Transferring eNom domain with associated Google Apps services to Dreamhost: 2015 Edition

It’s hard to imagine now, but once upon a time Google gave big stuff away. Until Dec 2012 anyone could get extended family Google Apps services and a companion domain for a pittance — $10 a year.  Today I still have most of the features of Google’s $50/user/year ’Apps for Work’, but I only pay for domain registration. [4]

Naturally I acquired quite a few Google Apps services, either directly from Google or through Dreamhost (referral link) [1]. Today I still have 10 Google Apps suites. 

The ones I got directly through Google were registered with eNom. This worked reasonably well until Google ended their first generation payment systems, so each eNom account had its own payment data and was completely independent from all others. Since then I’ve been slowly migrating accounts from eNom to Google.

Very slowly! I last moved a Google Apps associated eNom domain in 2009. Yeah, six years ago. [2] Over the past few weeks I’ve moved two more, enough that I’m getting the hang of it. The process is similar to what I wrote about years ago, but there are some added security steps.

I’m going to try to document what I did here — as much for me as for anyone else. Don’t trust what I write though — read Google’s documentation as well, they include registrar specific advice as well:

• Your domain host - Google Apps Help 
• Access DNS records from a partner host - Google Apps Help 
• Transfer your domain to another host - Google Apps Help
• Add a CNAME record - Google Apps Help
• Avoid bounced messages from new MX records - Google Apps Help
• Set up MX records - Google Apps Help
• Set up MX records (host-specific steps) - Google Apps Help

Key Concepts 

If you understand these concepts things are a lot simpler:

1. There are 3 independent services involved in this process:
1. Google Apps services
2. DNS services (primarily CNAME and MX, the latter is email specific and is particularly old and crotchety).
3. Registrar services (ex: management of kateva.org, including pointing to DNS services for Kateva.org wherever they might be.)
2. One business could provide all 3 services [3] or each service could be with a different service. Throughout the process below Google provided Google Services, but I started out with eNom providing both DNS and Registrar services. Then I moved DNS services to Dreamhost. Seven days later Registrar services completed their move to Dreamhost.
3. The things that connect a Domain to Google Apps are…
1. Google stores the name of the domain in its records
2. DNS entries that point to ghs.google.com. When you enter a URL the Domain Name Server sends the request to ghs.google.com, it looks up the domain name and handles it. (Similar magic for MX records).

Steps to follow

This assumes you’re paying for full featured Dreamhost hosting [1]. Quick steps here, more notes below.

1. Go to eNOM domain settings on Google Apps. Confirm contact information email works. Don’t use contact email that belongs to the domain you’re moving.
2. Go to Dreamhost, add the domain you’re going to move to Domains Hosted per DreamHost CNAME record instructions as a fully hosted domain under your Dreamhost username. Yes, you can and should do this before you actually move the domain. You’re setting up DNS services at Dreamhost and soon you’ll tell eNom to use those instead of eNom’s native services.
1. Go to Manage Domains and “Add Hosting” choose Fully Hosted. I put everything under my one username.
2. Click the box for Google Apps. Dreamhost will configure standard CNAMEs and especially MX records.
3. Add additional CNAMEs as needed: calendar, docs, drive, blog based on what you see in your eNom records. Don’t need to repeat DomainKey entry used to verify with Google (?). The A record that Dreamhost creates is used to redirect the naked domain to ‘www’.
3. Go to eNom settings and change eNOM DNS information to use Dreamhost. (ns1.dreamhost.com, etc) Once you do this eNom is now only your registrar.
4. Confirm DNS still works and can send email to address in domain. I’m not sure how long this takes, 
5. NOW, Request unlock of the eNom domain by email (see example below. Yes, by email and include your eNom password!). Once this is processed you’ll get two emails from Google, one with authorization key (EPP key).
6. Go to Dreamhost Reg Transfer, request transfer using the EPP key and complete form. Pay for new registrar service, seems to vary from $10 to $10 depending on domain. Initiate transfer. You’ll see a notice that a 7 day countdown has begun. Dreamhost shows something like this:
    
