking) | |
| | - Production Impact: 100% OFFLINE within 0 to 48 hours of expiry    | |
| | - Recovery: Log into registrar & pay normal renewal ($10-$30).      | |
| +---------------------------------------------------------------------+ |
|       |  (Registrar sends Delete command to Registry at Day 30-45)      |
|       v                                                                 |
| +---------------------------------------------------------------------+ |
| | STAGE 2: Redemption Grace Period [RGP] (Exactly 30 Calendar Days)   | |
| | - EPP Status: redemptionPeriod (Domain removed from TLD Root Zone)  | |
| | - Recovery: Still 100% guaranteed to original owner, MUST pay       | |
| |   Registry RGP Redemption Fee ($80-$250) + renewal via registrar.   | |
| +---------------------------------------------------------------------+ |
|       |  (30-Day RGP expires without redemption payment)                |
|       v                                                                 |
| +---------------------------------------------------------------------+ |
| | STAGE 3: Pending Delete (Exactly 5 Calendar Days)                   | |
| | - EPP Status: pendingDelete                                         | |
| | - Recovery: IMPOSSIBLE to renew or redeem at any price. Registry    | |
| |   rejects all registrar commands until public drop at Day 5 (~18:00 | |
| |   UTC for Verisign .com/.net).                                      | |
| +---------------------------------------------------------------------+ |
+-------------------------------------------------------------------------+

Qhathanisa amalungelo akho aqondile, izindleko, kanye nezenzo zokuthola kabusha kuzo zonke izigaba zokuphelelwa yisikhathi, okuhlanganisa nezizinda zezinga eliphezulu lezwe (ikhodi yezwe)ccTLDs njenge .uk, .de, .eu, .ca, .au), ezingalandeli*** i-ICANN gTLD imithetho:

Isigaba sesi-2: Ukubuyiselwa kwesinyathelo ngesinyathelo kokuphelelwe yisikhathi noma RedemptionPeriod isizinda¶

Landela lokhu chungechunge olunembile ukuze ubuyisele isizinda esiphelelwe yisikhathi ku-inthanethi ngesikhathi esifushane ngangokunokwenzeka:

Isinyathelo 1: Thola futhi ukufinyelela ku-Akhawunti yakho Yokubhalisa uma @yourdomain.com i-imeyili ifile¶

Nansi i-Catch-22 yakudala yesizinda esiphelelwe yisikhathi: - Isizinda sakho (company.com) iphelelwe yisikhathi, kanjalo MX amarekhodi we company.com yeka ukuxazulula. - Uzama ukungena kumbhalisi wesizinda sakho (GoDaddy, Namecheap, Cloudflare, Porkbun, Hover, Network Solutions, Gandi), futhi umbhalisi uthi: "Sithumele ikhodi yokuqinisekisa enezinhlamvu ezingu-6 ku admin@company.com." - Ngoba company.com iphelelwe yisikhathi, leyo imeyili ayikwazi ukufika.

Ungaphuma kanjani ku-loop ye-imeyili yesizinda esiphelelwe yisikhathi ngokushesha: 1. Ungadlulisi noma uguqule noma yini okwamanje: hlola ukuthi ungakwazi yini ukuphenya isibambi semeyili esiphuthumayo KUPHELA uma isizinda singaphelelwa yisikhathi (uma isizinda ngokwaso siphelelwe yisikhathi ezingeni le-TLD, MX ayikwazi ukuxazulula noma yikuphi kuze kube yilapho ivuselelwa). 2. Sebenzisa Isiteshi Sokubuyisela I-akhawunti "Yokutholwa Kwe-imeyili Elahlekile / Isizinda Siphelelwe Isikhathi": - Cishe bonke ababhalisi abagunyazwe yi-ICANN bahlinzeka ngocingo oluzinikele noma i-ID kahulumeni / ukugeleza komsebenzi wokuqinisekisa idokhumenti yenkampani eqondiswe ngqo kumakhasimende ama-imeyili awo okungena ngemvume ahlala @ isizinda esiphelelwe yisikhathi ngaphakathi kwe-akhawunti. - Iba nezinto ezintathu ezilungile ngaphambi kokufonela usekelo lobhalisi: (a) izinombolo zokugcina ezingu-4 zekhadi lesikweletu noma i-ID yokwenziwe ye-PayPal esetshenziswe ku-invoyisi yokuvuselela yangaphambilini, (b) I-ID yakho ye-Akhawunti Yokubhalisa / Iphinikhodi yeKhasimende, kanye © ne-ID yesithombe sikahulumeni + Imibhalo Yenhlangano / Ibhilikhithi yezinsiza* efana neNhlangano Ye-WHOISTech / Admin / Registrant). 3. Uma usungenile, shintsha ngokushesha ikheli lakho le-imeyili le-Akhawunti Yokubhalisa libe isizinda sangaphandle (@gmail.com, @proton.me, noma isizinda esiphuthumayo esihlukile osiphethe) bese uvula Ukhiye Wokuvikela Wezingxenyekazi zekhompyutha (FIDO2) noma TOTP Authenticator App MFA ngakho-ke ukungena akunciki @company.com i-imeyili futhi.

