Vlad Alexa's Blog

If you ever did a whois on say google.com , miscrosoft.com or yahoo.com you have been most likely been exposed to some obscenity and there is nothing the owners of the named domains can do about it.

This is to say that they or their providers or the dns servers have not been in any way hacked or exploited , responsible for this is a feature (turned into a flaw in the light of this) in whois clients that returns everything within the namespace of the queried domain name.

It did not take long for malicious or plain disgruntled individuals to turn dns spammers by creating a google.com.my.spam.rant.whatever.text.example.com subdomain on their own example.com to spam google whois for example.

As the whois query searches for any entries containing google.com in this case, the subdomain on example.com would be returned too , it is expected behaviour of the program.

Inexplicably unexpected was the exploitation of this , however funny MICROSOFT.COM.SMELLS.SIMPLECODES.COM might look to you , there could have been ways to prevent this being displayed in the whois for microsoft.com

What would you say if not owning a garage your auto seller would supply by default a Mord truck by your house for you to park your new car into and told you this is your only alternative besides buying a garage from them?

Well such a situation is functional concerning Internet domains and this is what happens when you buy a domain and do not have a dns/hosting server.

But what if you are mislead into not taking your car from the truck in the morning , instead letting the truck drive you and your car to work?

This is a new situation where your active Internet domain is still parked on the same server and the traffic is transparently redirected to your server.

Well concerning cars and garages you would probably laugh at such a aberrations and no car maker would even hope such an plan to work just so they can proudly flaunt how many people drive Mord trucks but for Internet domains it works and i will go on detailing how GoDaddy does it.

You see in the last months there was a big racket over how a couple of million sites suddenly switched to windows servers.

Turns out that GoDaddy has moved all of it’s parked sites from linux servers to windows ones.

Well it’s their right to get greedy and host your parked site on whatever system pays off best for them, it legal too and somewhere along the registration you agreed to it.

But when you activate your domain and start using it and they still leave it parked just forwarding your traffic not only is it misleading for you and poisonous for webserver surveys but also damaging to the quality of the service and causing you problems like it did to the person that pointed this out to me.

I am talking about the owner of galacticchaos.net who was asking for alternatives to godaddys’s forced “truck” or expensive “garage” because they intentionally failed to inform him of any.

He , the owner of the domain and the content that should be on it has the ip 70.178.70.116 and the content is served by a Apache webserver.

However galacticchaos.net points to the ip 64.202.189.170 and the content is served by a IIS webserver.

In effect the content of the owner appearing to be hosted from a 2million+ domains** IIS*** webserver, in effect Go Daddy having mislead customers into having their active domains parked and putting up with inferior quality of service and other negative implications.

*whois.sc reports 64.202.189.170 as the ip of the server for galacticchaos.net and PARK5.SECURESERVER.NET**** as the hostname of the dns server for galacticchaos.net

**domaintools.com reports over 2 million domains being hosted on 64.202.189.170

***netcraft.com reports IIS as the webserver on 64.202.189.170

****SECURESERVER.NET and it’s subdomains are known to have shady implications likehttp://aplawrence.com/Security/fake_blacklists.html

Since aprox Sept 2004 there is a new headache for mail server administrators but it is not sure whatever it has the same effect on spammers , like it was intended to , and it’s name is SPF .

It is part of a set of rules that work for the purpose of stopping spam , and it is claimed that in the future all the mail your server send will be seen as spam if you do not implement SPF into your DNS records

There is a new SPF version out that makes use of microsoft’s proprietary Sender ID , which makes it unimplementable in any GNU software , but the classic SPF implamentation does not and is widely implemented in many opensource infrastructures.

You can use a SPF wizard on http://spf.pobox.com/ to generate your TXT record for spf , then add that record to your existing DNS records , that is if you have the ability to add TXT records to your DNS server .

Once you do that here is a tool to test your domain for SPF compliancehttp://www.dnsstuff.com/pages/spf.htm