Zoho.com CEO says domain with 40M users suspended for abuse complaint

https://twitter.com/svembu/status/1044265646739996673

by achynet • 8 years ago

500 228 8 years ago

noja• 8 years ago

Incredible. Their registrar (TierraNet) has some explaining to do.

The importance of using a reliable registrar can't be overstated. tierra.net looks like a small company, without 24hr support, and with an abandoned social media presence. Why would a company with 40M users use a tiny registrar to save 2 bucks on a domain name?

svembu16• 8 years ago

This was not the company used. The domain registrar market has gone through consolidation and it ended up here. We have been moving domains and this is a cautionary tale for us.

toast03• 8 years ago

They probably registered the name very early in their corporate life. At some point, they had a real business, and a business critical domain name, but they didn't realize they needed to do something different. My CEO registered our business names at network solutions, sigh.

Anyway, as a wakeup call -- if you have a business critical domain name, you need to find (and use) a registrar that has a registry lock procedure for the TLD you're in. A registry lock means the registry won't process changes from your registrar unless you authorize them, which makes it a lot harder to change things on purpose, or by an attacker. I imagine abuse takedowns could still go through though -- but there will at least be more people who know you care about your domain.

fermienrico2• 8 years ago

I can understand if they're a cement company with a website. Zoho is in the business of email with @zoho.com emails. This is a huge oversight which makes me question their whole company and how things might be internally.

snowwrestler2• 8 years ago

I've been very happy with MarkMonitor. They have good customer service, a good reputation, and best of all, they auto-renew domains and send an invoice. That means that the failure mode is "domain is renewed, I owe them a check."

If your domains are riding on a credit card, you potentially have a failure mode of "card was declined, my domain did not renew, everything is down."

barkingcat• 8 years ago

and then someone steals the domain out from under you and you'll need to pay in bitcoins to get it back.

sandGorgon2• 8 years ago

How much does markmonitor cost ? There is no pricing anywhere.

lucasjans• 8 years ago

You would be surprised how prevalent these problems are even with supposedly reputable registrars.

A commonly recommend option here in HN was NameCheap. Earlier this year without any notice they modified our DNS servers completely taking down our SaaS product.

Why? Some migration script run incorrectly.

They offered me a random TLD for free for one year as compensation! I declined.

teddyh• 8 years ago

You seem to imply that reliable ≠ small, and that small registrars are cheaper.

In my experience, the opposite is true in both cases. Big registrars can’t afford any support costs since they prefer to squeeze the price down as far as possible, and therefore they prefer to simply lose or outright drop any customer in case of any and all problems. Conversely, small registrars may charge more, but have better (i.e. actually existing, and sometimes even dedicated and personal) support for when things go wrong, and have a vested interest in keeping you as a customer.

ttul6• 8 years ago

This is why you register your domain with MarkMonitor or Cloudflare. I cannot comprehend why they were so stupid to use a registrar that is not corporate oriented. This is just unreal.

toast03• 8 years ago

The domain was registered in 2004; MarkMonitor was around then, but Cloudflare wasn't. I was involved in moving a domain to MarkMonitor in 2013; at that time, they had a rather steep minimum spend to get on their platform, and they barely wanted to talk to us.

LeonM• 8 years ago

You can transfer a domain name to a different registrar.

lucb1e2• 8 years ago

That's a lot of strong words in a short comment for an honest mistake. I don't think this is called for with pretty much any unintentional error where we don't know the exact background.

ttul6• 8 years ago

When you have 40M users, this is an inexcusable oversight. It points at Zoho having an incompetent CIO role. An experienced and appropriately paid CIO would most definitely have had this near the top of his or her list years ago.

srgseg• 8 years ago

Do you happen to know how much Cloudflare charges for this?

svembu16• 8 years ago

Zoho CEO here.

