On Fri, Nov 12, 2021 at 1:29 PM Stephane Bortzmeyer <bortzmeyer@nic.fr> wrote:
On Thu, Nov 11, 2021 at 09:44:04PM +0000, [..] It depends on where you are (from my resolver, I get 64.130.197.11). This is because the name voyager.viser.net is not stable yet. Depending on your resolver, it points to 64.130.200.16 - which seems to give correct answers - or to 208.91.197.132 - which replies even for nonexisting domain names. [..]
So yes, then.. A DNS Hijack by NetSol redirecting the hostname on an expired SLD related to one of the individual nameserver hosts to a faulty/non-compliant nameserver of NetSol's that then publishes bogus RRs for domains that registrar have no authority over. That means instead of the 1 nameserver failing; the entire domain breaks, even if there are multiple nameservers listed, and only 1 had been accidentally allowed to expire. DNSSEC would help here. NetSol's rogue nameserver wouldn't be able to produce the signed zone if validation were required. -- -JH