Hacker News Reader

Comment by ghshephard | Hacker News Reader

I have a small number of domains (about 15 at last check) - and most of them have a mailing address from 16 years ago. If all they verify is email, why does this process have any value? It's not like you can't (A) Spin up a random mail server in 30 minutes, or (B) save yourself the trouble and just use mailinator.

This, finally, is the most pure form of security theater I have ever seen. There is no possible argument that this would deter any bad actor from doing bad things with their DNS domain - totally useless policy.

View on HN

It is indeed useless, but it's much more involved than just contacting you the once: registrars are required to contact you at least yearly and after any contact updates, and if your mailserver isn't up and running, and you don't confirm the details, you'll end up with the suspended domains.

It sucks, and I'm saying that as somebody who works for a registrar.

I've been getting those notes from registrars for 5+ years (at least) - I treat them as spam. I've never had a registrar suspend a domain.

You'll notice in the article they say this policy was only enacted by ICANN 5 years ago, and hasn't even taken into effect for EasyDNS yet.

i.e. Just because it hasn't happened yet, doesn't mean it won't now.

Sure - I'm just saying that other registrars do send those emails out, with threatening sounding words about how I have to fill in my contact information. I ignore it. They've never done anything.

My registrar interprets not responding to the email as "those details are fine"

So it treats them as password reset emails...

You're thinking of WDRP emails.

The WAP emails you'll be receiving are something different, and you will be required to respond. If the email bounces, or if you don't confirm the email within 15 days, you risk your domain being suspended.

You can read the spec here: https://www.icann.org/resources/pages/approved-with-specs-20...

You can't ignore the WAP emails. You have to affirm that the details are correct.

If you'd like to read the specification, it's here: https://www.icann.org/resources/pages/approved-with-specs-20...

Nope. This policy, WAP (WHOIS accuracy program), was enacted as part of the 2013 ICANN RAA. ghshephard is thinking of WDRP (WHOIS data reminder policy) emails, which came in as part of the 2003 RAA. The new policy, is independet of the WDRP.

You're wrong. What you've been seeing are WDRP emails. Those you can ignore. WAP is something completely different: you must follow the instructions outlined in the email, or your domain will be suspended.

It's funny you mention spinning up a new email server, I've had to do that for a domain I stopped using about 5 years ago, but had used for almost a decade at one point... you'd be surprised how easy it is to miss changing an account/email address.

Of course that was within a year or so of taking down the old domain, and haven't had issue since... just the same, it's interesting how painful an option can be at times.

It has value to you. What are you going to do when you get a default judgement against you and get your domain(s) transferred away from you because you decided to be cute and put 123 Elm St. for your address, preventing service of process?

The only thing I've ever got to a mailing address related to a domain registration is junk mail from a registrar trying to scare you into renewing with them. That was from Melbourne IT back about 15 years ago (for a .com.au domain).

The comment I was referring to was that sentence about working with LEAs to ensure accuracy.

If I really have concerns about losing a domain in a legal process, (I'm a corporation, or ongoing business) - I would use the services of a domain name portfolio management company, like MarkMonitor. https://www.markmonitor.com/services/domain-management.php

MM doesn't appear to protect you against attempted trademark-infringement claims.

Trademark/Intellectual property claims, in both directions, are one area of MM speciality.

Domain Services

As a full-service, corporate registrar, MarkMonitor offers a complete range of domain services:

.Brand Registrar Services Trademark Clearinghouse Services Registrations, renewals and transfers Domain recovery, snapping and masking Enterprise DNS UDRP administrative services Local presence Domain locking Mission-critical domain security, including Two Factor Authentication SSL certificates

Check out https://www.markmonitor.com/solutions/role_based_solutions-l... for some of the services they offer.

As far as I can tell, they only deal with trademark assertion, not defense.

The point is to ensure they can contact you. Same reason websites have email confirm links, basically.

Yes, but the point the OP is making is that it is a worthless guarantee. You can just use a throw-away email. And given the target audience, this is should not even be considered a significant barrier.

I presume it's attempting (badly) to deal with website owners who aren't contactable by mistake, not those who actively wish to be uncontactable.

Disabling their domains seems like a pretty heavy-handed way of dealing with owners who can't be contacted due to an honest mistake.

I mean, geez, a false positive from a spam filter can cause you to lose your domain!

Domains are suspended, not deleted from the registry.

OK... so a false positive from a spam filter can make your site go down for as long as it take to straighten out the mess. That's not a whole lot better.

Still better than having to pay redemption fees.

Well, blame the law-enforcement agencies: they're the ones that forced ICANN's hand on this. The registrars, particularly the European ones, fought back, and the policy is nowhere near as bad as it once was going to be.

However, even before now, you could easily lose your domain due to a missed email. For instance, if you don't have your domain on autorenew, it can end up in redemption (which is expensive), and eventually deleted. And, as of the 2013 RAA, if you don't renew your domain, your registrar is required to park the domain with a non-renewal notice a few days after its expiration date.

Fun, eh?

A throwaway email address would be a bad idea, as you periodically have to confirm the address works.

But if they're able to contact you then the exercise was pointless and if they're NOT able contact you they disable your domain. How does that help anyone?

Assume that the purpose of this exercise is to ensure there's some way to deliver a court order, subpoena or other law enforcement notice to a domain owner. In that context, this is going to ensure either (a) there's at least an e-mail on file that reaches the current owner, or (b) the domain can't be used for any illegal purpose, so the issue is moot. It's not a perfect system, but it'll probably do the job in 99%+ of cases.

Except that I would never want my name/email associated with a domain name - spam central. My registrar has my contact information when it comes to renewal, or to contact me for an issue, but the domain names all have dummy values.

Get WHOIS privacy from your registrar.

If you've provided invalid contact information on the domain, you're in breach of the TOS, as ICANN requires that domains have accurate contact data on them.

That's ostensibly why the system is good for lawyers and law enforcement. It seems like it's only bad for domain owners.

And I really question how useful it is for even the purpose you outlined. Considering that a) your registrar could easily be subpoenaed for this information if there's a genuine need and b) Anyone who has the tech savvy to register a domain with plans to do something illegal with it surely also realizes they can register a free email under a bogus name.

Disabling your domain is an effective (though unreasonably heavy-handed) way to contact you, and to force you to provide contact info if you care about the domain.

Reply on news.ycombinator.com