For transfersite, i have an addon domain that uses third party nameservers. as per searching on discord, i have added the domain to /etc/virtualhosting/dnsbypass.
Transfersite still fails with
NOTICE: aliases_add_domain failed... retrying...
NOTICE: aliases_add_domain failed... retrying...
NOTICE: aliases_add_domain failed... retrying...
NOTICE: aliases_add_domain failed... retrying...
FAILURE: aliases_add_domain
Aliases_Module::_verify(): `redacted.com': domain has DNS records delegated to nameservers dns1.registrar-servers.com, dns2.registrar-servers.com. Domain cannot be added to this account for security. Complete one of the following options to verify ownership:
Then the domain is not listed on the destination server’s dnsbypass list.
It’s literally the second check in _verify():
if (!$this->dns_domain_on_account($domain) /** domain under same invoice */ &&
!$this->_verify_dns($domain) && !$this->_verify_url($domain)
) {
All 3 conditions must be false. dnsbypass is checked in _verify_dns() as the first check:
protected function _verify_dns(string $domain): bool
{
/*
* workaround for account migrations which
* duplicate domains across multiple servers
* that no longer have DNS properly delegated
*
* @XXX DNS checks can be bypassed via API: BAD
*/
if ($this->isBypass($domain)) {
return true;
}
isBypass() checks each domain name listed. File is ordered as 1 domain per line.
There’s not much more to it than that. If the domain matches (strict matching, case matters) then it returns true thus preventing the error (1 condition in 3 is true; remember all 3 must be false to produce that error).
You’ve encountered the error because you have something malformed either in the domain name or entered the domain name on the source rather than destination server.
remove dnsbypass file (in …storage/opcenter), unlink (/etc/virtualhosting/dnsbypass), make a new dnsbypass file, make new link, insert domain list. ->nothing
Can this just be straight up disabled?
Since when do we need to validate ownership of an addon domain?
Plenty of reasons to add a domain before nameservers are changed, and this shouldn’t be a blocker for a site transfer. I’m seeing this on recent migrations too. I’d like to just turn this “feature” off.
Is this new? I’ve done thousands of migrations and never encountered this.
Since doing so would allow one to add gmail.com and intercept all outbound mail and even direct DNS if /etc/resolv.conf uses these nameservers in non-split-view mode. It’s a Really Bad Idea .
Having this feature is better than dealing with the consequences of someone bitching when a malicious actor subverts their network.
No. You’re using cp-proxy, so it’s able to check the domain against its account database.
In general i agree that this is a good feature. But if doing server transfers as admin/root via cli, i think there should be a bit less security checks.
Use cp-proxy so the panel can track domain ownership across servers.
This enforcement occurs when [domains] => dns_check is enabled (default: true) and [dns] => hosting_ns is set (default: unset) or dns,provider is anything but “builtin” or “null”.
It uses the SOAP API, which is the same API any user with an API key could access; hence the need for security.
.