Github pages with custom CNAME security

Question

Github allows you to host static pages on your own domain name. The procedure is described here: https://help.github.com/articles/setting-up-a-custom-domain-with-pages

It mentions that you have to create a file called CNAME in your repository to make sure your domain is mapped to this repository.

What would happen if someone else would create a pages repository with your domain name in their CNAME file? Would they be able to hijack your domain this way, or will Github forever associate this domain name with your repository?

Ernieernst

Answer 1

First of all, if you take the CNAME first, you're safe. GitHub Pages will raise an error to anyone who would try to create the same CNAME file. This if a bit frustrating with forking such repository.

On the second hand GH Pages recently added an option to set DNS to a specific account, using CNAME DNS record instead of A like this:

www.example.com   CNAME   username.github.io

Checkout the page you mentioned for more info: https://help.github.com/articles/setting-up-a-custom-domain-with-pages

Terat

be careful also if you have a repos to publish on a subdomain but delete it or rename it or transfer it to another owner. The change will unlink the repos and the gh pages subdoamin. Then the domain is open to be claimed again an if you still have your CNAME record in your DNS, anyone can setup a domain and add the CNAME file and get served on your subdomain. -> never delete a repos without deleting the DNS entry. see medium.com/@jehy/… – Elias

Answer 2

Currently accepted answer is partially wrong.

Yes, you are safe as long as you claim domain name first and as long as it is set up in you repository.

But linking CNAME to specific account just does not do anything. It could work in past, but now it is simply broken. Even if you set up CNAME with your account name, anyone can still use your domain if you did not set it up in your repository. You can check my detailed post about this problem here.

Reboant