Isinyathelo sesi-2: Yenza Ukuvuselela noma RedemptionPeriod (RGP) Buyisela¶

1. Uma isizinda siseSigabeni 1 (Auto-Renew Grace Period, Izinsuku 1 kuya ku-30/45):
2. Iya kokuthi Inkokhelo -> Ukuvuselela noma Uhlu Lwesizinda -> Isihlungi Esiphelelwe Isikhathi bese ukhokha i-invoyisi yokuvuselela.
3. Hlola Okubalulekile imizuzwana engama-60 ngemuva kokukhokha: Vula isizinda Nameservers (NS) izilungiselelo kudeshibhodi yesibhalisi. Hlola ukuthi umbhalisi uzibuyisele ngokuzenzakalelayo iziphakeli zakho zangempela (isibonelo, ns-123.awsdns-15.com noma ada.ns.cloudflare.com) noma ushiye isizinda sikhomba kumaseva aso okupaka aphelelwe yisikhathi (ns1.sedoparking.com / dns1.registrar-servers.com). Uma amaseva okupaka asasohlwini, faka kabusha ngokwenza amaseva akho okukhiqiza bese ulondoloza.
4. Uma isizinda siseSigabeni 2 (Redemption Grace Period / redemptionPeriod, Izinsuku 30/45 kuya ku-75):
5. Bheka kuthebhu ehlukile ngaphakathi kwedeshibhodi yakho yesibhalisi evame ukulebulwa ngokuthi Izizinda Eziphelelwe Isikhathi -> Ukuhlenga, Udoti / Buyisela, noma Inkokhelo Yomusa/Yokuhlenga.
6. Khokha imali yokubuyisela i-RGP + ukuvuselela unyaka ongu-1.
7. Ukubuyiselwa kwe-RGP kusebenza kanjani kuRegistry (Verisign / PIR)? Uma ukhokha imali ye-RGP, umbhalisi wakho uthumela i-EPP <update><restore op="request"> umyalo ku-TLD Registry. I-Registry ishintsha ngokushesha isimo sesizinda kusuka redemptionPeriod ku pendingRestore bese ibeka isizinda sakho NS irekhoda emuva ku-TLD Root Zone phakathi kwemizuzu eyi-15 kuya kwengama-60 ngenkathi umbhalisi wakho ehambisa restore op="report" ukuqinisekiswa kokuhambisana.

Isinyathelo sesi-3: Dlula ukubambezeleka kwenqolobane yendawo ye-ISP ngokuyihlanza 8.8.8.8 futhi 1.1.1.1¶

Lapho isizinda sakho siphelelwe yisikhathi, izixazululi ze-DNS eziphindaphindayo emhlabeni jikelele zigcine kunqolobane amaseva okupaka noma okunegethivu NXDOMAIN impendulo (ilawulwa yi-TLD's SOA Minimum TTL, ngokuvamile 900 ku 3,600 imizuzwana, noma 86,400 imizuzwana ye NS amarekhodi). Isikhathi dig @a.gtld-servers.net yourdomain.com NS (ebuza .com iseva yezimpande ngqo) ikhombisa ama-nameservers akho wangempela wokukhiqiza futhi: 1. Vula I-Google Public DNS Flush Cache (https://developers.google.com/speed/public-dns/cache): - Uhlobo lwe-flush NS kuqala for yourdomain.com, bese ushaya SOA, A, AAAA, MX, kanye TXT. 2. Vula Cloudflare 1.1.1.1 Hlanza Inqolobane (https://one.one.one.one/purge-cache/): - Hlanza NS, A, AAAA, kanye MX ngoba yourdomain.com.