Our domain was abruptly blocked by our registrar this morning. Our NOC team and myself tried to get in touch with them and they tell us "Contact our legal". Even I could not get in touch with anyone beyond their phone operator. The domain was restored, but as DNS takes time to restore, we are still facing issues. They later claimed there were abuse complaints about Zoho.com emails (which is our personal email service with millions of free and paid users). We received a total of 3 complaints from them and two of them have been acted upon and one is under investigation.

Once we dig our way out of this, we will find ways make sure no one takes down our domain again this way.

KenanSulayman• 8 years ago

You should consider using Google Domains. There’s literally no company that’s more professional in this regard.

unstuckdev6• 8 years ago

Google is their direct competitor.

svembu16• 8 years ago

Yes, all of these possibilities are under investigation. We have just recently secured ICANN approval to be a domain registrar. With our scale, this has become important now.

RegicidalManiac• 8 years ago

Well when Google bans you, you will simply find no recourse. Google is pretty shitty company when support is needed.

devoply• 8 years ago

Google is a company with a horrendous customer support history.

abtinf• 8 years ago

Could you elaborate on your view that Google Domains is the most professional company for this kind of issue?

kartman• 8 years ago

As a small start up when we ran into a similar problem while using google domains, they gave us a very hard time with bad support...something we could not afford then. I dont have a good alternative but wanted to mention this experience with google domains. Hope that helps.

fitzroy• 8 years ago

Maybe domains registered more recently work differently, but my Google domains use a random user account generated by Google for eNom (the provider they were contracting with at the time). That makes each domain it's own virtual customer (I couldn't just login to eNom or Google see a list of all my domains). I need to log into Google Domains as a separate account for each domain, and then that takes me to GSuite which links to eNom.

Also, last I checked, unlocking a domain for transfer to another registrar required emailing Google/eNom. There's no interface for it. For a while the entire UI to choose to cancel a domain just disappeared as well.

I would not recommend Google Domains.

austhrow743• 8 years ago

Google doesn't even use google domains.

unixhero• 8 years ago

I'd go with DYN.COM for all my domain and DNS needs for a million/billion(?) Dollar business such as this. No referral here, just advice.

michaelbuckbee• 8 years ago

This should be higher up in the comments. DNS is a seldom thought of security / point of failure. Dyn's whole business model is basically: we won't turn you off until we talk to you.

azinman2• 8 years ago

Don’t forget https://en.m.wikipedia.org/wiki/2016_Dyn_cyberattack

tlamponi• 8 years ago

Just FYI, I'm one of the maintainers of a mid-size forum regarding opensource virtualization/containers and thus spam is a daily occurrence.

While the fight against it is rather dire and no end will ever be in sight, I'll nonetheless never stop (tool assisted) fighting.

Anyway, @zoho.com addresses used by spammers started to pop up circa a month ago and increased rapidly in occurrence. As we use stopforumspam to report and track spammer info (and surely are not the single forum seeing those @zoho.com domains) you may got a few flags raised somewhere.

Not sure what caused this sudden (from our POV) attraction of spammers using zoho, you may want to look into some defense against this. While a full solution may not be achievable it's often enough to be faster than other providers, aka the tiger defense ;-)

krn3• 8 years ago

It sounds like the spammers found a way to automatically create new @zoho.com email accounts, and the single way to stop them might be using a CAPTCHA service from the direct competitor, Google. At least that was the unfortunate case for the privacy focused German email provider Mailbox.org[1]:

We recently detected activities on our servers where bot nets were used to create hundreds of thousands of e-mail accounts for the sending of spam e-mail. Although we take this as a compliment – somebody out there must be convinced our infrastructure is up for the job – we needed to find a solution to stop this abuse of our service, of course. We subsequently deployed a number of different CAPTCHA systems to help our servers identify bots during registration. However, spammers were able to circumvent all these solutions shortly after they were put in place. [...] We therefore decided to use Google’s CAPTCHA for the time being, because out of the set of solutions we tried thus far, this one seems to work best.

