Hacker News Reader

Comment by djbusby | Hacker News Reader

One thing that sucks when moving registrar is that some (Namecheap, Porkbun, Enom/Tucows) doesn't let you set DNS entries before migration. Move reg, updated NS and then add entries.

So, my process now is to put DNS service OUTSIDE the registrar - so that switching one doesn't have to impact the others.

Why these providers don't let me create the NS Zone before transfer confounds me.

View on HN

Porkbun definitely lets you do that, they allow you to add an "external" domain which runs on their DNS (actually Cloudflare) but isn't registered through them, then you can seamlessly transfer the domain in to Porkbun later.

IIRC Spaceship (Namecheaps soft-relaunch) lets you set up your DNS records as soon as you initiate a transfer to them, before it completes, so the records are ready as soon as the nameservers switch over. Not sure about the original Namecheap, I haven't used them for a while.

They shouldn't publish a zone for a domain they don't control (yet). Regardless of who whois says manages the domain, if I were to query the new registrar's servers they could theoretically send people somewhere else than what was intended with the currently published zone information.

I don't want them to publish, I just want to create them before migration. Other registrar's had it for a while and Namecheap for sure still don't (maybe their new UI but they lost me years ago)

DNS is hierarchical so as long as the root servers point elsewhere it doesn't matter what they publish and once the root servers are updated then the new servers are the authoritive ones.

If that was the case, DNS based adblocking wouldn't work, except for gigantic /etc/hosts files.

WTF are you talking about. DNS-based adblocking doesn't work by pulling records from random servers.

I point my computer to use a local DNS server, I ask it to resolve an ad domain... the request doesn't go out to the root servers, it gets RPZ denied at the DNS server. The root doesn't mean anything if the local DNS server claims to know the answer to your query. The same goes for a registrar's DNS server that is publishing zones it doesn't own.

That still doesn't involve pulling records from random servers like registrar's DNS server for domains they are not yet authorative for.

No, it doesn't, because nobody is configuring systems to query that registrar's DNS server for zones it doesn't own.

What you are describing is a forwarding DNS query resolver, which can be configured to directly answer queries without forwarding them upstream in the DNS hierarchy. This is sometimes used for ad-blocking, but the archetypical example is the DNS resolvers your ISP usually provides. Their purpose is to forward your queries to the nameserver responsible for the zone you ask about.

Domain registrars, however, usually do not operate forwarding DNS resolvers. They typically only answer queries for zones that they are responsible for, and give you an NXDOMAIN response for anything else. For this reason, nobody would use a non-forwarding DNS as a resolver for their computer since it would make it near impossible to reach hosts on the Internet (unless you happen to query a record for one of the zones they provide service for).

Reply on news.ycombinator.com