DNS (Domain Name System) is a fundamental component of the internet that translates human-readable domain names (e.g., www.example.com) into numerical IP addresses (e.g., 192.0.2.1) that computers and servers use to communicate. 

When a user enters a domain name in a web browser, the browser sends a DNS query to a DNS resolver, which then contacts authoritative DNS servers to find the corresponding IP address for the domain. The resolver caches this information to expedite future queries.

DNSSEC (Domain Name System Security Extensions)

DNSSEC (Domain Name System Security Extensions) was created to enhance DNS security. While DNS efficiently directs users to the right websites, it lacks built-in mechanisms to ensure data integrity and authenticity. 

DNSSEC addresses this vulnerability by adding cryptographic signatures to DNS data, creating a chain of trust from the domain’s records to the root zone. 

Enabling DNSSEC prevents DNS-related attacks like DNS cache poisoning and DNS spoofing, allowing users to trust that the DNS responses they receive are genuine and have not been tampered with by malicious actors.

How DNSSEC Works

Let us start by explaining how DNSSEC (Domain Name System Security Extensions) works in simple terms:

1. Understanding DNS: The Domain Name System (DNS) is like a phonebook for the internet. When you type a domain name (e.g., example.com) into your web browser, the DNS translates it into the corresponding IP address (e.g., 192.0.2.1), allowing your device to connect to the correct server.
2. Vulnerabilities in DNS: Traditional DNS is susceptible to vulnerabilities, such as DNS spoofing or DNS cache poisoning. These attacks can redirect users to malicious websites without any indication, leading to potential data theft or other security breaches.
3. Introducing DNSSEC: DNSSEC is a set of security extensions designed to add an extra layer of protection to the DNS. It uses cryptographic signatures to verify the authenticity and integrity of DNS data, ensuring that users reach the correct website and not an imposter.
4. Signing DNS Records: With DNSSEC enabled, the DNS records of a domain are digitally signed by the domain owner’s private key. These signatures get added to the DNS records results when using a DNSSEC-aware resolver.
5. Validation of DNS Data: When a user’s device (e.g., computer or smartphone) tries to access a website, the DNS resolver (usually provided by the Internet Service Provider or set by the user, like Google Public DNS) checks the DNSSEC signatures on the domain’s records. If the signatures are invalid, the request gets marked SERVFAIL, and the resolver does not return an IP.
6. Chain of Trust: The DNS resolver then verifies the chain of trust from the domain’s DNS records all the way up to the root zone of the DNS. If all signatures are valid and the chain of trust is intact, the resolver knows that the DNS data is authentic. If the chain of trust is invalid, the request gets marked SERVFAIL, and the resolver does not return an IP.

Benefits of DNSSEC:

• Data Integrity: DNSSEC ensures that the DNS data remains unaltered during transit. Users can trust that they are accessing the correct website and not redirected to a fraudulent site.
• Authentication: DNSSEC verifies the authenticity of the DNS data, making it more difficult for attackers to impersonate a website.
• Trustworthiness: By implementing DNSSEC, domain owners demonstrate their commitment to internet security, increasing user confidence in their website.

Potential Negative Side Effects:

• Complex Implementation: Configuring DNSSEC can be a technical challenge and is not commonly used. If improperly configured, it may lead to misconfigurations and DNS resolution issues.
• Increased Packet Size: DNSSEC adds extra data to DNS responses, increasing the size of DNS packets. In some edge cases, this may cause DNS responses to exceed the maximum allowed size, leading to potential problems.
• Impact on Performance: DNSSEC introduces additional cryptographic computations during DNS resolution, which can cause a slight increase in DNS lookup times.

Overall, GreenGeeks believes that DNSSEC is a valuable security measure to protect against DNS attacks. 

DNSSEC implementation requires careful attention and consideration of potential side effects to ensure a consistent and secure browsing experience for users. 

If you have any concerns or questions about enabling DNSSEC for your domain on our GreenGeeks hosting platform, our Support Team will gladly assist you.

Verify DNSSEC Status

Verifying that DNSSEC is working for your domain involves performing a series of checks to ensure that DNSSEC signatures are in place, the chain of trust is valid, and DNSSEC validation is functioning correctly. 

Check Domain DNSSEC Status:

• • Use an online DNSSEC checker tool or a DNS lookup tool that supports DNSSEC validation such as DNS Viz & DNSSEC Analyzer
  • Enter your domain name and check if the DNSSEC status shows as “Secure” or “Insecure.” 
  • A “Secure” status means DNSSEC is implemented, and a “Not Secure”, “Insecure” or “No DS records found” indicates DNSSEC is not enabled on that domain.