[1] https://userforum-en.mailbox.org/knowledge-base/article/goog...

rajasekar_svel• 8 years ago

Hi Sorry for the issue caused to you. Can you provide few email address to abuse at zoho.com, so we would take appropriate action after investigations. Regards. Rajasekar Zoho Abuse Monitoring Desk.

EB66• 8 years ago

As a network engineer for an ISP, I can tell you that StopForumSpam reports generally don't make it on our radar. Cisco Talos IP reputation, SpamHaus, SpamCop and various other DNSBLs do make it on our radar and are proactively monitored by most responsible ISPs.

That being said, the proper way to report abuse to an ISP is to email the official point of contact for abuse associated with their IP netblock. In the case of Zoho, that contact info can be found here: https://bgp.he.net/AS2639#_whois

ARIN rules require that all IP netblock owners provide a valid point of contact for abuse issues. ARIN validates the points of contact annually. I believe that RIPE, APNIC and LACNIC have similar rules.

If an ISP doesn't act on the abuse after it has been reported to their abuse point of contact, then you have a legitimate complaint against them.

slv77• 8 years ago

Second that as we’ve started to see fraud related registration activity from zoho.com around the end of August.

iokanuon• 8 years ago

Is zoho.eu also affected by this?

gopi• 8 years ago

Sridhar, after this nightmare is over, move all your domains to MarkMonitor

belorn3• 8 years ago

If you have 40M users I suspect the annual cost from the registrar is very small part of the budget. Get a registrar where you don't have to deal with a phone operator.

I work in this industry and it's a very clear separation between bulk registrars and those that maintain fewer but high value domain names. The latter usually give you a personal contact person to call and work proactively to deal with threats to companies' domain names and trade marks. I don't think I have ever heard of a domain being abruptly suspended by such a registrar.

The cost is usually 5x-10x that of the cheapest registrars so there is naturally a balance to be struck, and as I work in this industry I might be a bit biased. However the damage when waiting on the TTL when registries update NS records sounds very substantial when they first suspend and later restore a domain name in what sound as a very reckless behavior.

taf2• 8 years ago

Which register do you recommend?

svembu16• 8 years ago

Yes, that is good advice. We are reviewing all our processes about domain registries right now. Major lesson learned, and I would encourage other companies to think this through and learn from our experience today.

wafflesindeed2• 8 years ago

Hey mate,

I've always been a bit perplexed as to how registrar's are created. How could I become a registrar?

Any advise or resources to explore this very open question would be wonderful.

Cheers J

henrygrew• 8 years ago

which registrars are these?

edm0nd• 8 years ago

Transfer your domain to a major registrar. Tierra.net looks like some bs cheap registrar and doesn't have any social media updates on their accounts since 2017. I'd recommend Namecheap.

wolco• 8 years ago

social media updates is not the best marker of current business activity.

indigodaddy2• 8 years ago

Even a solid company like Namecheap wouldn't actually be appropriate for a large, enterprise corporation such as Zoho.

protomyth• 8 years ago

I get the feeling a lot of folks ended up there from Domain Discover which had good ratings back in the day. They actually aren't that cheap.

ethanwillis6• 8 years ago

I don't recommend Namecheap. A few months ago they dumped all of my private information erroneously, including physical address, for a whois guarded domain. They admitted to it too and all they offered me was $100 in Namecheap credit.

Spoke with lawyers and from what i was told in consultations there's basically nothing I can do about it.

TL;DR Namecheap will endanger your family and they give 0 fucks.

highclass5• 8 years ago

Namecheap is just as bad, check out https://news.ycombinator.com/item?id=14139288

I almost has a domain frozen with namecheap after one warning. If I missed the warning email or checked my email after 24 hours they would have completely suspended my domain. I'm talking about a site with MILLIONS of visitors per month and ten thousands of posts per day, not some small blog.

nodesocket• 8 years ago

I highly recommend AWS Route53 domains paired with their DNS service. Pay for the AWS support plan so you can call. I suspect Zoho is a multi-million dollar company at this point, should not be using a discount registar.

pmlnr• 8 years ago

This was registrar level, not nameserver level.

ttul6• 8 years ago

$400M PA reportedly...