7. About 30-40 min later you’ll get an email from Dreamhost at your official domain email contact that you verified above. Click the link. Go to approval page. Agree. See “your response has been recorded”
8. Receive notice from Google in 1-2 hr (no action required unless wish to cancel)

   STANDARDIZED FORM OF AUTHORIZATION
   DOMAIN NAME TRANSFER - Confirmation of Registrar Transfer Request

9. Receive notice after 7 days that is complete. Now go to Dreamhost. Lock the domain. Enable auto-renewal. Test email and google services.
10. LAST: Google tries to renew registration, fails, sends note domain moved. However, Google never fixes up its Domain settings on the legacy account, they always show “enom” (sic) as registrar.

Sample of eNom letter

GoogleClients@enom.com

Please unlock this domain, disable Google ID Protect, and send authorization code. Thank you!

Domain : yourdomainame.com
Password : u5yhtt5p965965 (your eNom pw, not your Google pw. Get this from Google Apps Domain Settings.
Customer service PIN : (if you know it, optional)

This is what eNom sends if you ask how to proceed.

 Greetings ,

To transfer your domain, you're going to need the domain to be unlocked and the authorization code for the domain. I can assist you with both of those if you can give me the domain password that Google supplied you. (Note: this is NOT your Google Apps login password.)

When you registered the domain, Google set up a privacy protect service and I will disable that in order for the transfer to be successful.

Also, please be aware that in order to transfer the domain, it needs to be 60 days after registration. This isn't an eNom-specific rule - this is a rule for all registrars set by ICANN.

Please e-mail me back with the domain name and password and I can get started on getting you the information you need.

If you don't know your domain password, follow these steps to find it:

Enter your domain name at the access login screen (http://access.enom.com), with AAA as the password, then copy the verification code. Click "Log In" to submit the information.

Put the name in again and then click on the "forgot password" link and it will be emailed to you at the address on file with Google for your domain name.

***IMPORTANT: Remember log into your domain manager at http://access.enom.com to ensure your Registrant and Administrative contact information is valid BEFORE transferring the domain name***

Alternately, IF YOU DID NOT CHANGE THE PASSWORD, you may also recover your Google domain password using the following steps:

To access your Advanced DNS settings, please follow these steps:

Log in to your account at admin.google.com.
Click on the Domains icon on your Admin console dashboard. You may need to click on More controls at the bottom of the screen to find the Domains icon.
Click on the Advanced DNS settings link associated with your Primary Domain.
To make changes to your DNS settings, sign into your DNS console with the login information provided on this page.
When you access Advanced DNS settings, you'll be directed away from Google, and to the domain registration partner that registered your domain name. This is currently available in English only.

Regards,

Google Advanced Domain Support

Provided by eNom, Inc.
email googleclients@enom.com

and this is what you get from eNom after you unlock:

Thank you for proper verification of domain ownership by supplying the domain password.

The domain has been unlocked, ID Protect has been disabled for transfer and your authorization code has been sent to the following email address in a separate e-mail. Please check your spam folder or filters as this is often captured.

***IMPORTANT: Remember log into your domain manager at http://access.enom.com to ensure your Registrant and Administrative contact information is valid BEFORE transferring the domain name***

YOUR EMAIL HERE

If the above email address is invalid, please log into the access control panel (http://access.enom.com) and update the contact information. Once the email address has been updated please reply back at your earliest convenience so that we may resend the EPP/ Authorization code.

Your domain is ready for transfer.

As a note: the transfer process does take 5-7 days for the domain to arrive at the gaining registrar. Once started by you, there is nothing you need to contact us about again. You can however ask us to confirm if the domain is pending transfer should you need to check.

