June 30, 2025 - How a suspended domain taught me to understand DNS, WHOIS, and scams.

Spoiler alert, it was not a scam, just I was too paranoid :) (I HATE scams. Get a job dude, don't hurt people.)

When I registered my personal domain, emmakun.com, I never imagined I would learn so much about WHOIS records, nameservers, ICANN email validation, and that how easy it is to panic when things don't work!

It all started with one error:

At about midnight of June 29, 2025, I noticed that my website was not loading anymore. When I tried to visit it, my browser gave me an "ERR_CONNECTION_REFUSED" error. So, I did what any curious researcher would do: I tried to understand the problem and eventually went down the DNS rabbit hole.

I ran WHOIS lookups, checked nameservers, tested my IP address with DNS checkers, and found something odd:

• My domain's nameservers were showing as ns1.emailverification.info and ns2.emailverification.info.
• The root A record pointed to an unfamiliar IP that did not belong to my actual web host.

It turned out my domain was on serverHold, an ICANN status that basically suspends a domain when the contact email has not been verified correctly.

The suspicious email…

The scary part? I remembered that several days earlier, I received a "Final Request for Email Address Validation" email that landed in the SPAM folder. It looked suspicious:

• The link was HTTP, not HTTPS.
• The sender domain was emailverification.info, which sounded odd to me.
• I had already verified my email address when I registered my account with my hosting provider.

I did not click on the link, as I was convinced it was a scam.

What I learned digging deeper:

• The ICANN policy for .com domains really does require that you validate your WHOIS contact email within 15 days of registration or a change — or your domain can get serverHold status.
• Some registrars (or their wholesale backend providers) do use separate domains like emailverification.info for this, so it can be legitimate!
• The real difference? A legitimate link will always be HTTPS and traceable to your actual registrar's brand. If you are ever unsure, it's safest to ask support before clicking.
• Scammers use the above info to steal your domain. Simply they send an e-mail that looks like an ICANN e-mail asking validation, then if you are not careful they steal the data. I HATE scammers. Get a job dude, do not hurt people.

How I solved it:

I did what I could:

• I opened a detailed support ticket to my registrar with all my findings on the morning of June 30.
• I explained my concerns about the suspicious link.
• I carefully watched my WHOIS status, nameserver delegation, and propagation.
• I waited (and waited!) for the DNS and root WHOIS records to update.

In the end, my registrar confirmed the email was real, they re-sent the validation link, I confirmed it, and the serverHold status lifted. Big thanks to Rackhost for their helpful and smooth support!!

The result?

My domain became alive again within 3-4 hours after writing the support ticket: https://emmakun.com/
The WHOIS check seems okay, the SSL certificate works. Everything is secure.

What I would share with anyone:

• Don't panic (as we all learnt from Douglas Adams's The Hitchhiker's Guide to the Galaxy series), if your site goes down!
• Always check your WHOIS, DNS, and nameserver delegation.
• Understand what serverHold means: in my case it was about missing ICANN email verification.
• If in doubt, don't click shady links - ask your registrar instead.
• Propagation takes time. Sometimes you really do have to wait 24–48 hours.

🎉 Lesson learned:

One little problem can teach you a LOT about how the internet really works.
Domain Delegation Flow: ICANN->Registrar->Root Zone->Nameserver Delegation->DNS Zone->Web Server

Thanks for reading, maybe my story will help you too!