Domain name security

How do I obtain a commitment letter for a domain name?

If the National Computer Network Emergency Response Technical Team/Coordination Center of China (CNCERT) requires a website cleanup report, download the Website Cleanup and Rectification Report. Complete the report and email it to cncert@cert.org.cn for review.
If authorities require documentation for a domain used for access outside the Chinese mainland, download the Letter of Commitment for Using a Domain Name for Access from Outside Mainland China. This document serves as a declaration that the domain name is used for a website that is accessed from outside the Chinese mainland.
If authorities require documentation for a domain used for non-website purposes, download the Letter of Commitment for Using a Domain Name for Non-Website Purposes.

How do I obtain an appeal letter for a malicious domain name?

If the China Internet Network Information Center (CNNIC) penalizes your website for harmful content, download the Malicious Domain Name Appeal Form Template, complete it per the instructions, and send it to service@cnnic.cn.

How do I resolve disputes over Chinese domain names?

According to the CNNIC Domain Name Dispute Resolution Policy, two CNNIC-certified providers handle Chinese domain name disputes: the China International Economic and Trade Arbitration Commission (CIETAC) Domain Name Dispute Resolution Center and the Hong Kong International Arbitration Centre (HKIAC). Contact either provider to request arbitration.

Note

When filing with CIETAC, enter the registrar's email on the application form. For Alibaba Cloud domains, use domaindisputes@service.aliyun.com.

How do I diagnose and handle DNS hijacking?

A DNS server resolves domain names into IP addresses so your browser can reach the correct server.

In a DNS hijacking attack, an attacker intercepts DNS queries to block access or return incorrect IP addresses, redirecting users to malicious websites.

If you suspect DNS hijacking:

Run nslookup (Windows) or dig (Linux) to verify that the domain resolves to the correct IP address.
Use third-party diagnostic tools to assess the scope and report to your ISP. Try switching your DNS resolver to Alibaba Cloud Public DNS (223.5.5.5 and 223.6.6.6) to test resolution.
For urgent access, connect to the service directly using its IP address.

Note

Carrier complaint hotlines in the Chinese mainland:

China Mobile: 10086
China Telecom: 10000
China Unicom: 10010

Why is SMS verification required for configuring DNS settings?

Alibaba Cloud requires SMS verification when you change DNS settings from an unrecognized device or network to prevent unauthorized modifications.

If you cannot receive the verification code:

Wait a few moments for possible network delay, then request a new code.
Verify that your mobile service is active and not suspended for overdue payment.
Check whether security software on your phone is blocking the message.
Try your SIM card in a different phone to rule out a device issue.

If your mobile phone number is no longer in use, you can change your secure phone number.

What should I do if my domain name is stolen?

If your domain name was transferred without authorization, contact the current registrar immediately. If it was registered with Alibaba Cloud before the transfer, Alibaba Cloud will assist with recovery. The process depends on where the domain was transferred.

Scenario 1: The domain name is in a different Alibaba Cloud account

Contact us immediately. We will lock the domain name to prevent further changes or transfers. You must provide documentation proving legitimate ownership.
Scenario 2: The domain name has been transferred to another registrar
- Contact Alibaba Cloud
  
  If your domain was transferred from Alibaba Cloud without authorization, contact us immediately with proof of ownership and theft evidence (such as a police report). We will request the gaining registrar to lock the domain, preventing further changes or transfers.
- Contact the current registrar
  
  Contact the current registrar to file a theft complaint. Use a lookup to identify them. Provide proof of ownership, which may include ID documents and a signed recovery statement. For registrars outside China, submit documents in English.
  
  After verification, the registrar will investigate. If they confirm the theft, they will coordinate with Alibaba Cloud to return the domain to your control. You can then manage the domain name at the new registrar or transfer it back to Alibaba Cloud.