1

So long story short: for a long time I've had domain (basic website + G-Suite email) for an LLC (let's say example.com) that I used to use for freelance gigs. I stopped doing much freelance stuff since I became employed by a company around 2 years ago. Still, I wanted to keep the domain, but idiot me forgot to renew the domain earlier this year and the domain expired and stopped existing.

Somehow my email with Google continued working as normal and I got no warnings AT ALL from Google about the underlying domain... I imagine perhaps because the domain wasn't snapped/kidnapped up by a reseller or any new owner to reset the DNS records?

Anyhow, as soon as I realized my domain had expired, I went to a new/different registrar (Cloudflare) and re-registered it ASAP. I setup the following DNS records (real domain name and IP redacted):

cloudflare-DNS-records

Now comes the weirdness:

  1. When I go to mysidehustle.com, I see the html page I'm expecting... BUT the page has an SSL certificate that I did NOT create or install. It's for the bare domain, and any subdomains (*/wildcard), and it's issued by Google Trust Services LLC. WTH?? I get that Cloudflare is proxying the domain, but why, how/where is it getting a Google SSL cert?!?
  2. When I log into G-Suite/Workspace Domain admin area, I don't have many options as the domain just shows OK/active and "Verified" and the only thing I can do is "set up a redirect for www" and "Add Users".
  3. Right now I am getting mail for the domain, and everything is working as normal (I think)

My question is what and why does #1 above happen?

Improve this question
9
  • 1
    It would be useful if you provided us with the actual domain - its difficult to grasp what you are saying. For a start, if you don't renew a domain name, all services associated with it - including email - will stop working - so what you say makes little sense. It might be useful for us to look at what DNS ACTUALLY thinks of your domain.
    – davidgo
    Aug 7 at 6:13
  • 2
    Im not willing to play 100 questions on your domain ( and trying to keep public info private is an anaethma to me) - but I have had a thought - could the presenting problem relate to browser caching?
    – davidgo
    Aug 8 at 20:06
  • 1
    It sounds like your DNS setup is not how you think it is. You should do a "whois" query to get the authorative nameservers, then do a dig query to get the A records referencing the authorative nameservers. Unless you use Linux I need to leave this as an excercise to you. (In Linux you can simply do whois mysidehussle.com to find the nameservers and other info, then pick a DNS server and do a dig @name.server sidehustle.com A to get the IP address. I expect the nameservers wont be Cloudflares ones and your problem flows from there.
    – davidgo
    Aug 9 at 2:21
  • 2
    CloudFlare uses several Certificate Authorities with Google Trust Services being one of. DNS servers cached the MX record, so when you transferred the domain to CloudFlare, your MX record was picked up by CloudFlare. There would have been no interruption in mail delivery providing you maintained a Workspace account and quite a bit more time after expiration didn't occur. So, everything is as it should be.
    – dan ♦
    Aug 10 at 1:45
  • 1
    @dan thank you! I think you're right on the money! Cloudflare apparently does use GoogleTrustServices! Never would have imagined that. PS: I'll give you the answer if you post it below :)
    – unknownprotocol
    Aug 10 at 10:18

1 Answer 1

Reset to default
2

The answer to this riddle turn out to be silly and trivial, for posterity:

Like Dan commented: CloudFlare uses several Certificate Authorities with Google Trust Services being one of. DNS servers cached the MX record, so when the domain was transferred to CloudFlare, the MX record was picked up by CloudFlare. There would have been no interruption in mail delivery provided one maintained a Workspace account and quite a bit more time after expiration didn't occur. So, everything is as it should

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.