DNS Result after setting up in Dreamhost as fully hosted with Google Apps services

Additional Custom CNAME (copied from eNom) that I added (some, like ‘sl’ are really exotic. Don’t worry about it.)

Miscellaneous artifacts

Some sample email excerpts:

-

We have requested your domain.com to be transferred to DreamHost! First, your admin contact will receive an email with a link to approve the transfer from us. They will then receive another email from the current registrar with instructions on how to approve the transfer from their side. Typically, transfers take about 7-10 days to go through. You will receive an email from us when we've learned if the transfer has been approved or denied. Note: If you'd like to also host with us, please visit "Manage Domains" now.

-

Domains must be "unlocked" at their current registrar or the transfer will fail. Domains may not be transferred within 60 days of their initial registration or their most recent transfer! You should do any name server changes (e.g. to ns1.dreamhost.com, etc) before transferring! You must make sure you have access to the admin contact email currently listed for your domain! You will receive an email from do-not-reply@dreamhostregistry.com with instructions on how to complete the transfer to DreamHost. If you do not receive it in a few hours, please check your spam filter. The entire process may take 7-10 days or longer before it is complete!

- fn -

[1] Dreamhost has worked well for me for many years. I you sign up and use my PROMO code of KATEVA you get $50 off the 1st  year (I get $47.)

[2] That freaks me out a bit, I vaguely remember when 6 years was more than yesterday. 

[3] Recently Google began providing domain services itself, but i don’t know much about it.

[4] Ok, so you can still get Google Voice (thought it’s a bit trickier than it once was). That service has saved me thousands of dollars on mobile phone calls to Canada.

Fixing Google Chrome Mac Update Error: 12 - success after years of failure.

I’ve been waging a desultory war on a Google Chrome Mac Update Error 12 bug for years. I can’t remember when Chrome updated itself correctly on my Mac, but I didn’t really dig into the bug. I figured Google would fix it sooner or later, in the meantime I’ve been manually downloading Chrome installers every few months (not a great idea obviously).

Today I gave up on Google and started work on the bug. The key to finding the answer was logging into my admin account, starting Console, clearing the log, then watching what showed up as I started Chrome and opened the About screen while Chrome tried to update and generated the usual error: 12 message. I saw something like this:

 …. CODE SIGNING: cs_invalid_page(0x1000): p=809[GoogleSoftwareUp] clearing CS_VALID …

Searching on that string I found an old AskDifferent post on a related topic. That pointed to 

 /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources

where, like Daniel Azuelos, I found these file dates. 

Yeah, 2012.

The fix is to quite Chrome, delete  /Library/Google/GoogleSoftwareUpdate (root Library, not User), reinstall Google Software Update Installer and restart. Then you get something like this:

Yeah, 2014. A bit better.

Then, still from my Admin Account, I ran Chrome and stepped through several versions of the Chrome About screen:

 

then

Do the relaunch, then ..

Setup up Automatic Updates for All Users (I’ll be impressed if this actually works!):

First automatic update in my memory.

I suspect this problem arose from years of several intersecting bugs — some belong to Apple’s famously buggy permissions infrastructure, some related to how Google interacts with people who run OS X as non-admin users, some related to how Google Chrome/Updater manages install errors, some related to how Google mangled OS X Library structures over the years.

Once I’d fixed the problem I read Google’s tech support note more carefully (with Mavericks/Mountain Lion their sudo instructions only work if you run as admin, they kind of left that out). This is the relevant bit:

Run the following command. Be careful to enter the command exactly as written:

~/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/Resources/install.py --uninstall. It may result in a "No such file error"; the next command will address that.

Now run this following command. Again, carefully enter the command exactly as written:

sudo /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/Resources/install.py --uninstall

The first command runs against the User account library. Google acts like there’s ONE user account on the machine, instead of say, an Admin account and many user accounts. Anyway, I didn’t have anything like that in either my Admin or Non-Admin account.

