15

I recently set a server up on Digital Ocean. The process of pointing the domain to Digital Ocean name servers was as easy as updating them on the registrar's website, and just adding them to my server.

How did Digital Ocean verify I owned the domain I was adding to my server? Couldn't anyone do this? Could another customer have added my domain to their Digital Ocean account before I got around to it?

19

Couldn't anyone do this?

You are missing one factor. Domain name registration and hosting are two different things even if your host will register your domain for you. A domain name has to be registered and pointed to an IP address before the domain name does anything.

The hosting company does not generally care about the domain name registration except to sell you domain name registration to help you.

Let's assume for a moment you registered your domain name with GoDaddy and bought your hosting from Digital Ocean.

Digital Ocean would give you an IP address to your server. With GoDaddy, you would associate your domain name with that IP address. These are two separate processes. Even if you bought your domain name from Digital Ocean, the processes are still separated.

So if the question is, Could someone simply purchase hosting without a domain name and simply put a domain name in their hosting DNS server?, the answer is No. When a domain name is registered, the domain name has to appear in a TLD domain name server. For example, example.com would have to be registered in the .com TLD domain name server and SOA (statement of authority) records added. Simply placing a domain name in the hosting DNS does not do this.

How did DO verify I owned the domain I was adding to my server?

Again, hosting providers do not care if you own a domain name or not. The reason why is simple. The website you create will not work without properly registering a domain name. As well, it is not uncommon that the one who owns a domain name is not the one who is running the site itself. Separation between a domain name and host is a necessity. For example, when I was a web host, MARS candy owned the domain name, paid a hosting company to host the site, and then paid another to develop and maintain the site.

If you registered your domain name when you signed up for Digital Ocean, then they simply registered your domain name for you and set it up for you to work with their hosting. It is that simple.

  • 3
    Could any customer of your hosting company see that you registered a new domain and add it to their own hosting account before you did? Then when you point the IP address to your hosting company's servers, you aren't the one that controls the content. Or to put it another way, if I'm a web host how do I verify that the person who adds a domain to their account actually owns the domain? If I don't do verification, how would I resolve conflicts and disputes? – Stephen Ostermiller Nov 11 at 11:23
  • @StephenOstermiller: Step 1: Tell MyHost I own MyDomain.com. Step 2: MyHost.com will either respond ("err, please provide it (e.g., using a TXT record) or will respond, "OK, point at IP X.X.X.X". Step 3: I point MyDomain.com at X.X.X.X, knowing that MyHost promises it is my server . So, this gives MyHost two ways to deal with domain disputes: A) Just use a different IP. Whoever actually owns the domain will point to the right one or B) Require verification. Notice that in this sequence of events, I set MyDomain.com's DNS to point to MyHost after MyHost confirms I have control. – Brian Nov 11 at 14:56
  • @StephenOstermiller: All that being said, there are a few edge conditions were this scheme fails. Examples include ACME TLS-SNI-01 and Domain Fronting. – Brian Nov 11 at 15:01
  • 2
    @Brian the step of "OK, point it IP X.X.X.X" could be problematic on shared hosting. Most hosting companies don't implement any sort of DNS verification of ownership. They usually trust that the first person to add a domain to an account on that server is the owner. I could imagine that there could be circumstances in which another customer could show their content on your domain by adding your domain to their account. Either by doing so first before you have a chance to do so, or by social engineering the hosting company support. – Stephen Ostermiller Nov 11 at 15:05
  • 1
    @StephenOstermiller: If two customers register the same domain, the hosting company will either A) Require verification or B) Will assign the two customers different IPs. The host retains a unique list of domain/IP address pairs. If the host tells me "Point to MyDomain.com to IP X.X.X.X", then my account is the only account which will serve traffic when that traffic arrives at X.X.X.X with MyDomain.com in the SNI header. – Brian Nov 11 at 15:08
7

Sure, anyone could do this, but what would they get from it? Attaching the domain to the server doesn't give you any kind of access or ownership of the servers.

You could point thedomainyouown.com at Google's IPs, but all you get from it is costs and no benefit.. thus it generally makes little sense to point your nameservers at anything else but your own servers, so people generally don't do it.

There are a few situations where it is actually necessary to point your domain to servers you do not own.. like white-label payment services. In a case like that, you point a subdomain that you own (e.g. cash.thedomainyouown.com) at a server owned by the payment provider, and when their servers see a request coming in with your domain name on it, they know to present the user with the payment page for your company.. and the user doesn't notice that you've delegated that service to another company unless they dig in deeper (e.g. verifying IP ownership). These white-label use cases wouldn't work if you had to prove server or IP ownership to set DNS records.

  • 3
    When someone points his domain example.org to your server, it depends on the web server configuration, if http://example.org/ will show anything or give an error message. But http*s*://example.org/ should always result in a certificate error. (Mail server configuration is yet another thing.) – Dubu Nov 11 at 13:54
2

How did Digital Ocean verify I owned the domain I was adding to my server? Couldn't anyone do this? Could another customer have added my domain to their Digital Ocean account before I got around to it?

Since none of the other answers have mentioned it: you probably had to tell your server which domain names to expect, but that does not actually cause those domain names to go there.

When you visit http://example.org/ in a web browser, your browser looks up the IP address of example.org. Then it contacts that IP address, and says "Hi, I'm looking for example.org. Please send me your home page."

Depending on the server configuration, the server might care about what domain the browser tells it, or it might not. If the browser said "Hi, I'm looking for asdjhashsdfsfgdfgdg.org. Please send me your home page." then the server will either send back the homepage for example.org (if it doesn't care) or it will send an error page saying "sorry, I don't know what site that is." If your server does care, then it needs to know what your domain is.

It's done this way so that you can use the same IP address for more than one domain, and still have different web pages on every domain. If you have more than one domain pointing to the same IP address, then the server does need to know which domains you have, so it can send the right page.

1

Simple answer: They don't know, and they don't care, To make your website work, you need to point your domain to your droplet which you only can if you are the owner of that domain. If other person adds your domain on DO then they won't be able to point your domain to their droplet.

1

I think in general hosting providers don't verify that you actually own a domain before letting you instruct them and their nameservers to point it at your server or website. I've been able to do it at a hosting provider in the past. In most cases this is harmless, because either the owner of the domain set it up first (in which case your hosting provider won't accept another entry for the same domain), or they set it up on a different hosting provider (in which case nobody will ask yours for the site anyway).

This can cause problems, however, if you set up a domain you don't really own, and then the real owner of the domain later tries to bring it over to the provider you are using. I once got a phone call from a hosting provider complaining that I had entered someone else's domain into my account, and that now (many years later) that person was trying to switch over to the hosting provider and wasn't able to set up their domain properly because of it.

So in my experience the problems that result from this are handled by humans on a case-by-case basis. To actually claim enough domains to have a high probability of hitting one that was likely to be registered or transferred in, you'd have to add so many domains that you would raise other red flags.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.