Question

What prevents another user from using my domain name?

Posted on June 11, 2017
DNS
Asked by vangelis4cbbe0fa134228d02a

Hello there!

My domain name correctly points to my droplet ( following https://www.digitalocean.com/community/tutorials/how-to-set-up-a-host-name-with-digitalocean ). I’m using GODADDY for my domain name.

So, I just added ns{1-3}.digitalocean.com at GODADDY and then I set up my domain name in the Networking tab.

The question is what prevents another DigitalOcean user from using my domain name?

In my mind I didn’t do any other authentication between DigitalOcean and GODADDY, I just added the nameservers. With that in mind, in the Networking tab in DigitalOcean I can add any hostname that has ns{1-3}.digitalocean.com in their whois, whether it belongs to me or not.

I think I’m wrong but I don’t know why.

Show comments

Submit an answer

This textbox defaults to using Markdown to format your answer.

You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

Matt Nordhoff • June 11, 2017

Accepted Answer

You’re correct. There are two key things.

Only one user can add a zone to the DO DNS control panel. Now that you’ve added your domain, no one else can. And you can’t gain control of the DNS for other people’s domains unless they’ve deleted the domain from the DO control panel while leaving it pointed to the DO nameservers at their registrar.
The assumption that, if someone else had added your domain under their account before you did, well, you wouldn’t choose to go to your registrar and give that person control of your DNS. That would be silly. You’d use a different DNS host, or contact DigitalOcean to complain.

Some DNS providers solve this problem by using a large number of different nameservers. For example, if you created a zone, and DigitalOcean told you to use ns792.digitalocean.com and ns481.digitalocean.com, but the domain was already using ns515.digitalocean.com and ns289.digitalocean.com and you were unable to change it, it would be obvious you didn’t control the domain.

Other DNS providers, like DigitalOcean, trust their users to behave responsibly. (While knowing that users don’t always do so.)

Edit: Additionally, while you or i or anyone can add any domain like google.com in the DNS control panel, it doesn’t matter because Google is not going to go to their registrar and change the domain to point at the DO nameservers. It doesn’t matter if you’re hosting a fake service if no one knows to use it.