CODEWITHSUNDEEP
dnsgcloud
deepelement
deepelement

Reputation: 2506

How does GCloud DNS verify domain ownership?

Configuring GCloud DNS, it is clear that they reuse nameservers across zones. However, I noticed that once GCloud's nameservers are added to the domains NS records in an external provider (Bluehost, GoDaddy, etc), the mapping resolution occurs without ownership validation.

What happens when:

Does GCloud DNS allow the other user to hijack traffic at www.joe.com in this case? At what point does GCloud DNS assert the SOA back to the domain owner, given the overlap of Nameserver endpoints?

Update

Just created a new GCloud DNS zone for a domain that I do not own (ex. hijack.domain.com), that is publicly known for using GCloud DNS nameservers (ex. www.domain.com). Was able to CNAME that subdomain to www.mycustomsite.com.

Since zone's can take any form, doesn't this essentially mean someone can just hijack endless zone names on a GCloud DNS user's domain?

Update

3 hours later, the zone creation view in GCloud DNS now has a challenge to verify ownership at https://www.google.com/webmasters/verification

Not sure what happened earlier, but the verification wasn't part of the creation process.

Upvotes: 2

Views: 526

Answers (1)

deepelement
deepelement

Reputation: 2506

Google Cloud DNS should work hand-in-hand with https://www.google.com/webmasters/verification

When creating new zones, there should be a challenge to verify ownership if not already established in their stack.

Upvotes: 0

Related Questions