Check DS Record at Parent Zone:

• • The DS records link your domain’s public key to the parent zone’s DNSKEY records, establishing the chain of trust.
  • Your domain’s DS (Delegation Signer) records get published in the parent zone (e.g., the .com parent zone for domain example.com). 
  • Use an online DNSSEC checker or DNS lookup tool to check if the DS records got configured in the parent zone. 

DNSSEC Chain of Trust:

• • DNSSEC operates based on a chain of trust from the root zone to the domain’s DNSKEY records. Validate the chain of trust using an online DNSSEC validation tool or DNSSEC-aware resolver. 
  • Be sure the DNSSEC validation passes verification & the chain of trust is complete.

Check DNSSEC Signature RRSIG Records:

• • RRSIG records contain the cryptographic signatures for DNSSEC-signed DNS records. 
  • Verify your RRSIG (Resource Record Signature) records using a DNS lookup tool. Ensure that the RRSIG records are present and correspond to the respective DNS records.

Test DNSSEC Validation:

• • Use a DNSSEC-aware resolver or a tool like “dig” (domain information groper) with DNSSEC validation enabled to resolve your domain. 
  • The DNSSEC-aware resolver should validate DNSSEC signatures and provide a successful or SERVFAIL response.

It’s important to note that DNSSEC might take time to propagate across the network, and DNS caches at various levels may also impact the immediate visibility of DNSSEC changes. 

After making any DNSSEC changes, allow some time for the changes to take effect and propagate throughout the global DNS infrastructure before re-verifying DNSSEC on your domain.

DNSSEC Client Support

Most clients, like web browsers, do not check DNSSEC status by default.  There are plugins and extensions that offer this functionality, but this will only impact the browser and not the entire system.

By using a DNSSEC-supported resolver, clients can enjoy the additional security benefits provided by DNSSEC without the need for complex configurations, as public DNS resolvers that support DNSSEC validation handle the cryptographic verification process transparently.

Here are some step-by-step directions for enabling DNSSEC on a device using a public DNS Resolver:

1. Identify Public DNS Resolvers with DNSSEC Support:
   • Identify public DNS resolvers that support DNSSEC validation.
     Popular options include Google Public DNS (8.8.8.8 and 8.8.4.4) and Cloudflare DNS (1.1.1.1 and 1.0.0.1).
2. Access Network Settings on the Client Device:
   • On the client device (e.g., computer, smartphone, or tablet), access the network settings.
   • The process for accessing network settings may vary based on the device’s operating system (e.g., Windows, macOS, iOS, Android).
3. Locate the DNS Resolver Settings:
   • Find the DNS resolver settings within the network settings. This is where you can specify the DNS server addresses used by that device for DNS resolution.
4. Change the DNS Resolver Settings:
   • Replace the existing DNS server addresses with the IP addresses of the public DNS resolvers that support DNSSEC.
   • For example, if you choose Google Public DNS, remove the existing servers & use 8.8.8.8 and 8.8.4.4 as the new DNS server addresses.
5. Save and Apply Changes:
   • Save the changes to the DNS resolver settings.
   • Depending on the device, you might need to click “Apply,” “Save,” or “OK” to confirm the changes.
6. Restart the DNS Resolver (Optional):
   • In some cases, restarting the DNS device may be necessary to ensure the new settings take effect immediately.
7. Verify DNSSEC Support:
   • After changing the DNS resolver settings, you can verify DNSSEC support by visiting websites that have enabled DNSSEC.
   • When using a DNSSEC-aware public resolver, it will validate DNS responses and only return trusted DNSSEC-signed data.
   • Test your DNSSEC support by visiting domains with a known-broken DNSSEC config such as:  https://www.rhybar.cz/ & http://www.dnssec-failed.org/
     • You should NOT be able to access these domains when using a DNSSEC-enabled resolver.

Enabling DNSSEC on the client device enhances DNS security by ensuring the authenticity and integrity of DNS data received from DNSSEC-enabled domains.

If you encounter any issues or have concerns about DNSSEC for your GreenGeeks-hosted domain, please open a Support Request Ticket from within your GreenGeeks Dashboard – Support – Open Ticket.

The post Understanding DNS Security Extensions (DNSSEC) appeared first on GreenGeeks Support.

As of January 1, 2014, the Internet Corporation for Assigned Names and Numbers (ICANN) has mandated that all ICANN accredited registrars begin verifying the WHOIS contact information for all new domain registrations and Registrant contact modifications.

The purpose is to ensure the information the registrant provides is accurate and up-to-date to ensure the registrant can be reached in the event of an issue with the domain.