Isigaba sesi-3: Iseva Yezimo Eziphuthumayo (NS) Ukufuduka Ngesikhathi Sokuphuma Komhlinzeki we-DNS (Futhi DNSSEC Ugibe)¶

Kuthiwani uma ukubhaliswa kwesizinda sakho kungamaphesenti angu-100 avumelekile futhi aphelelwe yisikhathi, kodwa Umhlinzeki wakho we-DNS ogunyaziwe (Route 53, Cloudflare, GoDaddy DNS, DigitalOcean DNS, Azure DNS, DNSimple, Dyn) ibhekene nokunqamuka okuyinhlekelele noma ukuhlaselwa kwe-DDoS, futhi udinga ukuthutha ama-Nameservers esizinda sakho (NS) kumhlinzeki we-DNS oyisipele khona manje?

Umbulali Wokufuduka ongu-#1: Ukushintsha NS Ngenkathi DNSSEC (DS Irekhodi) Inikwe amandla¶

Ngaphambi kokushintsha eyodwa NS rekhoda kusibhalisi sakho, sebenzisa lo myalo ukuze uhlole ukuthi DNSSEC inikwe amandla esizindeni sakho ekubhalisweni komzali kwe-TLD:

dig +short yourdomain.com DS @8.8.8.8

+-------------------------------------------------------------------------+
| WHY CHANGING NS RECORDS WITH AN ACTIVE DS RECORD BREAKS THE INTERNET    |
|                                                                         |
| 1. Parent TLD (.com) holds your old DNS provider's DS Record (Key #2371)|
| 2. Old DNS Provider goes down. You import zone to New DNS Provider      |
|    (unsigned, or signed with a brand-new Key #9910) and swap NS.        |
| 3. Validating Resolver (8.8.8.8 / 1.1.1.1 / Comcast / ISP) queries      |
|    New DNS Provider, sees signature does NOT match DS Key #2371.        |
| 4. Resolver assumes an active MITM Spoofing Attack -> Returns SERVFAIL  |
| 5. RESULT: Your domain stays 100% dead worldwide even though the new    |
|    DNS servers are up and answering cleanly.                            |
+-------------------------------------------------------------------------+

Uhlu Lokuhlola Lokufuduka Kwesimo Esiphuthumayo Esiphephile (Zero SERVFAIL Inqubo)¶

1. Yakha kabusha noma ngenisa ifayela lakho eliphelele le-DNS Zone kumhlinzeki omusha we-DNS kuqala:
2. Ungalokothi uqagele amarekhodi akho e-DNS enkumbulweni (@, www, futhi api akuvamile ukuba kube amarekhodi kuphela; ukukhohlwa MX, SPF/TXT, DKIM, _dmarc, autodiscover, noma CAA iphula ukulethwa kwe-imeyili kanye nokuvuselelwa kwe-TLS).
3. Ungayithola kuphi indawo yakho egcwele ye-DNS uma ideshibhodi yomhlinzeki wakho we-DNS eyinhloko iphansi:
   • Hlola Ingqalasizinda-njengekhodi (Terraform, Pulumi, OctoDNS, DNSControl) endaweni yakho yokugcina ye-Git.
   • Hlola ukuthunyelwa kwezoni kwakamuva (BIND .zone amafayela) noma sesha imininingwane yomlando ye-DNS (SecurityTrails, ViewDNS.info, DNSDumpster, noma Censys / crt.sh kwezizinda ezingaphansi).
   • Amarekhodi afakwe kunqolobane yombuzo asahlezi ngaphakathi kwezixazululi eziphindaphindayo zomphakathi (dig @8.8.8.8 yourdomain.com MX, dig @1.1.1.1 yourdomain.com TXT, dig @9.9.9.9 api.yourdomain.com A) ngaphambi kokuthi ama-TTL abo aphelelwe yisikhathi.
4. Qinisekisa ukuthi umhlinzeki omusha we-DNS uphendula ngokusemthethweni kuwo wonke amarekhodi abalulekile NGAPHAMBI kokuthinta umbhalisi wakho: Ake sithi umhlinzeki wakho omusha ukunikeze ns1.rescuedns.com futhi ns2.rescuedns.com. Zihlole ngqo nge dig:

