We are running a Discourse instance on our server, but we’ve encountered an issue where anyone can take our server’s public IP and create an A record on their own domain, effectively pointing their domain to our forum.
We want to ensure that only our authorized domain can be used to access the forum and prevent unauthorized domains from working.
What are the recommended ways to enforce domain restrictions in Discourse? Is there a configuration, Nginx setting, or other method to achieve this?
Yes. That’s the expected behavior and it appears to be the actual behavior. As far as I can tell you don’t have a problem. And most browsers will default to https: and https://hijackeddomain.com will generate a certificate error.
Yes, but nothing happens. Totally same thing that you have right now someone knocking using ssh, bots etc.
If you set up such site/forum then yes they would send visitors who would see what ever you started using that domain. But they can’t hijack your domain, because you are telling to world wich nameserver that domain uses and to what IP it is pointing. And there is web server letting visitors in, if they are requesting such site you are configured for that domain. If request domain doesn’t get anything then doors stay closed.
I understand that was just an example, but that spesific situation is impossible, because you own domain get.it and its nameservers dont know such DNS that would point to hijack.get.it`
