Two names¶

Before the move, the Home had one name, homeforbeasts.am, and everything hung off it: the address the donors wrote to, the address the registrar and the bank recovered through, the staff logins, and the zone that held the tenant’s records and nothing else. It had been registered in the early years by Kevin’s aunt, who had helped set up the shared mailbox and had never been asked for the password back. Nobody still in the building knew which registrar held it, whether DNSSEC was on, or what would happen on the day the renewal card expired. The scraps for this layer say what the first stack’s naming page says, and then something it does not: a name is the layer everything else hangs off, and a charity with 200,000 correspondents cannot move house the way a one-woman company can.

Whose street¶

.am is the city’s own registry, Ankh-Morpork’s, and that was the first scrap and the shortest. Purple Lantern’s old name sat in a US namespace and had to leave it. The Home’s name sits in the namespace of the city it is in, under the city (state)’s rules, with no US registry on the road. Whether that is enough depends on what the name is for, and the Home’s name is for two things that turned out not to want the same treatment.

The registrar¶

The registrar was found by reading the zone’s SOA record and then an old invoice. The account recovered through Kevin’s aunt’s mailbox, which Kevin’s aunt still had. The account went onto the recovery mailbox at Posteo, with a second factor, and the registrar’s page was read for DNSSEC and registry lock. What the .am registrar offered went into the notes as it was found, and where the registrar’s page said nothing, the note says that the page said nothing. The renewal moved from Kevin’s aunt’s card to the Home’s bank, by transfer.

Why two¶

Purple Lantern registered a .eu, moved everything under it, and left the old name to redirect until the links elsewhere stopped pointing at it. The Home cannot do that. Two hundred thousand members and donors write to homeforbeasts.am. The Adopt-a-Legend welcome packs carry it in print. Standing orders and a few wills name it. Chapters across the Disc hand it out in places where the Circle Sea’s writ does not run, and a name that changes is a name that can be impersonated in the gap. The public name has to stay, for as long as the Home exists, and that is a different problem from Purple Lantern’s, because a name that has to stay is a name that can be taken and hurt.

So the public name stays public, and stops being anything else. A second name, under a registry and a registrar that share nothing with the first, carries what the Home cannot afford to lose along with its front door: the identity provider’s hostname, the staff logins behind it, the recovery routes, and the internal names of the four landlords. The first name can be seized at a border, suspended by a registry, or lost to a lapsed renewal, and the Home loses its front door for as long as it takes to get it back. It does not lose its files, its chat or the means of logging in to any of them, because none of those are under the name that was taken.

The second name¶

The second name is a .eu, under EURid, the registry appointed by the European Commission and seated in Diegem, with registry lock and DNSSEC switched on through the registrar and a registrant portal that hands out transfer codes without asking the registrar first. The registrar is TransIP, part of team.blue of Ghent, with its data in the Netherlands and DNSSEC switched on automatically for the names it holds. Not Purple Lantern’s registrar, and not the .am registrar either. Two registries, two registrars, two invoices, and no bank, mailbox or account in common between the two.

The zone for the second name lives at TransIP and at none of the landlords, and it holds only what the identity layer needs: the identity provider’s hostname, the landlords’ internal names, and the records that point them at each other. Nothing a donor would ever type. The apex-record question and the DS record’s behaviour on a move are the same as on the first stack’s naming page, and the sequence for changing nameservers with DNSSEC on is the one in RFC 6781, kept in the notes for both names.

Which name holds what¶

Public, on homeforbeasts.am: info@ and the donor-facing addresses, the MX records that route them, the website, the addresses in the welcome packs and on the coffin by the door. Identity, on the .eu: the identity provider, the staff logins, the internal names of the file store, the chat and the mail administration, and the routes by which each of those recovers. On neither: the recovery mailbox at Posteo, which the mail page places on Posteo’s own domain so that it survives the loss of both.

One consequence took the Head of Fundraising a moment. Staff still send and receive as @homeforbeasts.am, because that is the name people know, and the mail provider serves both names. A donor does not see the second name. An attacker who takes the first name gets an empty front door, with the house behind it locked from a different street.

Two doors¶

   homeforbeasts.am                                 the .eu
   the city's registry                              EURid, Diegem
   registrar found, account recovered               TransIP, Netherlands, of team.blue
         │                                                │
   info@, donor mail, MX, the website             identity provider, staff logins,
   the welcome packs, the coffin                  landlords' internal names, recovery routes
         │                                                │
   can be taken; the front door                   can be taken; the locks, and then the
                                                  first name is only a front door too

   on neither: the recovery mailbox at Posteo

Both names have DNSSEC on, and both are paid by transfer from the Home’s bank, on separate invoices.

What could go wrong?

The city’s registry suspends the public name, and the donors’ mail bounces until it is back, while the staff keep working and the case histories never moved.
TransIP or EURid suspends the identity name, and the staff cannot log in until the identity provider is reached by another name.
A chapter’s host country seizes the public name at its border, or orders a local block, and the chapter reaches the Home by the second name, which nobody in that country was ever given.
The two registrars turn out to share a bank, a parent or a datacentre, and the two names were one name with two invoices.

The public name is gone, what now? Mail to the donors bounces and the website is dark. The identity provider, the logins, the files, the chat and the recovery routes are untouched, because they were never on it. The Home tells its members what happened by the channels that do not run through the name, works to get it back through the city’s registry and the Home’s own lawyers, and meanwhile is still a working charity with a locked front door and no name over it.

Granny Weatherwax’s cottage has no name on the gate and never needed one. Everyone in Lancre knows whose it is, and the ones who do not are not expected.