Most domain names are lost through controls that were never switched on. The registrar offers multi-factor authentication, the registry offers a lock, the DNS provider supports signing, and the account sits for years with a shared password and a renewal notice going to someone who left. This guide explains how to secure a domain name in a single afternoon of focused work. It is written for the person who owns the problem at a small or mid-sized organization, and it follows the order we use when we take over a client portfolio. Our domain name security guide explains the threat model behind each step; this page is the working checklist.
Start with the registrar account and the email on it
Before changing anything, find out who actually controls the domain. Log in to the registrar and record three things: the account’s username and the email address attached to it, the registrant contact shown on the domain, and every other user who has been granted access. Then ask the uncomfortable questions. Is the account email a personal address? Does the web developer who built the site hold the login? Was the domain registered by a marketing agency under its own account? In our experience the honest answer is often that no one is sure, and that uncertainty is itself the first vulnerability.
The email address on the registrar account matters more than the password, because the email is how the password gets reset. Whoever controls that mailbox controls the domain. Treat it accordingly.
Move the registrant email to a dedicated, protected mailbox
Create a mailbox that exists only for domain and DNS administration, on a domain you control, and give it a name that does not advertise its purpose. Protect it with multi-factor authentication and make sure at least two trusted people can read it, so a departure or a vacation does not leave renewal and transfer notices unread. Change the registrar account email, the registrant contact and the admin contact to that mailbox. If the mailbox is hosted on the same domain it protects, the DNS controls later in this guide become doubly important, because an attacker who redirects the domain’s MX (mail exchange) records could intercept the password reset for the account that controls the domain.
Turn on multi-factor authentication at the registrar
Once the email is sorted, enable multi-factor authentication on the registrar account. A hardware security key is the strongest option, because it cannot be phished: the key signs a challenge tied to the registrar’s real domain, so a lookalike login page gets nothing useful. An authenticator app is the next best choice. SMS codes are better than nothing but can be defeated by SIM swapping, where an attacker persuades a mobile carrier to move your number to their device. If the registrar offers only SMS, that is a reason to consider a different registrar for critical domains.
While you are in the account, replace the password with a long, unique one stored in a password manager, and review the list of additional users. Each person should have a named login with the minimum permission their role needs. Remove shared logins entirely.
Enable transfer lock and check the status codes
Every registrar lets you lock a domain against transfer, and most set it by default, but you should verify rather than assume. Look up the domain in the registry’s RDAP (Registration Data Access Protocol, the successor to WHOIS for public registration records) or in a WHOIS lookup and read the status codes. You want to see three.
The clientTransferProhibited code tells the registry to reject any request to move the domain to another registrar. The clientUpdateProhibited code tells the registry to reject changes to the domain’s nameservers and contact data. The clientDeleteProhibited code tells the registry to reject a deletion request, which matters because an attacker can delete a domain and re-register it elsewhere. Each of these is set by your registrar and, importantly, can be removed by anyone who can log in to your registrar account. They stop an outside transfer attempt cold; they do nothing against account takeover. That gap is what registry lock, described below, exists to close. ICANN’s Security and Stability Advisory Committee has recommended exactly this combination, the three client status codes with registry lock as an additional layer, since its 2010 report SAC044, according to the SSAC’s Registrant’s Guide to Protecting Domain Name Registration Accounts.
Register for multiple years and fix the renewal
An expired domain is lost as surely as a stolen one, and recovery after the drop is far from guaranteed. Extend the registration of every domain that matters to the longest term the registry allows, which for most generic top-level domains is ten years. Then enable auto-renew and attach a corporate payment card with a long expiration date, not an individual’s card that will be replaced at the next bank reissue. Confirm that renewal notices go to the dedicated mailbox from the previous step. A long registration term buys you a decade of margin for error on a control that fails silently.
Make the registrant the company, not a person
The registrant of record is the legal owner of the domain. If that field names an employee, a founder or a contractor, the organization’s claim to the domain depends on that person’s continued goodwill. Change the registrant organization to the company’s legal name, with the company’s address, and the registrant email to the dedicated mailbox. This step matters in disputes: a registrar, a UDRP panel or a court will look first at who the registration record says owns the name. Our post on whether private registration is necessary explains how to keep the organization as registrant while still using a privacy service for the public record.
