5 ms·

I have gotten registrars to change domain records for domains over the phone without having to prove who I am. Definitely vet your registrars and registers very

I have gotten registrars to change domain records for domains over the phone without having to prove who I am. Definitely vet your registrars and registers very carefully, they do not all operate by the same rules.

wizeman 6y ago
Can you recommend one that isn't easily persuaded to change domain records without securely verifying the customer's id? It's almost impossible to vet registrars or registries, as this information isn't easily available.
- peterwwillis 6y ago
  I'm afraid I don't have a list of good ones, only bad ones. The easiest way to vet them is to call them and ask them what their policies are, then test them (for legal reasons, against your own test domains would be best...). See whether you can find documentation about their policies online. If you can't find them: potential red flag. If you can find them but it doesn't seem thorough/very secure: red flag. If they don't seem to deal with international customers: potential red flag. If they don't support TOTP or U2F, or you can't disable SMS validation: red flag. If their password policies suck: red flag (just create a free account and see what it lets you use). If they don't do both registry & registry lock for your TLD, or won't explain how the process works for that TLD: run away. Often they may document their online process for doing things like registry lock. Call them up and say you are a potential customer and you want to know what you can do over the phone, then ask them what you need to provide in order to do each thing. They're not going to try to hide anything from you, so they may tell you if (for example) all they need to know is your full name, e-mail address, and what domain you want to unlock. They'll also tell you if they only send EPP codes over e-mail or their web interface, or if they have a way to record customer support requests (like a special verification code for phone support, select lists of people who can administrate the account, etc). Of course, it's up to each customer service rep to actually follow the Registrar's rules. It just takes one lazy SOB to skip all the steps and just do whatever you ask to ruin everything. So you might also ask to talk to whomever manages the support reps and find out more about them, like how much training they receive and how much oversight is done over each support call. You'll probably have to settle for correspondence over a ticketing system. Registries you'll probably have to e-mail for their rules, or ask a Registrar. Some registries can be unnecessarily cloak-and-dagger about their policies, but some registrars don't care and will tell you anyway. Personally, I would stay away from the Registries that require two weeks of paperwork just to change WHOIS information.

wizeman 6y ago

Can you recommend one that isn't easily persuaded to change domain records without securely verifying the customer's id? It's almost impossible to vet registrars or registries, as this information isn't easily available.

peterwwillis 6y ago
I'm afraid I don't have a list of good ones, only bad ones. The easiest way to vet them is to call them and ask them what their policies are, then test them (for legal reasons, against your own test domains would be best...). See whether you can find documentation about their policies online. If you can't find them: potential red flag. If you can find them but it doesn't seem thorough/very secure: red flag. If they don't seem to deal with international customers: potential red flag. If they don't support TOTP or U2F, or you can't disable SMS validation: red flag. If their password policies suck: red flag (just create a free account and see what it lets you use). If they don't do both registry & registry lock for your TLD, or won't explain how the process works for that TLD: run away. Often they may document their online process for doing things like registry lock. Call them up and say you are a potential customer and you want to know what you can do over the phone, then ask them what you need to provide in order to do each thing. They're not going to try to hide anything from you, so they may tell you if (for example) all they need to know is your full name, e-mail address, and what domain you want to unlock. They'll also tell you if they only send EPP codes over e-mail or their web interface, or if they have a way to record customer support requests (like a special verification code for phone support, select lists of people who can administrate the account, etc). Of course, it's up to each customer service rep to actually follow the Registrar's rules. It just takes one lazy SOB to skip all the steps and just do whatever you ask to ruin everything. So you might also ask to talk to whomever manages the support reps and find out more about them, like how much training they receive and how much oversight is done over each support call. You'll probably have to settle for correspondence over a ticketing system. Registries you'll probably have to e-mail for their rules, or ask a Registrar. Some registries can be unnecessarily cloak-and-dagger about their policies, but some registrars don't care and will tell you anyway. Personally, I would stay away from the Registries that require two weeks of paperwork just to change WHOIS information.