Svexax2• 8 years ago

If you’re providing email service, you should be actively monitoring public blacklists, not waiting for your registrar or hosting company to notify you. Even if your domain isn’t banned, your users’ emails may be bounced by other servers. That you don’t seem to know any of this means you aren’t employing the right people.

icebraining• 8 years ago

I'm pretty sure you're over inferring stuff from that post. It's not credible that 20+ years old company serving email for millions of users wouldn't know the most basic stuff about running an email server, don't you think?

Kim_Bruning• 8 years ago

I think it's pretty good that you came to ycombinator yourself!

I wish you the best of luck once you catch up with the CEO of Tierranet (or perhaps you already have!)

ttul6• 8 years ago

I'm sure that Zoho has many talented engineers, but to manage abuse on the scale of 40M users you might benefit from engaging with one of the firms that specializes in this area.

ted02• 8 years ago

Ted from Namecheap here. I shot you an email. We'd be happy to help you out and ensure that your domain is locked down.

kweks3• 8 years ago

Hi Ted.

This event seems to have been triggered from abuse complaints - and involved the registrar not reaching out to the client in question.

Curiously enough, I had a very similar incident with Namecheap last week: an unsubstantiated email (without subpoena, judge's order, or even validation of who actually sent the email) - was sent to namecheap abuse /alleging/ (correct, no proof) trademark infringement.

Namecheap rolled over and provided all information to the third party - and didn't bother to inform me of the incident. The only way I found out was a menacing legal letter using the address that I have on file at namecheap.

If Namecheap doesn't respect due process (ie, requiring legal documents to turn over customer information) or customer privacy (Hi, we have just had to turn over information) - on a 10+ year customer, I'm not sure that you're in a better position than Terra.

Severely disappointed with you guys.

ethanwillis6• 8 years ago

Don't take Ted up on his offer. Namecheap released all of my personal information erroneously and all they offered me was $100 in Namecheap credit.

This company literally has 0 morals and doesn't care about making sure people are treated right. Also, good luck getting through their regular support. It's straight from a script with 0 deviations.

highclass5• 8 years ago

Namecheap is just as bad.

I run a forum site with MILLIONS of visitors and about 5,000 TB of traffic per month. Namecheap.com suddenly sent me a link warning that they will suspend my domain completely within 24 hours, if I did not delete two problem images (which were inappropriate/troublesome images but in the context of the forum posts, "a very poor attempt at humor"). I deleted the images and avoided being suspended, but the way they threatened to suspend my domain due to two images was ridiculous. If I missed the warning email or checked my email after 24 hours they would have completely suspended my domain. I'm talking about a site with MILLIONS of visitors per month and ten thousands of posts per day, not some small blog.

They may be suitable for some blog, but I can now say to NEVER use them for any enterprise site.

https://news.ycombinator.com/item?id=14139288

namebase• 8 years ago

Handshake.org is trying to solve this problem for good by decentralizing DNS at the root TLD level. I'd look into this if you want to make sure no one takes down your domain ever again.

Disclosure: we're building a registrar on top of Handshake. We can also help you claim "zoho" on Handshake for free if you're interested.

wp3816402• 8 years ago

Zoho has 40M users and apparently $350M in revenue. Why are you using a consumer grade domain registrar[0]?

The gold standard for any enterprise is MarkMonitor. You can pick any other enterprise level service which would mean you don't resort to lowering yourself to begging on Twitter to find a contact at a pivotal service provider

This has damaged you beyond DNS propagation, I don't know how anybody in tech is going to take you seriously again without some serious action

[0] https://www.tierra.net/

quintin• 8 years ago

Cut them some slack.

eeeeeeeeeeeee• 8 years ago

I was thinking the same. I hadn't even heard of Tierra until this post. Seems insane that Zoho would cheap out on a registrar.

navinsylvester• 8 years ago

We(Gridmarkets) use multiple Zoho services and are a very satisfied customer. Would like to say we understand and stand by you as you sort this issue out.