Remove former staff and agencies
Go back through the user list at the registrar and the DNS provider and remove every person and vendor who no longer needs access. Pay particular attention to agencies: a web or marketing firm that set up the domain years ago may still have an API key or a delegated login. If an outside party legitimately needs to edit DNS, give them a named account with DNS-only permissions and a calendar reminder to review it. The same applies to the DNS provider if DNS is hosted separately from the registrar; that account needs its own dedicated email, multi-factor authentication and user review.
Add registry lock on critical domains
Registry lock (a registry-level hold that blocks changes until the registrar verifies the request out of band) is the control that defeats account takeover. With registry lock in place, the registry sets serverTransferProhibited, serverUpdateProhibited and serverDeleteProhibited on the domain. Those server-side codes cannot be removed from the registrar control panel. Unlocking requires the registrar to contact the registry through a separate, verified channel, usually a phone call or a signed request between named people, which means an attacker holding your password still cannot move the domain or change its nameservers.
Registry lock costs more than a standard registration and makes changes slower, which is the point. Apply it to the domains the business cannot function without: the primary website domain, the email domain, and any domain used for customer logins. It remains rare even among large organizations. CSC found that 24 percent of Forbes Global 2000 companies use registry lock, up from 17 percent in 2020, according to the CSC 2024 Domain Security Report. Our registry lock guide explains which registries offer it and how to arrange it through your registrar.
Enable DNSSEC where the DNS provider supports it
DNSSEC (Domain Name System Security Extensions, which add cryptographic signatures to DNS records so a validating resolver can tell a genuine answer from a forged one) protects against a different attack: cache poisoning and forged responses that redirect users without touching your registrar or DNS account. Adoption is low. The European Commission’s Joint Research Centre reported that only about 5 percent of second-level domains were signed, even though about 92.2 percent of top-level domains were, according to its analysis of DNSSEC uptake in the EU. Among the Global 2000, CSC put adoption at 9 percent in the same 2024 report.
If your DNS provider supports DNSSEC with managed signing, turning it on is usually a matter of enabling it at the provider and publishing the DS record at the registrar. If the provider does not manage key rollover, be cautious: a signed zone with an expired signature stops resolving entirely. The DNSSEC guide covers the decision and the operational safeguards.
Set up monitoring
Every control above can be undone, and you want to know within minutes rather than months. At a minimum, monitor the domain’s registration record for changes to registrar, status codes, contacts and expiration date; monitor the nameservers and the key DNS records; and monitor Certificate Transparency logs, the public ledger of issued TLS certificates, so you learn when a certificate is issued for your domain by an authority you did not use. Certificate monitoring was one of the four actions the Department of Homeland Security required of federal agencies in its Emergency Directive 19-01 on DNS infrastructure tampering, because certificate issuance is the step that turns a DNS change into usable interception. Our DNShield domain name monitoring service runs these watches and alerts the people you designate.
Write the recovery runbook before you need it
The last step is a document. Write down, in plain language, what to do if the website goes dark, email stops arriving, or the registrar reports a transfer you did not authorize. It should name the registrar, the account holder, the registry lock contacts, the DNS provider, the people authorized to make decisions, and the first three phone calls to make. Include the registrar’s abuse and transfer emergency contacts, because ICANN’s Transfer Policy gives you a path to reverse an unauthorized transfer and the clock on that path starts immediately. Store the runbook somewhere that does not depend on the domain being up, and read it with the people who would use it once a year. The registrar account security guide and our domain name security best practices post cover the operating habits that keep the runbook from ever being needed.
What DNAccess does
DNAccess carries out this process for clients through our domain name management service, which consolidates a portfolio, configures account and transfer protections, arranges registry lock on critical domains, manages renewals, and runs the annual review. Our DNShield monitoring service watches for changes afterward. When a domain has already been lost, we recover it, and we have recovered hundreds of stolen domain names for clients who did not get to this checklist in time. To have us review your domains, contact DNAccess.