On Thu, Nov 11, 2021 at 01:36:58PM -0800, Jeff Shultz <jeffshultz@sctcweb.com> wrote a message of 122 lines which said:

Never mind, looks like an expired domain issue. Someone didn't remind someone else.

To avoid such a problem: * some registries allow for multi-year registration, * some registrars allow for multi-year registration, and/or automatic renewal, so you no longer have to think of it, * automatic entries in your agenda software is nice, too :-) * automatic monitoring of expiration (through whois or, better, RDAP, later is an example of a Nagios/Icinga/whatever plugin using RDAP). % /usr/local/lib/nagios/plugins/check_expire -H 2dpnr.org 2dpnr.org OK: expires in 497 days, 13:36:22.602780.

Yeah, apparently when a domain expires, a lot of DNS queries to domains in that domain's DNS server... get redirected to a Network Solutions "this is expired" website at that IP. Even though those domains are perfectly legit and paid up. Or so it was explained to me and how it appeared. Anything I could say about my opinion of that might be actionable, or at least inflammatory, so I'll stop now. The original problem has been corrected. On Thu, Nov 11, 2021 at 1:40 PM Stephane Bortzmeyer <bortzmeyer@nic.fr> wrote:

On Thu, Nov 11, 2021 at 01:28:07PM -0800, Jeff Shultz <jeffshultz@sctcweb.com> wrote a message of 105 lines which said:

...

I hit my registrar, DirectNic, and found I'm good through 2023. They pulled up DNS checker and found that a bunch of DNS servers were showing 208.91.197.132 as the IP for the domain. It's actually in 64.130.197.x .

I'm wondering if I was the only one?

No, you're not. Half of the RIPE Atlas probes see the wrong address:

% blaeu-resolve -r 100 --type A 2dpnr.org [64.130.197.11] : 59 occurrences [208.91.197.132] : 41 occurrences Test #33310635 done at 2021-11-11T21:38:30Z

-- Jeff Shultz -- Like us on Social Media for News, Promotions, and other information!!    <https://www.facebook.com/SCTCWEB/>      <https://www.instagram.com/sctc_sctc/>      <https://www.yelp.com/biz/sctc-stayton-3>      <https://www.youtube.com/c/sctcvideos> _**** This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. E-mail transmission cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. The sender therefore does not accept liability for any errors or omissions in the contents of this message, which arise as a result of e-mail transmission. ****_

On Fri, Nov 12, 2021 at 5:55 AM William Herrin <bill@herrin.us> wrote:

On Thu, Nov 11, 2021 at 6:36 PM Jeff Shultz <jeffshultz@sctcweb.com> wrote:

...

Yeah, apparently when a domain expires, a lot of DNS queries to domains

in that domain's DNS server... get redirected to a Network Solutions "this is expired" website at that IP.

...

Even though those domains are perfectly legit and paid up. Or so it was explained to me and how it appeared.

Hi Jeff,

Do you mean that there's a delay between when you're recorded as having paid up and when everything is correct throughout the DNS system? Yes, there is. Your domain expired, you corrected the problem, but then there was an unexpected (by you) delay before the interloping name resolution was gone?

If you meant something else, I'd like to hear a better description of the problem. If not... well of course: that's how the DNS works. There's propagation delay imposed by TTLs and refresh intervals before old data is discarded. There are a handful of scenarios (e.g. old-school browser pinning) where stale data can persist for months. Don't let the domain expire before you renew it. Really don't.

I suspect it's more a case of domain foo.com provides DNS service for several other domains, including bar.com. bar.com is fully paid up. foo.com doesn't get paid up on time; expires, but is quickly re-claimed and paid up again. queries for bar.com suddenly show up as "this domain is available" due to foo.com (which provides DNS for bar.com) having briefly gone into the expired state. Users of bar.com are (rightly) confused, as bar.com was never in a jeopardy state. We'll see if Jeff confirms my suspicion of what happened in this case. ^_^; Matt

On 11/12/21 8:33 AM, Jeff Shultz wrote:

I still think that this is not the correct way for NetSol to handle this situation, particularly since the pages they put up look like phishbait designed by Austin Powers.

I didn't see the page, but for what it's worth, this is governed by this ICANN policy: https://www.icann.org/resources/pages/errp-2013-02-28-en Particularly 2.2.4: "In interrupting the DNS resolution path of the registration, if the registrar directs web traffic to the domain name to a web page while the registration is still renewable by the RAE, that web page must conspicuously indicate that the domain name registration is expired and provide renewal instructions." If it didn't meet that requirement, you could complain to ICANN about it. (You're also more generally right that what Network Solutions is doing here is horrible. Decent registrars don't redirect traffic: they simply set the domain name to clientHold so that it doesn't appear in the DNS at all, because otherwise they're breaking your stuff -- and what's worse, breaking it in a way that may take some time to recover from even after you renew the domain name, due to DNS caching.) -- Robert L Mathews

On Fri, Nov 12, 2021 at 11:30 AM Stephane Bortzmeyer <bortzmeyer@nic.fr> wrote:

On Thu, Nov 11, 2021 at 09:44:04PM +0000, Richard <lists-nanog@listmail.innovate.net> wrote a message of 37 lines which said:

...

The second of these is returning the 208.nnn IPnumber for your a-record:

dig @VOYAGER.VISER.NET 2dpnr.org

2dpnr.org. 300 IN A 208.91.197.132

It depends on where you are (from my resolver, I get 64.130.197.11). This is because the name voyager.viser.net is not stable yet. Depending on your resolver, it points to 64.130.200.16 - which seems to give correct answers - or to 208.91.197.132 - which replies even for nonexisting domain names.

Lesson: don't use a name as an argument to dig's @

I think 208.91.197.132 (Network Solution's domain bucket) needs to go in everyone's troubleshooting notebook as a sign there is an expired domain somewhere affecting whatever you have going wrong. -- Jeff Shultz -- Like us on Social Media for News, Promotions, and other information!!    <https://www.facebook.com/SCTCWEB/>      <https://www.instagram.com/sctc_sctc/>      <https://www.yelp.com/biz/sctc-stayton-3>      <https://www.youtube.com/c/sctcvideos> _**** This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. E-mail transmission cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. The sender therefore does not accept liability for any errors or omissions in the contents of this message, which arise as a result of e-mail transmission. ****_

DNSSEC would help here. NetSol's rogue nameserver wouldn't be able to produce the signed zone if validation were required.

Nope, they could just remove the DS since they are the registrar for that domain. DNSSEC only protects against a DNS provider going rogue, not your own hired registrar. Rubens

On Fri, Nov 12, 2021 at 03:13:57PM -0800, William Herrin <bill@herrin.us> wrote a message of 24 lines which said:

To my mind, though, Netsol's server should not be responding with authoritative answers to random domains that aren't assigned to it. That it does makes me think it's a good candidate for black-holing in the routing system.

To my mind, I simply don't understand why some people continue to use Network Solutions, with the track record they have.