Once we dig our way out of this, we will find ways make sure no one takes down our domain again this way.

Would look forward to an official email with regard to what steps were taken to mitigate this going forward.

Endy• 8 years ago

Zoho user since 2006.

Thank you for responding to this quickly. I saw this just a little while ago; I use Zoho Writer and Show for presentations and team-based doc editing and I have for the last decade. If Zoho goes down, I'd be very much lost. Thanks for providing a great service for this many years and I hope it keeps going for many more.

chris2• 8 years ago

This happened to us (Weebly) years ago when we had godaddy as our registrar. I highly suggest you transfer your domain to someone competent like Safenames or MarkMonitor.

huhtenberg2• 8 years ago

The hell are you complaining about unreachable contacts when your own abuse@ address is dead -

    Arrival-Date: Thu, 30 Aug 2018 00:00:00 +0200 (CEST)

    Final-Recipient: rfc822; abuse@zohocorp.com
    Original-Recipient: rfc822;abuse@zohocorp.com
    Action: failed
    Status: 4.7.1
    Remote-MTA: dns; mx2.zohocorp.com
    Diagnostic-Code: smtp; 451 4.7.1 Greylisted, try again after some time

This is from our MTA after 5 (FIVE) days of trying to deliver you a spam report, with all delivery attempts originating from the same IP.

And that's without getting into why you have a filter on your abuse@ address to begin with.

lathiat• 8 years ago

If I had to guess they're probably rejecting the message further because it likely contains the spam itself.

This is a key error in their handling of their abuse@ address, it needs to be expected to receive spam.

rajasekar_sv2• 8 years ago

Dear User,

Thank you for bringing this up. It was due to our greylist setting for *@zohocorp.com domain, we have now excluded the greylist for abuse addresses. Please resend your complaint to our abuse address. Regards, Zoho Account and Abuse Monitoring Desk.

rajasekar_sv2• 8 years ago

Further you can report to us using https://www.zoho.com/report-abuse/

guru4consulting• 8 years ago

btw, I just noticed that Zoho.com domain TLS certificate expires next year. Hope you have automatic checks for the timely renewal.. I have been a fan of Zoho and hope you make a comeback.

ca98am79• 8 years ago

change registrars ASAP!

Also, this is why I think DNS should be decentralized.

unstuckdev6• 8 years ago

A whole lot of people are learning about the hazards of centralization in email lately. First Google turns GMail into a slow-loading nightmare for weaker computers like mine, then they announced the closure of Inbox. Now 40 million people are without email because Zoho couldn't keep up with registrar consolidations (https://news.ycombinator.com/item?id=18060013).

Zoho is fine as a service, but a domain suspension shouldn't cut tens of millions of people off from email.

chooseaname• 8 years ago

A whole lot of people are learning about the hazards of centralization in email lately.

What is the alternative?

unstuckdev6• 8 years ago

I don't know, I'm not an email geek. Lots of smart people run their own email systems and report good delivery rates going by past threads here. Maybe they can work together on something more accessible.

acct17712• 8 years ago

In case this is a serious question: federation, with servers kept running by stakeholders of whatever the email's needed for.

svembu16• 8 years ago

I agree this is unacceptable. We are figuring out ways to make this more resilient - we host third-party domain mails, and we could map those domains directly without involving our domain. That could be one solution. We have learned a serious lesson here.

unstuckdev6• 8 years ago

Steal GitLab's business model and let people/companies self-host their own Zoho.

lucb1e2• 8 years ago

I wouldn't say Zoho is one of the ones enjoying "centralized" status. If you said so of Google or Microsoft, or in the past perhaps Yahoo, then in the western world that's true; but I can only vaguely recall ever hearing of Zoho, let alone see an email address of theirs used by anyone.