   dig @ns1.rescuedns.com yourdomain.com SOA +norecurse
   dig @ns1.rescuedns.com yourdomain.com A +norecurse
   dig @ns1.rescuedns.com yourdomain.com MX +norecurse
   

   Linda kuze kube flags: umugqa ku dig unhlokweni uhlanganisa ngokusobala aa (Authoritative Answer) kanye nezimbuyiselo status: NOERROR.
5. Uma dig +short yourdomain.com DS ubuyile a DS irekhodi, isibambo DNSSEC kubhalisi:
6. Ngesikhathi sokucisha okusebenzayo lapho umhlinzeki we-DNS endala engafinyeleleki ngokuphelele: Ngena ku-Domain Registrar yakho (lapho uthenge khona isizinda), iya esigabeni DNSSEC / DS Records, futhi ususe konke DS amarekhodi ukuze isizinda sibuyele kokungasayiniwe (Insecure) imodi endaweni yomzali ye-TLD. Linda kuze kube dig +short yourdomain.com DS @a.gtld-servers.net ibuyisela ingenalutho (futhi i-flush DS phakathi 8.8.8.8 / 1.1.1.1), noma engeza entsha umhlinzeki we-DNS DS irekhodi elihambisana nendala uma wenza ukuthutha okuhleliwe kwababhali abaningi.
7. Buyekeza ama-Nameservers (NS) ku-Domain Registrar yakho: Faka esikhundleni amaseva afile ns1.rescuedns.com futhi ns2.rescuedns.com kuphaneli yombhalisi wakho ethi Custom Nameservers (inothi: iyashintsha NS amarekhodi ngaphakathi komhleli wendawo awenzi lutho uma amaseva amadala efile; kufanele uguqule Iglue/Amaseva Okuthunyelwe Komzali ezingeni Lokubhalisa).
8. ** Hlanza NS futhi DS izinqolobane ku-Google (8.8.8.8) kanye ne-Cloudflare (1.1.1.1)**: Sebenzisa amathuluzi wokuhlanza inqolobane yomphakathi kusukela esigabeni sesi-2 Isinyathelo sesi-3 ukuze uphoqelele ukwamukelwa ngokushesha kwamaseva amasha.

Isigaba 4: Ukusinda Kukhiye Wokudluliswa Kwesibhalisi Sezinsuku Ezingu-60 ngesikhathi sesimo esiphuthumayo¶

Kuthiwani uma udinga ukudlulisa isizinda sakho kubhalisi omusha (ICANN Inter-Registrar Transfer), kuphela ukuvinjwa ngu-Domain Status: clientTransferProhibited kanye nomlayezo othi: "Lesi sizinda singaphansi Kokhiye Wokudlulisa we-ICANN wezinsuku ezingu-60 ngoba ulwazi lokuxhumana lusanda kubuyekezwa"?