This means that all new domain registrations will require ICANN verification within 2 weeks of registration. The same rule applies to updating the registrant information address on an existing domain.

GreenGeeks has no control over this process. Should a domain verification fail, only ICANN has the ability to override your DNS records and serve the domain verification pending page.

DNS Update Chart

To help illustrate the process we have included the following flow chart:

How do I verify my domain?

Open the email from the registry, review the information is accurate, and click the link contained in the middle of the message that says “Click here to verify your email address.”

Subject: IMMEDIATE VERIFICATION required for <DOMAIN.COM>
Sender: donotreply@name-services.com

What happens if I don’t verify my domain within two-weeks?

The domain will be suspended by ICANN & point to the verification page, indicating that the domain is suspended, as shown in the image below.

How do I unlock a suspended domain?

After your domain has been suspended by ICANN, pending WHOIS verification, it will remain suspended until the verification process is complete or the registrant email is updated. Updating the registrant email will completely restart the verification process & unsuspend the domain.

The WHOIS verification email can be resent by visiting the suspended domain page in your web browser, or GreenGeeks Support can resend it on your behalf.

After 60 minutes, if you still have not received the verification email, double-check the registrant email address is correct for that particular domain from within your GreenGeeks dashboard.

Reach out to the GreenGeeks Support Team for additional assistance with your domain.

Additional Information

GreenGeeks ICANN 2014 Changes – https://www.greengeeks.ca/support/article/icann-raa-2013-changes/

GreenGeeks Blog Post – https://www.greengeeks.com/blog/recent-icann-changes-how-they-affect-you/

ICANN Registrar Agreement – https://www.icann.org/resources/pages/approved-with-specs-2013-09-17-en

WHOIS Accuracy Program – https://www.icann.org/resources/pages/approved-with-specs-2013-09-17-en#whois-accuracy

The post ICANN – WHOIS Accuracy Program appeared first on GreenGeeks Support.

If you prefer to use name servers on your own domain (like ns1.ggexample.com), you can set the default name servers in WebHost Manager (WHM).

To be used as a name server, a domain must first be registered as a name server using an IP address.   You can find the GreenGeeks nameserver IPs in the Private Nameserver support article.

If you registered the domain name that you want to use for private name servers through GreenGeeks, this article will show you how to register the domain as a name server.

Log in to GreenGeeks.

In the navigation, click “Domains” then “My Domains.”

Click the “Manage” button for the domain you are working with.

Click the “Domain Nameservers” tab.

Scroll down to the “Nameserver Registration” section and click the “New Item” button.

• Enter ns1 in the first box, and the “Nameserver 1 IP address” from the private nameserver article into the second field.
• Click the “Save” link.

• Enter ns2 in the first box, and the “Nameserver 2 IP address” from the private nameserver article into the second field.
• Click the “Save” link.

Like any DNS changes, these may take several hours to propagate. You can ping the new ns entries to determine when they have propagated.

Once the name servers have propagated, you can use your new private name servers as the default name servers in WebHost Manager (WHM).

The post Registering Private Nameservers for Domains Registered Through GreenGeeks appeared first on GreenGeeks Support.

Category one
A natural person who is a United States citizen, a permanent resident of the United States of America or any of its possessions or territories, or whose primary place of domicile is in the United States of America or any of its possessions.

Category two
A United States entity or organization that is incorporated within one of the 50 U.S. states, the District of Columbia, or any of the United States possessions or territories or organized, or otherwise constituted under the laws of a state of the United States of America, the District of Columbia or any of its possessions or (including a federal, state, or local government of the United States, or a political subdivision thereof, and unincorporated organizations based in the United States).

Category three
An entity or organization (including a federal, state, or local government of the United States, or a political subdivision thereof) that has a bona fide presence in the United States of America or any of its possessions or territories.

• If a foreign entity, the applicant must state the country of citizenship.
• Regularly sells goods in the United States; regularly provides services in the United States; regularly engages in business activities, trade or other business (commercial or non-commercial including not-for-profit) relations in the United States.
• Maintains an office or other property within the United States.

The registry operator conducts weekly random checks for .US requirements.  They select a small sample of new registrations and send the selected registrants a confirmation email. Each selected registrant has 30 days to respond to the confirmation email. If the registrant fails to respond, the registry operator will attempt a second contact. If there is no response to the second contact, the registry operator will delete the domain name. The registry operator does not refund registration fees for deleted names.

The post Requirements for Registering A .US Domain appeared first on GreenGeeks Support.

The post 2013 ICANN Changes appeared first on GreenGeeks Support.

