Differences

This shows you the differences between two versions of the page.

--- system:registrars [2024-12-23T15:27:04+0000] – Namecheap.com new DS still using SHA-1 in violation of RFC 8624 Section 3.3 michael_paoli
+++ system:registrars [2025-01-15T19:58:23+0000] (current) – +RFC 7344 michael_paoli
@@ Line 257: / Line 257: @@
 And yes, not expecting anything on it anytime particularly soon, but they did well understand it and take note,
 so, rather likely will come in future API and web interface. \\
-See also: [[https://www.rfc-editor.org/rfc/rfc8078.html|RFC 8078]], etc.
+See also: [[https://www.rfc-editor.org/rfc/rfc7344.html|RFC 7344]], [[https://www.rfc-editor.org/rfc/rfc8078.html|RFC 8078]], etc.
 I might be forgetting some details and further examples, but pretty much
@@ Line 331: / Line 331: @@
 Also much of the information their support staff provides is incorrect ... ugh.\\
 Ugh, "spam" - created account there 2024-11-19 (to assist someone with something), and very explicitly opted out of their "marketing" communication.  Yet 2024-11-26 they're sending me spam: "Subject: Forgot something? Hot deals inside" and body that starts with: "Namecheap Top deals" ...
-And "of course", their unsubscribe link tells me: "You’ve already been unsubscribed from newsletter & marketing communications".
+And "of course", their unsubscribe link tells me: "You’ve already been unsubscribed from newsletter & marketing communications".\\
 And I vote "no confidence" (at best) on Namecheap.com.  As of 2024-12-18 they're still doing DS records with SHA-1
-(see e.g.: [[https://dnsviz.net/d/lunacrescentnails.com/Z2J5fw/dnssec/]]),
+(see e.g.: [[https://dnsviz.net/d/lunacrescentnails.com/Z2J5fw/dnssec/|lunacrescentnails.com]]),
 which is disallowed for new DS records, and has now been for years per [[https://datatracker.ietf.org/doc/html/rfc8624#section-3.3|RFC 8624 Section 3.3]].
 Furthermore, on 2024-12-18 I commented on this matter on their
@@ Line 341: / Line 341: @@
 so appears they don't care to accept/post comments nor reply, and very possible they don't even bother to read them.
 So, yeah, paint me not surprised - when they've already got open requests that have been open for more than a decade that should've been implemented,
-and haven't yet been ... alas, not surprised //at all//.
+and haven't yet been ... alas, not surprised //at all//.  This DS SHA-1 issue //may// be limited to just their "BasicDNS"
+(and likely also "Premium DNS") services, and possibly certain domains thereupon,
+as it seems to //not// impact (at least some, if not all) domains which are not on their DNS hosting
+(e.g. [[https://dnsviz.net/d/savingthedolph.in/Yt3Rhg/dnssec/|savingthedolph.in]]).
 ----