The second is closer to the real fix, but look back at 2012 files. There’s no Install.py file there. The answer was to delete parent folder in /Library, not to try to run a non-existent installer.

PS. MarsEdit image upload really needs a lot of work. Hope the new competition from Blogo will help. Also, this is relevant.

Work around for the Lion Connect As bug

There’s a bug in Lion that causes all network connections to Connect As the current user. You can’t Disconnect and then get a username/password prompt; if you click Disconnect you’ll briefly see the “Connect As” button flash by. Then you’re back as the current machine account.

I think the bug hits when the username on the Lion machine matches the user name on the remote machine.

There are several workarounds, but this is the easiest for me.

Go to Finder:Go:Connect to Server. Look for something like: 

afp://Molly_afpovertcp._tcp.local

Now put the username you want to use on the remote server in there:

afp://myname@Molly_afpovertcp._tcp.local

Now you’ll be asked the password.

(Yeah, still have a Lion machine. Old dual USB MacBook with a swapped drive. Won’t die.)

How to find the damned MAC address for an Airport client so you can configure access times

There is such a thing as too few features. 

Apple stripped a lot out of Airport Utility between v5 and various v6 iterations. Among other things they made it much harder to find the MAC address for a connected device. You need this address to control access times.

The trick is to Option-double-click the base station to get the Summary tab, from which you can see the MAC address. You can’t copy paste that address however. To do that run the terminal command [arp -a]. Look up the IP and MAC address, that you can copy paste.

Of course you may find copy-paste isn’t all that useful. I tried a copy-paste operation into the MAC address field of Airport Utility 6.3.2 and the “Save” button stayed unclickable. I had to type the MAC address in character by character to enable the Save button.

Dumb. Really.

iTunes Cloud videos not showing up? Maybe you're over the device limit Apple is now enforcing.

Recently Apple revised their US family sharing policy … "… up to 10 devices per account, only five of which can be computers … Not all products, including In-App Purchases … eligible for Family Sharing. “

Recently I think I ran into the policy limits. All of our family devices use a single iTunes account, but I’ve not run into trouble before. I think Apple has changed more than the Family Sharing policy. I think the new limit applies to wise old timers who’ve always used a single iTunes ID for the entire family (though everyone has their own iCloud account).

There’s no error message, instead my son’s iPhone 5 simply failed to show our Cloud video resources (TV/Movies). It would only show what was on the phone.

This happened after we introduced an i6 to the family. Emily doesn’t want anything bigger than a 5, so she got my 5s. Most importantly #2 finally got rid of his dying 4 in favor of a fairly fresh 5. 

Except the 5 wouldn’t show his Cloud video. They simply weren’t there. Signing in and out of the store did nothing.

So I pulled his old 4 out of the reserve bin and logged out of iTunes there. A few minutes later the videos showed up on his 5.

Looks like we went over the (new) limit. Turns out it’s not simply for Family Sharing, it’s for devices associated with an iTunes account.

In our case we have 6 active iPhones, 1 Apple TV and 3 Apple computers. We seem to be right at the 10 device limit, so #2’s old 4 pushed us over the limit.

It’s not documented but the iTunes App Store account information now provides some info. According to Account info we had 4 authorized computers and 10 devices. The device detail list provides some policy information:

There’s no additional information on the 4 authorized computers. I know of 3 and an Apple TV. I could reauthorize them all and reauthorize but that’s a bit of a pain.

Interestingly the 10 devices includes 2 computers (should be 3) and doesn’t include the Apple TV or my own phone! It does, however, include several devices no longer in use. I removed all of those, but I needed to figure out why my new iPhone 6 wasn’t on the list.

Poking around with Apple ID on my own phone I saw this: “Enabling Automatic Downloads … or downloading a previous purchase … will associated this device with your Apple ID for use with iTunes in the Cloud”. So I launched a video and updated an app on my iPhone 6 Sure enough, I now show up on the list.