While email is getting harder to run yourself due to all the bad actors, with dozens of reasonable choices (plus the option to self-host like I do) you can hardly call it centralized.

foo101• 8 years ago

Honest question: What exactly does it mean for a registrar to block a domain? I believed so far that for my browser to successfully connect to a web server running on a domain or for a mail server to deliver email to a domain, there should only be valid A, AAAA, MX, and/or CNAME records in the DNS.

Was it really a block at the registrar level or was it a block at the DNS level, i.e., the registrar also ran DNS service and their DNS service refused to return responses for zoho.com domains?

At what layer or at which stage of the protocol can a registrar disrupt this and take a domain offline?

daigoba66• 8 years ago

The registrar maintains the records that specify which nameservers, i.e. DNS servers, will resolve names for that domain. The registrar simply changes that record to point to nameservers that they operate, and with DNS entries that “take it offline”.

avens19• 8 years ago

I assume the registrar was also the nameserver in this case

chrsstrm• 8 years ago

Am I seeing things or is dig really telling me their NS records pointed to vtitan.com? Who the hell is vtitan? Route53 with AWS would run them what, $100 a month for their level of traffic?

toast03• 8 years ago

I'm not seeing a block at the moment. I did find a whois history page that claims their NS records in January, 2018 are the same as what I'm seeing now:

    ns1.vtitan.com
    pdns90.ultradns.net
    pdns90.ultradns.com
    dns1.p03.nsone.net
    dns2.p03.nsone.net
    nds3.p03.nsone.net

Those don't appear to be connected to the registrar (tierra.net); most likely the NS records were removed or replaced with servers that direct all queries to a parking page for abusive domains. The TLD servers for com. return a 2 day TTL for all glue records, and their SOA record indicates a 1 day negative TTL.

(Of course, some caching resolvers ignore TTLs :( )

dsp1234• 8 years ago

There are several layers where a registrar has control over DNS resolution.

Terms:

ICANN: The organization responsible for coordinating the maintenance of the domain name system (among other things).

Registrar: A company authorized to update ICANN database on behalf of registrants. Google, GoDadddy, Enom, etc are registrars

Registrants: An entity that wants to register a domain name. In this case, Zoho is a registrant, but it could also be an individual. This is your role if you 'own' a domain.

Authoritative Name Server: A domain name server that is considered authoritative for a specific domain.

Stuff registrars can do (among other things):

1.) They can update the ICANN database to disable a domain completely[1]

2.) They can replace your authoritative name servers with their own or someone else's (ex: botnet domains being reassigned to a security company for dismantling via court order)[2]

3.) If the authoritative name servers for a domain are owned by the registrar, then the registrar can merely change the DNS entries themselves to point to something other than the domain owner's wishes.

[0] https://en.wikipedia.org/wiki/ICANN

[1] https://www.icann.org/resources/pages/epp-status-codes-2014-...

[2] https://www.icann.org/en/system/files/files/guidance-domain-...

ddingus• 8 years ago

Direct IP?

Got a major sales push today, looking for a bandaid.

ai_ia• 8 years ago

This is pretty bad service from Tierra registrar. I am taking this as a cautionary tale for everyone. Domain registrar have way too much power. A back up domain in case things go south, should be a must.

lifty• 8 years ago

I really hope https://handshake.org will catch on. It has the potential to solve a few very hard problems (PKI and online identity) without fundamental changes to the way the Internet works.

TekMol2• 8 years ago

So as a domain owner you are completely at the mercy of your registrar?

What is considered a reliable registrar in Europe?

kevingrahl2• 8 years ago

For private or business use?

Privately I’m pretty happy with Namecheap, they never failed to provide the support I needed in a friendly and precise manner. For business purposes with high value domains MarkMonitor seems to be the industry leader.

