How do I prevent locking myself out (Domain, Emails, Servers) reddit / selfhosted ---------------------------------------------------------------------- mouro_001 · 2023-09-26 18:14 Lately I've been switching all the emails from all the accounts I have (on different websites) to use random unique emails to hopefully prevent possible spamming, and to be able to control who can send emails. Currently, I'm using [Addy.io](https://addy.io) with my own domain (so I can move to selfhosted Addy solution in the future). But with changing all the accounts email addresses, I'm left with a question. Currently I have my domain on NameCheap. Should I change the email address of my namecheap account to be under my domain? As in the login of my account would be [user@example.com](mailto:user@example.com), and upon login in I can modify the domain [example.com](https://example.com)? The same applies for the server that is going to be running Addy, do I sign up for Digital Ocean (or whatever) with an email address that one server in that account controls? What is the best way to preventing having a bad time when something goes wrong in the future? ---------------------------------------------------------------------- jusepal · 2023-09-26 18:44 No, don't do that. That would just open up a possible catch-22 situation locking you out for good. ---------------------------------------------------------------------- mouro_001 · 2023-09-26 18:45 both? ---------------------------------------------------------------------- jusepal · 2023-09-26 18:54 Yes, don't. Registrar login email need to be on another domain. If shit happens, then they the registrar, or registry, or icann need to somehow contact you. And that shit sometimes can mean your domain being suspended with dns reset to default ie zero records. Zero record as in mail for the domain itself doesn't work thus mail to you which you changed to use whatever@domain.com is gone. You're toasted in that situation. ---------------------------------------------------------------------- zoredache · 2023-09-26 19:15 Not sure about namecheap, but many registrars have the ability to create multiple accounts with access to a given domain. I know Digital Ocean lets you create multiple accounts with access to a VM. My point here is that you could create a secondary account with gmail or something for your critical systems with a very strong password, and strong 2FA. Then make your primary account be the one on your own domain. ---------------------------------------------------------------------- mouro_001 · 2023-09-26 19:21 That's an interesting idea, just checked and Namecheap does support "share" a domain: https://www.namecheap.com/support/knowledgebase/arti cle.aspx/192/46/how-do-i-share-access-to-my-domain-with-other-users/ ---------------------------------------------------------------------- mouro_001 · 2023-09-26 19:22 That makes sense! Thanks so much for the input! ---------------------------------------------------------------------- zoredache · 2023-09-26 19:32 Ah good. So yeah, with that, you could make an emergency account backup account. The only down side, is that the second account is potentially a second thing a person could attack, so it is important to keep both accounts strongly secured. Oh, and if you are using a free account for your backup, make sure you use it often enough so that it doesn't get deleted. ---------------------------------------------------------------------- zfa · 2023-09-26 21:37 In the very very distant past I had a nightmare recovering from a situation where my DNS host had a hiccup and the account was registered to an email address on a domain who's records they hosted. It was then that I decided to use gmail(s) accounts for essential service logins. See also how that fella lost his '@q' Twitter account back in the day. Sometimes you need an address at a domain with completely external control, be it for service continuance or certain security aspects. ---------------------------------------------------------------------- NikStalwart · 2023-09-27 00:21 You are overthinking it. > What is the best way to preventing having a bad time when something goes wrong in the future? The best way to prevent something going wrong in the future is to not let something go wrong in the future. Your namecheap username is just that — a username. You do not require access to your email account in order to log in (assuming you have TOTP set up). The *only* reason you would need access to your namecheap email is if you lose your password. The solution is evident: don't lose your password. The problem is that you can just as easily lose your "backup gmail" password as you can lose your namecheap account password. Then you would still be logged out. I prefer to use my own domains for all of my logins, because that gives me provider independence. When the G Suite Apocalypse was going down last year, I never more than 30 minutes away from switching my mx records to iCloud+. The problem with using @gmail, @hotmail etc addresses is that it is a pain to migrate to another service if you decide you need to leave — or are forced to leave. So, to answer your question, with a good password strategy you should not have any problems being locked out of your namecheap account. ---------------------------------------------------------------------- zfa · 2023-09-27 01:36 > The only reason you would need access to your namecheap email is if you lose your password. You'd think so but not the case. Fairly sure they sent me an email about them having reset my password following a breach years ago. I'd advise anyone have access to the registered email address for such a critical service. Not sure how I'd have gotten on without it tbh. Probably just a lot of fucking about in support chats, I guess. Not insurmountabel but prob something I could do without. As an aside, in a setup such as yours that registrar is as critical as you can get seeing as presumably he who controls that can control your dns, thus control your mx records, thus get password reset emails and in may cases 2fa removal links for any other service which will use it as a recovery address. So whilst I use vanity domain in email addresses myself, I use gmail for things like registar, dns hosts etc. to minimise attack surface. [Here's the not so amusing story I've referred to elsewhere that made me move from vanity addresses everywhere](https://medium.com/@N/how-i- lost-my-50-000-twitter-username-24eb09e026dd). Poor