Auto-Renew Grace Period
For about 29 days* after the expiration date, your domain name can be renewed at standard rates. In order to renew your domain during this period, call or open a ticket with our billing department. Once the renewal payment is processed, your domain name will be reactivated. You may experience a period of 1-48 hours for DNS propagation.

Redemption Grace Period
29 days* after the expiration date, your domain will enter the Redemption Grace Period, which typically lasts 30 days*. When a domain enters the Redemption Grace Period it is being managed by ICANN/Enom and it is removed from the zone file, so the website and email will stop working. GreenGeeks no longer has control of a domain in the Redemption Grace Period. In order to renew the domain during this period, the fees are $80 plus the cost of the domain renewal.

When a domain name expires, the website may display an advertising page set by ICANN/Enom. GreenGeeks does not control and cannot change that page. The domain’s expiration date may also be extended. That does not mean the domain is active. The name servers may also change to dns1.name-services.com, dns2.name-services.com, etc.

RGP Stage 3
After about 30 days* in the Redemption Grace Period, the domain name will be deleted. Once deleted the domain name may be available for registration at standard rates. However, while it is in the Redemption Grace Period your domain name may be listed for auction, and if it is sold, you will not be able to re-register it. Also, many domain buying companies employ automated systems that make it difficult for the original owner to regain an expired domain.

For those reasons, if you want to be sure to retain an expired domain, we strongly recommend paying the Redemption Period fees. We understand that the redemption fees are high, but the companies that buy expired domains will likely ask for much more to sell the name back to you than you would have paid in redemption fees. Again, GreenGeeks does not benefit from or share in the redemption fees. Our recommendation is made strictly in the interest of helping you keep your domain name.

*Note that the time frames for some domain extensions are different than those stated in this article. You can contact our support team for details on your domain extension.

General domain expiration timeline from ICANN:

The post My Domain Has Expired, What Should I Do? appeared first on GreenGeeks Support.

Can I renew my domain early?
For information on early domain renewal, please contact a member of our Billing Staff by opening a ticket in GreenGeeks.

What happens if my domain expires?
You can read about the expiration process in the article; My Domain Has Expired, What Should I Do?

How do I cancel my domain name?
If you want to cancel your domain name and prevent it from renewing, please contact a member of our Billing Staff by opening a ticket in GreenGeeks. Domain registrations, transfers, and renewals are non-refundable.

The post How Do I Renew My Domain Name? appeared first on GreenGeeks Support.

1. Your domain name registration and any privacy/proxy services you may use in conjunction with it must be subject to a Registration Agreement with an ICANN Accredited Registrar.
   • You are entitled to review this Registration Agreement at any time and download a copy for your records.
2. You are entitled to accurate and accessible information about:
   • The identity of our ICANN Accredited Registrar Partner;
   • The identity of any proxy or privacy service provider affiliated with GreenGeeks;
   • The terms and conditions, including pricing information, applicable to domain name registrations;
   • The terms and conditions, including pricing information, applicable to any privacy services offered by GreenGeeks;
   • The customer support services offered by your GreenGeeks and the privacy services provider, and how to access them;
   • How to raise concerns and resolve disputes with your Registrar and any privacy services offered by them; and
   • Instructions that explain your Registrar’s processes for registering, managing, transferring, renewing, and restoring your domain name registrations, including through any proxy or privacy services made available by your Registrar.
3. You shall not be subject to false advertising or deceptive practices by your Registrar or through any proxy or privacy services made available by your Registrar. This includes deceptive notices, hidden fees, and any practices that are illegal under the consumer protection law of your residence.

Domain Name Registrants’ Responsibilities

1. You must comply with the terms and conditions posted by your Registrar, including applicable policies from your Registrar, the Registry and ICANN.
2. You must review your Registrar’s current Registration Agreement, along with any updates.
3. You will assume sole responsibility for the registration and use of your domain name.
4. You must provide accurate information for publication in directories such as WHOIS, and promptly update this to reflect any changes.
5. You must respond to inquiries from your Registrar within fifteen (15) days, and keep your Registrar account data current. If you choose to have your domain name registration renew automatically, you must also keep your payment information current.

For more ICANN Registrant education, please visit: http://www.icann.org/en/resources/registrars/registrant-rights/educational

For more ICANN Registrants’ Benefits and Responsibilities: http://www.icann.org/en/resources/registrars/registrant-rights/benefits

The post Registrant’s Benefits and Responsibilities appeared first on GreenGeeks Support.

The post Do I Have to Turn Off Privacy Protection to Transfer a Domain to GreenGeeks? appeared first on GreenGeeks Support.

The post What Happens to Mail Sent to the Whois Privacy Protection Service Postal Address? appeared first on GreenGeeks Support.