How to know if a domain belongs to a person or not?

Question

We're almost done on creating a hosted CMS solution (something like Weebly). We offer people to create a website with 3 different options:

1. If they don't have a domain yet, they can create a sub-domain
2. If they don't have a domain yet, but they don't want to have a sub-domain either, they can buy their own domain (we're a re-seller of a big registrar)
3. If they have a domain already which has been registered by another registrar, we want to offer a feature, so that they can use that domain with our CMS.
4. If they have multiple domains, they can park'em on the same CMS instance, so that they can see their websites with many domains.

However, they should follow some steps, so that their domain name would be resolved to our servers. For example, one step is that they should change their name servers info.

But a business requirement has been posed by the stakeholders and product owner, and that is, we want to get sure that people are true owners of the domains registered by other registrars. In other words, when a user wants to add another domain to his/her CMS instance (parking a new domain) and this newly added domain is not registered by us, we want to get sure that the domain really belongs to him/her.

What options and solutions do we have? How can we get sure that Bob for example is the owner of second-domain.com domain, when he's parking this domain on his CMS (which is already accessible via first-domain.com?

Answer 1

I think this may be a bad business decision. There is no automatic way to determine that a specific person/entity actually owns a domain. A lot of them are 'private' registrations which purposesly hide ownership details in a whois search. I think that they can set the dns entries for the domain should be sufficient to prove they are the domain's administrators. If you start making them jump through hoops to prove the domain, you'll scare away a lot of potential customers.

And dont forget, depending on the nature of the sites you host, the person signing up may not own the domain. They may be administering it for a friend or client, licensing it, whatever.

Edit: if setting the dns isnt enough, how about requiring that they respond to an email sent to the domain - say using an email address they specify in signup. Its not a guarantee of anything, of course, and may just mean a customer's email was hacked. And it prevents people with parked domains from using your service. But it may be about the best you can do in a semi-automated fashion. Those that cant be verified by the email are then manually researched.

Answer 2

Google apps for business do validate with one of the followings:

• Validate by an entry on the domain name server (CNAME or TXT) containing a verification code
• Ask the user to upload a verification html page on the web root containing verification code
• Add a meta tag to a webpage containing the verification code

Answer 3

To answer the following question

How can we get sure that Bob for example is the owner of second-domain.com domain

you first have to determine what do you mean with owner. In fact, there can be several explanations, depending on what you want the owner to be able to do.

Let me clarify. Technically speaking, a domain can have a technical contact, an admin-c (which is the legal owner), a billing contact and a registrant. Usually, what you need to check is whether the person have administrative power on the domain. It doesn't need to be necessary the owner, in fact in the case of a Company it's likely the CEO or the real owner is not the person that technically manages the domain and it's not the one that will point the domain to your CMS.

A possible solution, that is the same Google applies to validate the ownership of a domain, is to ask the user to add a DNS TXT record. If the user has the ability to change domain DNS, it means he has the full control of the domain.

You might want to do the same. Create an unique token, ask the user to add it as a TXT record and validate it.