Watch the video, transcript and sources
- Namecheap locks a 12-year account
+ Let's Encrypt: seven checks
- .com price lawsuitYou think domains you've renewed for twelve years are yours. A Namecheap customer says one missed email locked all of them, and his inbox with them. Namecheap is a big domain registrar; in 2025 private equity firm CVC agreed to buy a majority stake at a valuation around $1.5 billion. That lockout leads today's diff, then Let's Encrypt adds more vantage points before it trusts your domain, and a lawsuit asks why .com keeps getting pricier.
The notice. In his r/sysadmin post, the customer quotes Namecheap's email: his account was "flagged to be a part of our routine account information accuracy check-up" and "locked pending your response to the requests for documentation below." He says it gave him 72 hours for ID verification, and he was away for a few days. He came back to dead servers, sent the documents, and a day later still had "no ETA, no reason, nothing." Support chat kept deferring to a risk management team that, chat said, only works by email.
The chain. The account holds the domains. The domains run his servers and his mail. And the account's contact email lived on those same domains, so the lock cut the channel Namecheap uses to reach him. He paid another host just to get email working again. Getting a backup address added over chat took about four hours, and he says nobody asked him to prove he owned the account. An identity check, where changing the email needed no identity.
The clocks. ICANN's registrar contract treats more than fifteen days without answering accuracy inquiries as grounds for suspension. Namecheap's own agreement says five business days. His email, he says, gave 72 hours. Namecheap hasn't said which rule it used, the post has no update saying the account is back, and I found no public reply from Namecheap. So this is one customer's side.
The fix for your own setup is boring and cheap: put your registrar login email on a domain that registrar doesn't hold, keep a phone number current, and treat any compliance email like an outage. It wouldn't stop an ID check; it shortens the time between the notice and your answer.
Let's Encrypt will make seven validation requests per check: one from the primary data center and six from remote perspectives, up from four. The primary and a quorum of the others must see the right answer, which makes a briefly hijacked network route much less useful. Staging starts October 27, production November 10, ahead of an industry rule requiring at least five remote perspectives from December 15. Let's Encrypt expects little to no impact; a firewall that blocks whole regions is where you'd notice.
Verisign. Last month I stamped Verisign's deletion of paid-up .name domains a REVERT. Now a class action in federal court in Los Angeles targets Verisign and ICANN over .com prices. The plaintiffs say the wholesale price went from $7.85 to $10.26, that a .com costs Verisign about $3 to run, and that every registrar pays the same fee, Namecheap included. These are allegations; nothing has been proven in court.
The sentence in the contract. Namecheap's agreement says that if it has grounds to suspend one domain or service in your account, it "may terminate or suspend all Service(s) provided through your account, including Service(s) to other domain names." That's how one locked account takes everything with it.
Verdict: REVERT — If his version holds up, a 72-hour lock that also kills the inbox you need to answer it is broken design. Verify people, fine, but leave them a way to reply.
Sources
https://www.reddit.com/r/sysadmin/comments/1x8cycd/namecheap_just_seized_and_disabled_all_my_domains/
https://news.ycombinator.com/item?id=50142866
https://www.namecheap.com/legal/domains/registration-agreement/
https://www.icann.org/resources/pages/approved-with-specs-2013-09-17-en
https://webhosting.today/2025/09/12/cvc-acquires-majority-stake-in-namecheap-for-1-5-billion/
https://community.letsencrypt.org/t/lets-encrypt-is-adding-two-additional-remote-perspectives-for-domain-validation/252166
https://news.ycombinator.com/item?id=50150809
https://www.hbsslaw.com/cases/verisign-com-domain-name-registry-consumer-class-action
https://news.ycombinator.com/item?id=50148441
And that's the diff for today. I'm Niko from Axrisi. Merge responsibly.
YouTube · Newsletter · thedailydiff.dev · forward this to the intern who deployed on Friday.