1. Kungani kuqaliswe ukukhiya kwezinsuku ezingu-60: Ngaphansi Kwenqubomgomo Yokudlulisa I-ICANN (Isigaba II.C.1), ababhalisi babeka ilokhi yokudlulisa yezinsuku ezingu-60 noma nini lapho isizinda sisanda kubhaliswa, sidluliswa phakathi kwababhalisile, noma singena "Ushintsho Lobhalisiwe" (ukubuyekeza Igama Lokuqala, Ikheli Lokubhalisa, Ikheli Lokubhalisa, Inhlangano Ye-imeyili).
2. Ungawudlula kanjani noma uphume kanjani kukhiye wezinsuku ezingama-60 Wokushintsha Obhalisiwe:
3. Ngaphambi kokuhlela imininingwane yokuxhumana ye-WHOIS: Cishe bonke ababhalisi abakhulu banikeza ibhokisi lokuthikha khona kanye esikrinini sokuhlela othintana naye esinelebuli: "Khetha ukuphuma ekukhiyweni kokudlulisa kwezinsuku ezingama-60 ngemva kwalesi sibuyekezo soxhumana naye." Ukuhlola lelo bhokisi kukuvumela ukuthi ubuyekeze ikheli lakho le-imeyili lomlawuli/obhalisiwe bese ukhiqiza i-imeyili. EPP Auth-Code (Transfer Secret) ukudlulisa isizinda ngalo lolo suku.
4. Khumbula ukuthi AWUdingi ukudlulisa ukubhaliswa kwesizinda ukuze ushintshe abahlinzeki be-DNS: Ngisho noma isizinda sikhiyiwe izinsuku ezingu-60 ngokumelene Nokudluliswa Kwerejista (clientTransferProhibited), usengakwazi ukushintsha Nameservers (NS amarekhodi) kubhalisi wamanje nganoma yisiphi isikhathi ngaphandle kwesikhathi sokulinda; ukushintsha i-DNS kuthatha amaminithi, kanti ukudluliselwa kombhalisi okugcwele kuthatha izinsuku ezi-5 kuye kweziyi-7 ngaphandle uma umbhalisi olahlekile echofoza ngokushesha Vumela Ukudluliselwa Okuphumayo (FOa) inkinobho.

Isigaba sesi-5: Ukwenza lukhuni ukubhaliswa kwesizinda kanye ne-DNS ngokumelene nokucisha okuzayo¶

Uma isizinda sakho nokulungiswa kwe-DNS sekubuyiselwe ngamaphesenti angu-100, qedela lolu hlu lokuhlola ukuqina:

• Vumela Registry Lock (serverDeleteProhibited, serverUpdateProhibited, serverTransferProhibited) ezizindeni zokukhiqiza ezibalulekile: Okujwayelekile Registrar Lock (clientTransferProhibited) ingashintshwa ngokuchofoza okukodwa uma umhlaseli entshontsha ukungena kwakho kombhalisi. I-Registry Lock (ihlinzekwa yi-Verisign, PIR, Cloudflare, CSC, MarkMonitor, Gandi, ne-Porkbun/Namecheap yezizinda zebhizinisi) ikhiya isizinda ngqo ezingeni le-TLD Registry, edinga ukuqinisekiswa kwezwi/i-cryptographic ngaphandle kwebhendi ngaphambi kwanoma yikuphi NS irekhodi lingashintshwa noma isizinda sisuswe.
• Vuselela izizinda zokukhiqiza iminyaka emi-5 kuye kweyi-10 kusengaphambili (ICANN maximum horizon is 10 years): Ungalokothi ushiye isizinda esibalulekile sebhizinisi ekuvuselelweni konyaka nonyaka lapho ikhadi lesikweletu lebhizinisi elilodwa eliphelelwe yisikhathi lingabangela ukuphela kwesikhathi. Khokha kusengaphambili iminyaka emi-5 kuya kweyi-10 ngesikhathi esisodwa.
• Ungalokothi usebenzise i @yourdomain.com ikheli le-imeyili njengoxhumana naye wokungena noma wesaziso sokukhokha kubhalisi ophethe yourdomain.com: Sebenzisa uhlu oluzinikele lokusabalalisa ukuvikeleka esizindeni esizimele sokuphatha noma i-akhawunti yangaphandle eqinile, bese uqapha RDAP / WHOIS izinsuku zokuphelelwa yisikhathi ngeziqaphi zangaphandle ze-Prometheus/Uptime (domain_expiry_days < 60).
• Ngaphansi NS futhi DS Ama-TTL (300 ku 3600 imizuzwana) Amahora angu-48 ngaphambi kwanoma yikuphi ukufuduka kwe-DNS okuhleliwe: Ukwehlisa ama-TTL kusengaphambili kuqinisekisa ukuthi izixazululi ziyashintsha phakathi kwemizuzu engu-5 yokusika okuhleliwe.