guy. ---------------------------------------------------------------------- NikStalwart · 2023-09-27 03:25 Thanks for the read. It is a perfect example of why I tell people to not use GoDaddy in the first place. I have suggested, almost half- sarcastically, to use a registrar with no support. If there is no support, there is nobody to reverse-engineer, right? But the problem is this: the guy didn't get comped because he used vanity domains for email. The guy got comped because he was using vendors with shit security. There is nothing you can do about that. Reading the article, he gave up his Twitter account himself (well, in response to the extortion) and the extortion was only possible because his GoDaddy account got comped. His GoDaddy account would have been comped whether or not he was using vanity domains because GoDaddy is (and will always be) shit. As will any IT company with money to burn on prime TV advertising. I recall a swathe of account hijacks at Twitter and other places because people'd ring up the person's telco and reroute the phone number used for MFA. It took PayPal a surprisingly long time to move from SMS-based 2FA to TOTP (was it '19?). It doesn't help that a lot of places — banks and government institutions — use your freakin' date of birth for identification. Incidentally, don't use DynaDot for that reason. I wholeheartedly agree with you about minimizing one's attack profile. But I don't agree that using generic email providers for registration is the way to do it. For one thing, it is another mailbox that you need to keep secure. For another, you lose provider independence and can find yourself locked out of your most important accounts if your generic email is ever deactivated, banned or discontinued. For instance, your country does something Google doesn't like and they suspend service in your area (say the EU passes another big brain law that is a PITA to comply with) or you say something risqué and Google decides to deplatform you., but your registrar and banking is tied to a Google account. Now you're shit out of luck. The things I would recommend are: * Pay for a registry lock for your most important domain — not all TLDs support this, but .com, .net and .org should. This will cost you a few extra hundred bucks per year, so you don't want to do this for more than one domain (unless you are making money off of it) but it can be prudent. A registry lock prevents registrars from doing automatic operations on your domain. Everything — name server and contact updates, not to mention transfers — has to be done manually. Different registrars employ various levels of vetting, but photo ID and live teleconferences are not uncommon. * Use a medium-sized registrar in your jurisdiction. You want something that isn't a small fly-by-night operation that might get compromised just as easily as your account, but you also don't want to go with a large corporate where you will be lost in the shuffle. You want a company in your jurisdiction so that you have somebody to sue if shit hits the fan. * Don't use SMS-based 2FA if you can avoid it, to mitigate against the phone number hijack attack. * Don't be interesting enough for people to bother using the $5 Wrench attack against you. ---------------------------------------------------------------------- LostLakkris · 2023-09-27 03:38 Keep two emails, your donation catch all, and a "personal" Gmail. The Gmail should be for namecheap or whatever else you want to be sure works if something bad happens for 6 months. That said, I did it. I updated my namecheap email to the same domain they hosted and accidentally let my CC lapse and couldn't get my "I don't recognize this IP" email. Tech support happily helped me out after confirming I'm me, so that I could fix my CC myself. ---------------------------------------------------------------------- zfa · 2023-09-27 03:45 My approach has always just been if Google stops serving my country I'll just change email address at the affected services, it's only used in three places. You can see my top-level reply elsewhere about an issue I had with DNS hosting which caused me to be able to unable to get into my DNS host to fix the problem. Never again, lol. ---------------------------------------------------------------------- vivkkrishnan2005 · 2023-09-27 05:46 I have created an equivalent of 3-2-1 rule for this. For any domain, you should have 3 email IDs registered - 2 of them from different domains not related to the domain in question anyhow, and 1 should be a break glass account, unused elsewhere. This ensures that at any point in time, you can always get back to the domain if you get locked out. Once you regain access to the domains, you can do anything else from there. If your registrar does not allow multiple access, change the registrar. ---------------------------------------------------------------------- GolemancerVekk · 2023-09-27 08:57 I maintain a secondary mailbox that's dedicated to acting as secondary/recovery email. If you don't want to use a free Big Email provider you can pay for your own account with a private email provider, with or without your own domain. Most email providers will let you make an address @ one of their domains, if you don't want to enter another catch-22 with that domain. If you want a recommendation mailbox.org is $12/year, has been around since the '90s and is based in Germany with very good privacy laws. As a side note, you don't need Addy to keep your email addresses protected. Any decent email provider should offer you the ability to use aliases, for both receiving and sending. All you have to do is keep the base ("real") email address exclusively for login to the webmail/SMTP/IMAP/POP, and use aliases for everything else. If you want to make it even easier look for a provider that offers wildcard aliases, which you can use on the fly without having to go into a settings panel to create them. Please note that I'm not talking about plus-addresses (alias+real@domain), which still expose your real address, I'm talking about defining an alias with a wildcard component (alias-*@domain) which will let you use alias-site1@domain, alias- site2@domain and so on, which will let you identify later who sold your address (or had a breach) without exposing your real address. Migadu and Gandi are two such providers I know that offer this for sure (on Migadu it's called "patterns").