Not confirming email change seems to leave a stale account

1

Zone stuck in an inaccessible account after email change mishap

Setup: I’m migrating ~24 domains to deSEC, one account per domain
(email scheme: dns-admin@<domain>).

What happened:

  1. I registered an initial account (say dns-admin@example-a.org) and created
    the zone example-b.org in it. Records were served correctly.
  2. I then started an email address change on that account, intending to
    rename it to dns-admin@example-b.org, but never confirmed it.
  3. I may also have registered a new account under that same target address
    (dns-admin@example-b.org) while the change was still pending, and possibly
    deleted an account later during cleanup without removing the zone first.

Current state:

  • Logging in as dns-admin@example-a.org shows only its own zone.
  • The dns-admin@example-b.org account is empty; GET /domains/example-b.org/
    returns 404.
  • POST /domains/ for example-b.org returns:
    {"name": ["domain with this name already exists."]}

So the zone exists on the platform, but in an account I can no longer identify
or access.

Questions:

  1. Can support release or transfer a zone from an orphaned/deleted account?
    I can prove domain ownership via the registrar (TXT record, NS control).
  2. Is there any self-service way to determine which account holds a given zone?
  3. Does registering a new account under the pending target address of an
    unconfirmed email change lead to conflicts?
  4. Does account deletion leave zones behind, or should that be impossible?

I’ve emailed support with the details; posting here in case others hit the
same pattern and for any pointers on faster resolution.

2

Which should be example-b.org according to what you wrote?

You did not mention adding any zones to this account. So the result should be expected.

Yep, it exists in the account dns-admin@example-a.org.

So I suspect the email address change dns-admin@example-a.org → dns-admin@example-b.org simply did not happen, because a) you did not confirm the address and b) a new account with this address was created.

You seem to be able to access both accounts. The zone you created is present and seems to work correctly.

So what is the problem — apart from you being somewhat disorganised :wink:?

Yes, as long as you have valid credentials for an account, you can use either the web UI or the API to list the zones. However no method exists to determine the account of a zone. That would be a privacy violation. My recommendation: document your setup!

BTW: Is there a particular reason for setting up ≈24 domains in as many different accounts? If you provide a good reason, you could probably ask deSEC support to increase the limit for an account.

fiwswe

1 Like
3

There exist two accounts now, dns-admin@example-a.org and dns-admin@example-b.org.
Both accounts are empty, showing no domain. If I try to create zone for example-b.org, it says “domain with this name already exists”. For all domains, I have a catchall email. So, I should get any email, even if there were a typo. However, nothing has arrived there. So, where is the zone?

I hope some admin or support person sees this here. I contacted support two days ago. No response yet. I heard it may take several days sometimes. So, I’ll keep waiting.

I also suspect the email change did not happen. Still, I could create an account with the email address I wanted to change the old address into.

4

I’d prefer one account actually. I put that into my mail to their support as well. Still waiting for response :slight_smile: