Ask HN: Designated Access to Namecheap Domain Remains After Domain Is Sold

1 points by SpikedCola 3 years ago | 11 comments

Hi all,

Wondering if anyone else has noticed this.

I was given designated access to a client's domain name on Namecheap - let's call it `domain.com` to edit DNS and such.

The client sold the domain using Namecheap's "sell domain" feature. The domain sold to a new owner and was transferred.

After the domain sold and the new owner changed WHOIS/DNS records, my account still has access to the domain. Months later I still have access. I can make changes to DNS and other settings even though it is not owned by my clieny anymore. It's clear the new owner doesn't know there was designated access to the domain.

I've tried reaching out to Namecheap support to find out if this is intended behaviour, but all they wanted to do was revoke the permission from my account. They could not escalate to any other level of support.

SpikedCola 3 years ago |

Today I recieved this response from Namecheap support, confirming that my account had unauthorized access to a domain after it was sold in the marketplace:

---

I can see that the domain you mentioned is still shared and can be managed by your account, even though it was sold via our Marketplace. It will take a while to investigate the case properly and fix the bug.

I'll ask the team to keep you updated on the progress. As for the domain itself, due to security reasons, we'll need to revoke your access to it.

---

Anyone who has bought a domain through the "sell domain" feature - you should immediately check for unauthorized access to your domain(s).

SpikedCola 3 years ago | |

Additional confirmation:

---

We have thoroughly checked the issue reported by you and we would like to confirm, that there is indeed a bug in our system. As a result, modification rights for the domain are not removed when the domain is sold or pushed to another Namecheap account. Regrettably, we do not have any ETA on the fix at the moment.

justsomehnguy 3 years ago |

https://news.ycombinator.com/user?id=NamecheapCEO

But I doubt you would get a response

tamar 3 years ago | |

I can reply. I work with Namecheap. Will reach out to the OP.

tamar 3 years ago |

Hi there - can you please reply with the ticket number? I work with Namecheap and would like to investigate this further. Thanks so much.

SpikedCola 3 years ago | |

Hi tamar, I don't have a ticket number. How can I reach you to continue this conversation?

tamar 3 years ago | | |

If you can open a ticket (via support at namecheap dot com) with details and the domain name, I'll make sure this gets appropriately escalated. Just let me know the ticket number when you do.