So we are again under the limit — for the moment. Buy some iPads though, and we’ll be in trouble. I think we’re done buying iOS devices for a while. We need to stay under the limit. The limit is likely to fall; the RetinaLock [1] screws are tightening…

… patent pending 2040) RetinaLock™ (Palladium Inside!™). The RetinaLock™ prevents any access to DRMd material by control of visual inputs. BrainLock does the same for auditory, tactile, and olfactory inputs. BrainLock Enhanced™ (mandatory upgrade 2045) makes it impossible to consider any action that would circumvent the workings of the BrainLock™ (thereby ending the trickle of death sentences related to violations of the DMCA amendment of 2043). 

[1] Incidentally, Google couldn’t find that 2005 blog post. Duck Duck Go had it #2 on the list.

Update 2/27/2015: I wonder now if the syncproblems I saw four months ago were related to bugs with Apple’s implementation of this device cap.

Aperture 3.5.1 empty project bug - a workaround

Maybe this is fixed in 3.5.2 — but I doubt it. This bug has been around for years.

Periodically Aperture will show a project as empty on opening — event though an image count is displayed and images scroll if you mouse over the project. It’s a dangerous bug, with some configurations it would be easy to accidentally delete an image filled project.

The usual fix is to restart Aperture.

The only other fix I’ve found is to create a truly empty project, then drag the apparently empty project into it. All the images reappear.

Clearing thousands of Star tags from Gmail - two techniques and notes on Star support in OS X, iOS and Airmail.

Remember Inbox Zero?

Perhaps you’re there. Maybe, by dint of filters, of carefully constructed responses, of terror induced in potential correspondents, you’ve finally achieved productive nirvana.

You’re feeling good about it. Proud perhaps.

I’m here to ruin that. Because beyond Inbox Zero lies Sentbox zero.

In Outlook Sentbox zero means the “Sent” folder has no emails in it save those awaiting a response. They may have a flag that goes red 2 days after initial send. All other Sent emails have been deleted or (most often) dropped into the “keep” bin [2].

In Gmail things work differently. I don’t have/use folders; I make sparing use of a handful of tags. So I need a different way to tag sent emails that are awaiting a response.

There are several ways to “tag” such emails. I could use a Gmail tag/label, or a star, or a priority flag. The Star option is quick and synchronizes well across Google Gmail desktop, Google.app on OS X, and Mail.app on iOS and OS X (alas, Airmail doesn’t quite work [1]). So I went with the Star.

The problem was that I had 4,500 stared emails in Gmail - largely from 2007 and prior. Maybe in those days I used the star? Maybe Google automatically set it? Long ago, but I needed to clear them out.

My web searches for a quick way to clear 4,500 flags failed. app.net@jwssuggested using an undocumented? Gmail keyboard shortcuts (edited here):

If you use desktop web UI with shortcuts, search is:starred or whatever and then *a to select all. Gmail then provides a link/offer to select all results, not just those on page. 

Once you’ve selected hitting ’s’ will toggle starred status.

I couldn’t test however, because I’d already used OS X Mail.app to clear the Stars. In Mavericks Mail.app maps the Star to a “red” (Default) flag — so I elected all of those and cleared the flag. Mail.app then updated and cleared the Gmail flags.

No that my Flags are cleared, I can create and clear flags on my Sent emails that are awaiting a response. So now I can implement Sentbox zero-equivalent on Gmail.

- fn - 

[1] My copy of Airmail did not have a STARRED folder mapped to Gmail Star status. I had to create one using an obscure method. Pick any email and “star” it. Assuming preferences has Automap enabled, a new starred folder is created. On restart Starred now shows in the Folders section of the app title bar. Unfortunately it does’t work correctly, items starred in Gmail web app don’t appear in Airmail.app Starred folder — updates are one way from Airmail to Gmail. Fail.

[2] Not filed of course. Subject line is precisely correct and has key words used by search, retrieval will be by metadata search.