Nominet Maintenance Reminder

I was thinking something similar as a solution but you risk legally running a lottery which you would need a licence for

 

Not sure of the legalities but I was thinking more of a raffle which is probably covered under lottery rules?

 

Whatever happens. Nominets new system is probably not going to block the current exploit. It is probably something to do with DNS. Randomisation of create requests is as far as I can see, the only way to truly stop all past and future exploits.

 

From the DNS perspective a suspended domain does not exist.
dig @nsa.nic.uk bix.co.uk returns no NS
Maybe it returns NS just before it drops?

I just tried updating one of my domains and there was a 30+ seconds delay in seeing that through dig

 

@webber what RTT do you get for domain:check? Mine is ~103ms

I'm just going through my logs and can see some varying RTTs for EPP hello, eg:

Code:

2021-01-15 21:34:32.760442 [HELLO] EPP 1 RTT=43.5062ms
2021-01-15 21:34:32.764047 [HELLO] EPP 2 RTT=3.5722ms
2021-01-15 21:34:32.807995 [HELLO] EPP 3 RTT=43.9239ms

 

Ben has documented the method he uses to Nominet and the fix is due to be rolled out on March 2nd.

 

I complained to Nominet around a year ago that domain:check has an artificial 100ms delay added, as it wasn't documented or complied with the EPP specification. They refused to acknowledge that they were adding the delay, which is similar to the Delay DAC and whois (the latter is also not documented).

 

Interesting, so if i'm seeing ~103ms for domain:check, that would indicate my RTT is about 3ms.
My hello RTTs are 3/40/40 and domain:info 40, so there could be a delay being added somewhere (load balancer?).

 

If you're accessing the DNS firstly don't use dig. It is not written for speed. Secondly access the nominet dns directly to make your query by connecting to port 53 on dns1.nic.uk, dns2.nic.uk, and the other dns servers. You need to write your own connection software as the header structure needs to be put together. As you say though there is no difference between a suspended domain and a non-existent domain. There can be a spike in a lookup speed though if the data is not being returned from nominet's cache but has had to do a lookup because a domain status has changed (in theory anyway). I never found anything near reliable enough. If you're not using nominet to do the lookup you're at the mercy of whatever cache lies between you and there.

 

Earlier in this post, I implied that Denys Ostashko was the coward who sent an anonymous email designed to cause trouble between Ben Hay and myself. I was wrong and I owe Denys an apology, I shouldn't have jumped to conclusions without asking for his side first.