TekMol2• 8 years ago

Both seem to be US companies. What levarage do you have over them if they screw you? I would say none. Suing a company overseas is pretty much impossible.

kweks3• 8 years ago

I love namecheap - customer for over 10 years - but a recent incident has me rethinking my patronage. We recently received a "lawyer DDOS" - where a law firm sent multiple letters claiming /alleged/ trademark infringement. Without proof of identity, proof of subpoena, judge's order - whatever - namecheap rolled over on their WHOIS protection. There was no dialog, no email from legal, nothing.

I was dismayed to see that someone can literally send one email, get your personal info, and impact your company.

Very disappointed in namecheap.

krn3• 8 years ago

What is considered a reliable registrar in Europe?

I heard a lot of good things about German INWX[1], even though French Gandi[2] is more popular and is the registrar of ycombinator.com (and was the registrar of reddit.com until recently, before they moved to MarkMonitor).

[1] https://www.inwx.de/en

[2] https://www.gandi.net/en

TimWolla• 8 years ago

I can highly recommend INWX. What I like about them is that the service they provide is domains only (I don't consider their web hosting offers [1] seriously). Thus no conflict of interest and resources are focused on a good domain service.

[1] https://www.inwx.de/en/hosting

WC3w6pXxgGd• 8 years ago

This is terrible.

glglwty• 8 years ago

Is there a blockchain for DNS?

yjftsjthsd-h• 8 years ago

I believe OpenNIC was something like that.

hsk0823• 8 years ago

Like namecoin? or https://handshake.org

teilo• 8 years ago

Running their DNS on a 2-bit registrar is exactly the kind of thing I have come to expect from Zoho. I am forced to use this company for a handful of services at my company. If I started to tell you the idiocy I've had to put up with from these guys, I'd never stop ranting. I'll save it for DevRant.

svembu16• 8 years ago

The domain was registered over 22 years ago, and it kept moving through registrars who were acquired. We do have a solid record of reliable services, and have kept growing in spite of never taking a dime in outside capital.

brianmurphy• 8 years ago

To me this is even worse than choosing a bad registrar once by mistake. You keep choosing companies who can't stay in business and let your domain float around like it didn't matter. The second or third buy-out of your name registration should have been an alert to switch to a top tier company for stability. On the internet, your domain name is literally the crux of your services.

Thank you for sharing your story. It should serve as a warning to others who may need to audit their infrastructure.

walrus01• 8 years ago

This is a hard lesson for people that no matter how resilient your authoritative DNS infrastructure is, for your own nameservers (plus route53 or similar), your domain registrar is absolutely a single point of failure.

If you have something with 40M customers I'd highly recommend going with the same domain registrars used by some of the Fortune 100 companies.

Seizing a domain at the registrar level, by court order, is also how the US government implements "seizure" of domains, if you've ever seen a torrent index site that has suddenly been replaced with a big scary FBI page (examples: https://www.google.com/search?q=this+domain+has+been+seized+... )

themihai2• 8 years ago

I believe DNS/domain name is really a problem that could be better served using a blockchain technology. The registers can't be trusted

jamieweb2• 8 years ago

Namecoin is a good example of this - decentralised domain registrations using the .bit TLD.

themihai2• 8 years ago

Namecoin is cool but I think there are still big issues to be fixed, like renewals/pricing to avoid one person getting all the good domain/sane names.

rustcharm• 8 years ago

Aha! I was wondering when someone would say this!

gibsonf1• 8 years ago

Wow, Zoho is down a second time today now with a 400 Bad Request...

jtl999• 8 years ago

I hope they move to a proper domain register after this...

The lack of decent options of domain registers for technical people that don't need their hand held and have decent security, while not being $$$$ enterprise options is depressing...

I use Uniregistry which has TOTP support and what seems to be a competent team, and a friend swears by AWS's Route53 domain registration, but more choices with actual good policies and aren't just a reseller would be welcome.

mesozoic• 8 years ago

40M users doesn't really give a good idea of how significant 3 complaints are. Still it sounds like some additional screening and protection against phishing needs to be implemented on Zoho's side.

anonymous5133• 8 years ago

I've had similar issues when operating my business. The bottom line is your company is only as strong as your vendors. If you pick weak vendors then your business is harmed as a result. If you find that you have a weak vendor then you must dump that vendor immediately and replace them with someone who is a strong vendor. Period.

sreenadh• 8 years ago

Couple of things about Zoho that I don't understand.

