The ZA Central Registry (ZACR) launched a registry lock on 15 September 2020 for .ZA, .AFRICA and the dotCities (.joburg, .capetown and .durban).

The launch details were a bit thin and the ZACR support staff seemed unsure of internal procedures based on questions we put to them. We then decided to test the registry lock process so we could evaluate its practicality and security for our clients.

Scope of Test

We would lock our domain name lexsynergy.co.za monitoring response times and adherence to procedures and thereafter unlock the domain name. Support services are crucial when offering a registry lock service as updates may need to be made urgently and at odd times. Delays could result in downtime, interruption of services and potential losses for the business using the locked domain.

Locking Timeline

15 September 2020

Action

Result

12:00 – Lock request made via the ZACR portal

Portal error

12:02 – Contacted ZACR about the issue

-

12:48 - ZACR responded

Portal issue was fixed

14:17 – Lock submitted

Lock request recorded on the ZACR portal

16 September 2020

Action

Result

15:13 – ZACR Legal Department contacted Lexsynergy

ZACR apologized for not actioning the request due to an internal issue

15:52 – Lock was confirmed with a passphrase setup

 


Total time to process: 27 hours 52 Minutes

Unlocking Timeline

19 September 2020

Action

Result

23:48 – An unlock request submitted

No response from ZACR

22 September 2020

Action

Result

14:45 - Lexsynergy emails ZACR to follow up on unlock request

-

15:45 - ZACR Legal Department calls Lexsynergy

Domain unlocked during the call

THE ZACR DOES NOT LOG THE LOCKING/UNLOCKING ACTION.

Total time to process: 2 Days 15 Hours 57 Minutes

Conclusion

ZACR is not ready to offer a registry lock service and domain name registrants should be wary before taking out a lock. It was concerning that the ZACR support staff were slow to respond and there seemed to be an apparent disconnect between the ZACR portal and their support staff. The registry confirmed telephonically that the service is NOT 24/7 with requests being handled “within 24 hours” and only on business days (Monday to Friday).

We are of the opinion that a registry lock is essential for safeguarding a domain name but the lock process should not pose a risk in itself, which it currently does under the current ZACR system and processes.

Domain names are core to a business and the organization managing a Top Level Domain such as ZACR should implement robust testing before launching a time-sensitive and mission critical service. Staff should also be well versed with the procedures as a lack of knowledge could result in breaches, unauthorized or delayed locks and unlocks.

We will review the locking/unlocking process in a few weeks to evaluate whether the issues we identified have been rectified.