Izinombolo zezimo eziphuthumayo zesifunda kanye nezinqubomgomo ze-ejensi¶

Uma isizinda noma ukuphela kwe-DNS kuba nomthelela ezikhungweni zokunakekelwa kwempilo, izinsiza eziphuthumayo, izinsiza zikamasipala, noma ingqalasizinda kahulumeni, landela lezi ziteshi zokukhuphuka zesifunda:

• I-United States ne-Canada: Dayela 911 uma ukuphela kwesizinda/i-DNS kukhubaza i-telemetry yasesibhedlela yomtholampilo, ukuthunyelwa kwe-ambulensi, noma amasistimu okuphepha kwempilo. Bika ukuhlaselwa kwe-DDoS kungqalasizinda ye-DNS noma ukudunwa kwe-BGP/DNS ku-CISA (1-844-Say-CISA / cisa.gov/report), i-FBI IC3 (ic3.gov)**, noma Canadian Center for Cyber Security (1-833-CYBER-88). Ngoba .gov ezizindeni, xhumana ne-CISA .gov I-Registrar Helpdesk.
• United Kingdom: Dayela 999 ngezinsongo zokuphila noma ukuphazamiseka okukhulu kwe-NHS. Bika ukucisha kwe-DNS okubalulekile noma ukudunwa kwesizinda ku-NCSC (ncsc.gov.uk)**, bese uthintana no-Nominet (01865 332244) ngqo ngokuphuthumayo .uk / .gov.uk / .nhs.uk izinkinga zokubhalisa.
• I-European Union: Dayela 112 kuwo wonke amazwe angamalungu e-EU. Abahlinzeki besevisi ye-DNS kanye nokubhaliswa kwamagama we-TLD kulawulwa ngaphansi kwe- EU NIS2 Directive (Directive 2022/2555) futhi kufanele babike izigameko eziphawulekayo zokutholakala ku-CSIRT yabo kazwelonke phakathi namahora angu-24.
• I-Australia ne-New Zealand: Dayela 000 e-Australia noma 111 eNew Zealand; bika i-DNS ebalulekile noma izehlakalo zesizinda ku-*ACSC (1300 CYBER1)**, auDA (for .au), noma Ikhomishini Yegama Lesizinda NZ (ye .nz).
• I-India ne-Asia-Pacific: Dayela 112 eNdiya ukuze uthole impendulo ephuthumayo; bika i-DNS/ukuhlaselwa kwengqalasizinda yesizinda ku-CERT-In (incident@cert-in.org.in)* phakathi kwamahora angu-6 noma NIXI ukuze .in ukukhuphuka kokubhalisa.

Imibuzo evame ukubuzwa¶

Kungani isizinda sami siyekele ukusebenza amahora angu-24 NGAPHAMBI kwesitembu sesikhathi sokuphelelwa yisikhathi se-WHOIS?¶

Okokuqala, hlola izindawo zesikhathi: WHOIS `Registry Expiry Date` ihlala iphrintwa nge-**UTC (`Z`)**, okungamahora angu-4 kuya kwangu-8 ngaphambi kwezindawo zesikhathi zaseNyakatho Melika (okusho isizinda esiphelelwa yisikhathi ngo- `2026-11-01T04:00:00Z` empeleni iphelelwa yisikhathi ngo `8:00 PM PDT` ngo-Okthoba 31). Okwesibili, uma eyakho `NS` amarekhodi ayenayo a `24-hour` noma `48-hour` I-TTL kanye nombhalisi bawashintshanisa ngokuthi `00:00 UTC` ngosuku lokuphelelwa yisikhathi, abasebenzisi izixazululi zabo ezivuseleleke kusenesikhathi bangena ekhasini lokupaka ngokushesha kuyilapho abanye behlala kunqolobane amahora amaningi.

Umbhalisi wami akanalo nhlobo ibhizinisi noma akaphenduli (Dead / De-accredited Registrar), futhi isizinda sami siphelelwa yisikhathi. Ngiyihlenga kanjani?¶

Uma i-ICANN inqamula noma ihoxisa isibhalisi esihlulekayo ngaphansi kwe- **Inqubo Yokuguqula Isibhalisi Esingagunyaziwe (`DARTP`)**, i-ICANN idlulisela ngobuningi ngokuzenzakalelayo zonke izizinda iye kusibhalisi somgcini ozuzayo ngaphandle kwezindleko kwababhalisile. Hlola `whois yourdomain.com` (noma `lookup.icann.org`) ukuze ubone ukuthi iyiphi **Isibhalisi** kanye ne-**IANA ID** ephethe isizinda sakho njengamanje, noma thumela isikhalo esiphuthumayo **Sokuvuselela Isizinda / Isikhalazo Sokudlulisa** ngokuqondile **I-ICANN Contractual Compliance (`icann.org/compliance/complaint`)**.

