# Unverified custom domain binding

Does the service verify DNS or registrar ownership before binding a domain or zone to a tenant?

_Area: Web infrastructure and server-side requests. Seen in 4 disclosed reports; 4 confirmed bounties, median $1,231, range $750-$6,000; latest 2022-09-28. Updated 2026-10-23._

## How it works
A multi-tenant service lets a user attach a domain or DNS zone to their account, project, or hostname before proving they control it. The binding is stored and later trusted. The broken assumption is that whoever adds a domain owns it. In reality the binding is just a claim, and the real owner is whoever controls DNS or the registrar. If the service later serves traffic, mail, or certificates for that name, the claimant wins without ever proving control. The gap is timing: ownership is checked at resolution time (or never) instead of at claim time.

## Where it shows up
- Zone import or "add domain" flows that create a zone without a TXT or NS ownership check [E1](https://bugbountylibrary.com/r/blog%3Athehackerblog-com-the-orphaned-internet-taking-over-120k-domains-via-a-dns-vulnerability-in-aws-google-cloud-rackspace-a.md).
- Dependent features (email routing, DNS records, webhooks) that trust the zone record without re-checking ownership [E2](https://bugbountylibrary.com/r/h1%3A1419341.md).
- Custom-domain endpoints on PaaS that accept unlimited domains per project with no verification [E3](https://bugbountylibrary.com/r/h1%3A312118.md).
- SaaS custom-hostname / SSL-for-SaaS APIs that add a hostname without checking zone ownership or active status [E4](https://bugbountylibrary.com/r/h1%3A1700276.md).
- Client-side feature flags gating a UI whose backend endpoint skips validation [E4](https://bugbountylibrary.com/r/h1%3A1700276.md).
- Provider nameservers returning SERVFAIL/REFUSED for a zone that still has NS delegation — a fingerprint of an orphaned zone [E1](https://bugbountylibrary.com/r/blog%3Athehackerblog-com-the-orphaned-internet-taking-over-120k-domains-via-a-dns-vulnerability-in-aws-google-cloud-rackspace-a.md).

## How to review
Find every place a domain, zone, or hostname is written to a tenant record. For each, confirm the invariant: a binding is only created or activated after the claimant proves control via a DNS TXT record, NS delegation, or registrar check, and that proof is re-validated before dependent features act on it. Check that dependent features (mail, certs, routing) enforce the same check independently rather than trusting the stored binding [E2](https://bugbountylibrary.com/r/h1%3A1419341.md). Check for unlimited claims per account, which enables mass pre-registration [E3](https://bugbountylibrary.com/r/h1%3A312118.md). Check whether the API enforces what the UI flag implies [E4](https://bugbountylibrary.com/r/h1%3A1700276.md).

## Variants seen
- Managed DNS zone re-creation after deletion, with NS still delegated to the provider [E1](https://bugbountylibrary.com/r/blog%3Athehackerblog-com-the-orphaned-internet-taking-over-120k-domains-via-a-dns-vulnerability-in-aws-google-cloud-rackspace-a.md).
- Email routing configured on an unverified zone, overwriting the owner's config [E2](https://bugbountylibrary.com/r/h1%3A1419341.md).
- Mass pre-registration of custom domains on a PaaS, hijacked when DNS later points there [E3](https://bugbountylibrary.com/r/h1%3A312118.md).
- Custom hostname added via SaaS API without zone ownership/active check [E4](https://bugbountylibrary.com/r/h1%3A1700276.md).

## Why fixes fail
E2 shows a fix gap: ownership verification existed for zones but was not enforced when creating email forwarding rules, so a dependent feature bypassed it. E4 shows a UI gate removed client-side exposing an unvalidated backend.

## Impact and severity
High: interception of all inbound email for a domain [E2](https://bugbountylibrary.com/r/h1%3A1419341.md), takeover of 120K+ orphaned domains [E1](https://bugbountylibrary.com/r/blog%3Athehackerblog-com-the-orphaned-internet-taking-over-120k-domains-via-a-dns-vulnerability-in-aws-google-cloud-rackspace-a.md), mass domain hijack [E3](https://bugbountylibrary.com/r/h1%3A312118.md), and serving attacker content on provider subdomains [E4](https://bugbountylibrary.com/r/h1%3A1700276.md). Severity rises with scale (unlimited claims) and with silent mail interception.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Athehackerblog-com-the-orphaned-internet-taking-over-120k-domains-via-a-dns-vulnerability-in-aws-google-cloud-rackspace-a.md
- E2: https://bugbountylibrary.com/r/h1%3A1419341.md
- E3: https://bugbountylibrary.com/r/h1%3A312118.md
- E4: https://bugbountylibrary.com/r/h1%3A1700276.md