Ask HN: Designated Access to Namecheap Domain Remains After Domain Is Sold
Hi all,
Wondering if anyone else has noticed this.
I was given designated access to a client's domain name on Namecheap - let's call it `domain.com` to edit DNS and such.
The client sold the domain using Namecheap's "sell domain" feature. The domain sold to a new owner and was transferred.
After the domain sold and the new owner changed WHOIS/DNS records, my account still has access to the domain. Months later I still have access. I can make changes to DNS and other settings even though it is not owned by my clieny anymore. It's clear the new owner doesn't know there was designated access to the domain.
I've tried reaching out to Namecheap support to find out if this is intended behaviour, but all they wanted to do was revoke the permission from my account. They could not escalate to any other level of support. Today I recieved this response from Namecheap support, confirming that my account had unauthorized access to a domain after it was sold in the marketplace: --- I can see that the domain you mentioned is still shared and can be managed by your account, even though it was sold via our Marketplace.
It will take a while to investigate the case properly and fix the bug. I'll ask the team to keep you updated on the progress. As for the domain itself, due to security reasons, we'll need to revoke your access to it. --- Anyone who has bought a domain through the "sell domain" feature - you should immediately check for unauthorized access to your domain(s). Additional confirmation: --- We have thoroughly checked the issue reported by you and we would like to confirm, that there is indeed a bug in our system. As a result, modification rights for the domain are not removed when the domain is sold or pushed to another Namecheap account. Regrettably, we do not have any ETA on the fix at the moment. https://news.ycombinator.com/user?id=NamecheapCEO But I doubt you would get a response I can reply. I work with Namecheap. Will reach out to the OP. Hi there - can you please reply with the ticket number? I work with Namecheap and would like to investigate this further. Thanks so much. Hi tamar, I don't have a ticket number. How can I reach you to continue this conversation? If you can open a ticket (via support at namecheap dot com) with details and the domain name, I'll make sure this gets appropriately escalated. Just let me know the ticket number when you do. Hi tamar, You have brought up what is precisely my concern, and what I couldn't convey to support. If I open a ticket with the domain name, what's to stop the access being removed, and declaring "problem solved", without actually addressing the underlying issue? Either delegated access remaining after a sale is a mistake (in which case there is now "unauthorized access"), or it's "by design" (in which case users should be made aware so they can remove this access after buying a domain). Regardless, I think you shouldn't need to know the specific domain in order to say which situation it is. Support is aware of your issue and is awaiting details, and this is now in a specific escalation process to upper management. I will need some information in order to further assist you, especially to understand why this is impacting you and/or if it could be impacting others. This does not sound like something that is "by design." If you don't own or manage the domain, it shouldn't be listed in your account. Period. But we can't address any such underlying issue without a starting point. You don't need to tell me the domain here. Please simply open a ticket and let me know the ticket number and I will have management take a closer look. Hi tamar, Thanks again for your patience. The ticket number is QKL-147-94127. Super, much appreciated. We'll take a closer look and see what might be happening here, and appreciate your understanding.