Hacker News Reader

Comment by cookiengineer | Hacker News Reader

The whois check for a domain literally contains when it will expire. You can do this one time (combined with an MX lookup) while the email is added.

And knowing the ASN of a domain is also quite helpful. If anything changes (e.g. geolocation of ASN or different domain registrar) you can easily force the user to confirm this while they are already logged in.

Source: I am doing this for my tholian.network products.

View on HN

> The whois check for a domain literally contains when it will expire. You can do this one time (combined with an MX lookup) while the email is added.

That’s not reliable. A domain can be deleted before expiration.

Sure, but that is usually by the request of the owner, if I'm not mistaken?

Better cover most of the cases than none.

All I’m saying is if you’re building such a system you should be aware of this and possibly account for it with some low frequency scanning before listed expiry. Or not, if you decide it’s not worthwhile.

Fair enough.

Could also be renewed

Alternatively you could do a whois query of the domain (and verify against cached details) before sending out the recovery email. It's probably best to do that every time the email addresses are changed or updated.

Note that some WHOIS servers (as in port 43) are hostile to automation and might block you if you’re doing it too much, although you could be paying a few cent per custom domain per month to have a service perform the data aggregation for you.

Agree, most ToS of WHOIS servers say they don't want automated queries.

In this case I think it'd be simpler to just do a DNS check, either NS alone or A/MX. Scales better. If NXDOMAIN is returned over a period of days then the domain can be flagged.

Reply on news.ycombinator.com