Kungani iwebhusayithi yami isebenzela amakhasimende athile kudatha yeselula, kodwa isabonisa ikhasi lokupaka eliphelelwe yisikhathi ehhovisi lethu le-Wi-Fi amahora angu-6 ngemva kokuvuselela isizinda?¶

Inethiwekhi yehhovisi lakho noma isixazululi se-DNS se-ISP sendawo esiphindaphindayo sigcine kunqolobane ikhasi lokupaka lombhalisi `NS` futhi `A` amarekhodi ngenkathi isizinda siphelelwe yisikhathi, futhi amaseva okupaka adume ngokubeka ama-TTL aphezulu (`3,600` ku `86,400` imizuzwana / amahora angu-24) ukuze amakhasi ezikhangiso ahlale kunqolobane isikhathi eside. Sula i-Google (`8.8.8.8`) kanye ne-Cloudflare (`1.1.1.1`) besebenzisa amathuluzi abo okuhlanza iwebhu, bese kuba kukhompyutha yakho yangakini qalisa `ipconfig /flushdns` (IWindows), `sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder` (macOS), noma `sudo resolvectl flush-caches` (Linux).

Kwenzekani Kuma-imeyili Athunyelwe Kuwo @yourdomain.com Ngenkathi Isizinda Sethu noma i-DNS Isiphelelwe Isikhathi Amahora ayi-18? Ingabe Balahlekile Phakade?¶

Ezimweni eziningi, ama-imeyili asemthethweni athunyelwe phakathi namahora okuqala angu-12 kuya kwangu-48 okuphela kwe-DNS AKULAHLEKILE: abekwe kulayini kuseva yemeyili yomthumeli futhi azofika ngokuzenzakalelayo emahoreni ambalwa alandelayo.. Ngaphansi **`RFC 5321` (I-Simple Mail Transfer Protocol, Isigaba 4.5.4.1)**, lapho iseva yokuthumela i-imeyili (`Gmail`, `Microsoft Exchange Online`, `Postfix`) ithola ukwehluleka kwesikhashana kokubheka i-DNS (`SERVFAIL`) noma ayikwazi ukuxhuma ku- `MX` umsingathi, ubeka umlayezo emugqeni wokuzama futhi izinsuku ezingu-*4 kuya kwezingu-5 (`96 to 120 hours`)**, iyazama futhi ngokubuyela emuva komchazi. Nokho, uma ikhasi lokupaka lombhalisi eliphelelwe yisikhathi lihlanganisa **ikhadi lasendle elingenalutho `MX` irekhodi (`0 .`)** noma iseva yemeyili yokupaka enqabe i-imeyili nge-hard `550 5.1.1 User Unknown` ukubhampa unomphela, labo bathumeli bathole isaziso esisheshayo futhi kufanele baphinde bathumele ama-imeyili abo.

Ngingakwazi ukusetha abahlinzeki be-DNS ababili ngesikhathi esisodwa (Cloudflare + Route 53) ngokumane ubhale ama-Cloudflare amabili NS amarekhodi kanye noMzila amabili wama-53 NS amarekhodi kubhalisi wami?¶

Yebo, inqobo nje `DNSSEC` ivaliwe (noma ilungiselelwe kahle nge `RFC 8901` I-Multi-Signer DNSSEC) futhi bobabili abahlinzeki banikeza amarekhodi e-DNS afanayo. Izixazululi eziphindaphindayo zibuza bonke abazali abasohlwini `NS` amarekhodi asebenzisa ukukhetha kwe-round-robin/RTT (`SRTT`). Uma uhlu `ns1.providerA.com`, `ns2.providerA.com`, `ns1.providerB.com`, futhi `ns2.providerB.com` kuma-Nameservers Angokwezifiso zombhalisi wakho futhi ugcine zombili izindawo zivunyelanisiwe kusetshenziswa **OctoDNS**, **DNSControl**, **Terraform**, noma `AXFR / IXFR` ukudluliswa kwendawo, isizinda sakho sisinda ngokuzenzakalela ekunqanyulweni kwamaphesenti angu-100 kunoma yimuphi umhlinzeki we-DNS.

