And lived to tell the tale.
From time to time, I do research into sensitive TLDs. Did you know that CISA publishes an official list of domains in the .gov zone? Look no further than cisagov/dotgov-data.
While going though that list today, I stumbled across cityofmagazinear.gov with these two nameservers:
Hmmm interesting… indeed there are two different domains here, but more importantly, there appears to be a typo!
ns3 is a subdomain of ultraaistudio.com which was already registered - No good.
But ns4 is a subdomain of ultaaistudio.com (no r) and that domain name was fully open to registration!
I realised that any person could simply register this and then effectively control the entire cityofmagazinear.gov zone since the other nameserver was returning SERVFAIL.
Realising the opportunity, I immediately parted with my $9.08 and registered the domain.
Sure enough, after setting up my DNS server, I had full control over the .gov domain.
Of course, I immediately reported it to get.gov and sure enough, just a few hours later, I queried a.ns.gov again:
The zone now shows the corrected domains so it’s good to see CISA takes these reports seriously. Although both of the nameservers are still returning SERVFAIL, so I guess they have some work left to do.