- Why use the same domain for the free service, which is usually more prone to abuse?

- Zohocorp.com is hosted on GoDaddy. Why not move all your domains to a single company so that they value your business more and give you a better level of customer service?

I hope once this is all over, Zoho just shares their feedback and some advices that will help small businesses.

donmcronald• 8 years ago

I’ll add another. Why do they use the same domain for both MX records? Why not use mx.zoho.com, mx.zoho.net so that if one domain gets busted at the registry level the backup MX still works?

Symbiote• 8 years ago

Perhaps a reliable CCTLD for the alternative, so it's not under the US government.

I noticed Amazon use a UK domain for one of the four Route 53 nameservers they specify.

sandGorgon2• 8 years ago

What is the startup friendly markmonitor alternative here ? I don't see pricing information at a lot of these services ...so I'm guessing they are $$$$$$.

Anything which startups can use and is $$ ?

TheMagicHorsey• 8 years ago

I really don't understand why any enterprise service would use these kinds of bargain bin registrars. Is using a reputable registrar with professional, enterprise-grade service not worth it given the scale of someone like Zoho? Optimizing to save a tiny amount on your registrar while you have millions pouring in from customers seems like a really poor decision.

I really believe in running a lean business, but running lean means cutting the fat, not cutting out your muscles and tendons and running with a naked skeleton that is fragile.

casper345• 8 years ago

ZOHO went down and hundreds of thousands of business went down...feel like this should be a bigger warning of how dependent we are to handful of companies?

Animats2• 8 years ago

Well, of course. Look what business Zoho is in.[1]

"Email marketing software that drives sales. Create, send, and track email campaigns that help you build a strong customer base."

They don't have 40 million users. They have 40 million targets.

Of course they don't get many complaints. If you search for "zoho opt out", you get sent to a page with a HTTP 400 error.[2]

[1] https://www.zoho.com/campaigns [2] https://help.zoho.com/portal/kb/articles/what-does-email-opt...

lewisjoe• 8 years ago

[2] Works fine for me.

Also, Zoho is among the most trustworthy companies list of mine. They don't do funny business with AI and targeted Ads with your data.

You try, you pay and you use the software. Traditional, no-nonsense business model. I respect both Apple & Zoho for doing this. Just because Apple has a platform to run ads (The App Store), it doesn't mean Apple is in the advertising business.

anumita• 8 years ago

Hi,

The "email opt out" [2] link is fixed now.

Animats2• 8 years ago

No, it's not. Nothing in "help.zoho.com" seems to work.

400 Bad Request in Firefox.

curl:

    curl https://help.zoho.com
    <html>
    <head><title>400 Bad Request</title></head>
    <body bgcolor="white">
    <center><h1>400 Bad Request</h1></center>
    </body>
    </html>

zorkw4rg• 8 years ago

Its not like Zoho is known for their high availability anyways, their domain not being reachable is just par for the course.

Also since it said "suspended for abuse complaint", I would almost immediately assume the Zoho just didn't properly handle abuse claims and its their fault.

Needless to say I have a incredibly low opinion about their "service" based on having used their mail product for almost a year (switched to google afterward).

sbr464• 8 years ago

I feel that once you’ve passed a certain size you should move the domain to a more professional service, no matter the cost. MarkMonitor etc.

ksec• 8 years ago

Reading through the thread, people have similar problems with namecheap, name.com.

So if you cant afford something enterprise like MarkMonitor, and you don't want something super cheap $9.99 per year. What sort of good quality middle ground choices do we have?

Zoho.com CEO says domain with 40M users suspended for abuse complaint

Related Stories