Allow Remote Domains

[crypton]

I run cpanel server and name server separately.

When I tried to add an addon domain, this error occurred.

the domain is already pointed to an IP address that does not appear to use DNS servers associated with this server. Please transfer the domain to this servers nameservers or have your administrator add one of its nameservers to /etc/ips.remotedns and make the proper A entries on that remote nameserver.

I added my name servers in /etc/ips.remotedns and want to turn on [Allow Remote Domains] function to allow clients to use anyone's name server.

What security risks does it cause to turn on [Allow Remote Domains] function?

 

[ThinIce]

In the main I believe the risk is associated with things like locally created mail destined for the remote domain in question suddenly being collected locally rather than routed legitimatly to the domain's real MX servers. Impersonation and fraud would then be a risk.

You'll notice a bunch of common internet domains in /usr/local/cpanel/etc/commondomains and it would be a very good idea to list your own domains within /var/cpanel/commondomains (a version of the file that doesn't get overwritten by updates) if you're going to enable this.

I'd personally view it as a good idea to review each new account / parked / addon domain as it's created, if you get fraud orders you may well see domains for things like foreign banks.

Be interested to hear any other downsides anyone cares to mention

 

[crypton]

In the main I believe the risk is associated with things like locally created mail destined for the remote domain in question suddenly being collected locally rather than routed legitimatly to the domain's real MX servers. Impersonation and fraud would then be a risk.

You'll notice a bunch of common internet domains in /usr/local/cpanel/etc/commondomains and it would be a very good idea to list your own domains within /var/cpanel/commondomains (a version of the file that doesn't get overwritten by updates) if you're going to enable this.

I'd personally view it as a good idea to review each new account / parked / addon domain as it's created, if you get fraud orders you may well see domains for things like foreign banks.

Be interested to hear any other downsides anyone cares to mention

Thank you very much!

I'll be careful about new addon domain.