Uyini umehluko phakathi clientHold futhi serverHold ku-WANI?¶

Amakhodi esimo se-EPP aqala ngokuthi **`client...`** (`clientHold`, `clientTransferProhibited`) zisethwa **Umbhalisi Wesizinda** sakho (umthengisi lapho uphatha khona i-akhawunti yakho, njenge-Namecheap noma i-GoDaddy) futhi angasuswa ngokushesha ngosekelo lombhalisi wakho noma uhlelo lokukhokha. Amakhodi esimo aqala ngokuthi **`server...`** (`serverHold`, `serverTransferProhibited`) zisethwa ngokuqondile yi- **TLD Registry Operator** (`Verisign`, `PIR`, `Nominet`) ngenxa yemiyalo yenkantolo, izingxabano ze-UDRP, ukumiswa kokuhlukumeza ezingeni lokubhalisa, noma izingxenyekazi zekhompuyutha **Ikhiya Yokubhalisa**, futhi idinga ukuthinta Isibhalisi ngombhalisi wakho ukuze uphakamise.

Iziqondiso ezihlobene¶

• Ukudunwa kwegama lesizinda, i-DNS ephelelwe yisikhathi, nokuthathwa kwewebhusayithi
• Isitifiketi se-SSL/TLS siphelelwe yisikhathi ekukhiqizweni, ukuvala ukulayisha kuqala kwe-HSTS, ibhulokhi yerekhodi ye-CA CAA, nokuvuselelwa kwezimo eziphuthumayo
• I-Google Workspace noma i-Microsoft 365 ngokwezifiso yomqondisi wesizinda, ukuqinisekiswa kwe-DNS TXT, nokuhlenga abaqashi
• Ukudunwa kwe-DNS, ukulungiswa kabusha kwerutha ye-ISP i-WAN, kanye ne-captive portal spoofing
• Inkinga yokuba usokhaya wewebhu, ukufuduka, nokubuyisela ikhophi yasenqolobaneni
• Izinombolo zesimo esiphuthumayo ngezwe

Imithombo neziqondiso ezisemthethweni¶

• I-Internet Corporation Yamagama Nezinombolo Ezinikeziwe (ICANN): Inqubomgomo Yokubuyisela Ukubhalisa Ephelelwe yisikhathi (ERRP), Inqubomgomo Yokusulwa Kwesizinda Esiphelelwe Isikhathi (EDDP), Inqubomgomo Yokudluliswa Kwe-Inter-Registrar (Izinsuku Ezingama-60 Zokushintshwa Kokhiye Wokubhalisa), kanye Nereferensi Yekhodi Yesimo Se-EPP (clientHold, redemptionPeriod, pendingDelete).
• I-Internet Engineering Task Force (IETF): RFC 6781 (Imikhuba Yokusebenza ye-DNSSEC: Ama-Rollovers Abalulekile kanye Nezimo Eziphuthumayo DS Ukususwa) & RFC 8901 (Amamodeli e-DNSSEC e-Multi-Signer ye-Multi-Provider Authoritative DNS).
• Isikhungo Sikazwelonke Samazinga Nobuchwepheshe (NIST) (United States): Ukushicilelwa Okukhethekile 800-81-2: Isistimu Yegama Lesizinda Esivikelekile (DNS) Umhlahlandlela Wokuthumela.
• I-Cybersecurity and Infrastructure Security Agency (CISA) (United States): Isiyalezo Esiphuthumayo 19-01: Ukunciphisa Ukuphazamisa Kwengqalasizinda ye-DNS.
• I-European Union Agency for Cybersecurity (ENISA): I-NIS2 Isiqondiso Sobuchwepheshe Sabahlinzeki Besevisi be-DNS kanye Nerejista Yegama le-TLD.