Most stolen domain names are taken from the registrar account, by someone who logged in as you. In the recoveries we handle, the path is nearly always the same: a reused password, an unprotected mailbox, a former contractor whose login still worked, or a support agent persuaded to reset access by phone. Domain name management cyber security therefore begins with the account that holds the domains, and the controls on that account matter more than any setting on the domains themselves. This checklist is part of our domain name security guide; our page on how to secure a domain name takes the wider view.
The registrant email is the master key
Every registrar account has a password reset path, and that path ends in an email address. Whoever controls the registrant email can reset the password, approve a transfer, and pass the registrar’s identity check, so the mailbox is part of the account. Use a dedicated address that exists only for domain registrations, on a domain outside the portfolio it protects, so that one hijacked domain cannot be used to seize the rest. Protect that mailbox with MFA (multi-factor authentication, a second proof of identity beyond the password) using a hardware security key, with a spare key stored offline. If the registrant email is a founder’s personal webmail, the company’s domains are only as secure as that one person’s habits.
MFA on the registrar account, and why SMS is the weakest option
Turn on MFA for every login to the registrar itself. Prefer a hardware key or passkey, then an authenticator app, and treat SMS codes as a last resort. SMS is weakest because the number can be moved to an attacker’s device through a SIM swap (persuading or bribing a carrier employee to port the number) without touching your systems. A hardware key is strongest because it is bound to the registrar’s real domain and ignores a lookalike login page. ICANN’s Security and Stability Advisory Committee set out 12 credential-protection practices for registrants in a 2010 report, SAC044, A Registrant’s Guide to Protecting Domain Name Registration Accounts; it predates passkeys, but its advice on unique credentials and a protected contact email has not changed.
Named users and role separation
A single shared login is the most common weakness we find. It cannot be revoked for one person without resetting it for everyone, and it leaves no record of who made a change. Use named user accounts, then separate roles. DNS editors, who change records every week, should not hold the permission to transfer a domain or change the registrant. Domain administrators, who approve transfers and renewals, should be few and senior. Billing contacts need invoices, nothing more. If your registrar cannot separate these roles, move critical domains to one that can.
API keys and integrations
Many accounts carry API keys (long-lived credentials that let software make changes without a login) issued years ago for a certificate tool or a hosting panel. Each is a password that never expires and is not covered by MFA. List every key and integration, confirm who owns each and what it does, revoke the ones nobody can account for, scope the rest narrowly, and rotate keys when their creator leaves.
Support-desk social engineering and high-security options
Attackers who cannot break the login call the registrar instead, with a plausible story or a forged identity document, and ask the agent to reset access. The defense is to remove the agent’s discretion. Several corporate registrars offer an executive lock or high-security tier under which no change can be made through support without a callback to a pre-registered number and a passphrase. Enable it for the whole account. The companion control at the registry is registry lock (a registry-level hold that blocks changes until the registrar verifies the request out of band), which stops a transfer or nameserver change even when the registrar account is fully compromised, because the registry refuses the command until a human completes verification.
Transfer lock status codes and registry lock
Check the status codes on every domain in WHOIS (the public registration record for a domain name). Each should show clientTransferProhibited, clientUpdateProhibited and clientDeleteProhibited, the registrar-set codes that refuse a transfer, a registrant change and a deletion; SAC044 recommends all three, with registry lock as an additional layer. The client codes can be removed by anyone holding the registrar login, which is their limit. Registry lock adds server-level codes that only the registry can lift, so it survives an account takeover. Adoption remains low: CSC found that 24% of Forbes Global 2000 companies use registry lock, rising to 45% among companies at enterprise-class registrars, and that 68% of the Global 2000 have adopted less than half of the recommended domain security measures, in its 2024 Domain Security Report. Apply it to the domains that would stop the business if they went dark.
Recovery contacts and account-level PINs
A recovery phone belonging to a former employee, or a backup email on a domain you no longer renew, is an open door. Set a recovery contact that is current and company-controlled, and where the registrar offers an account PIN or support passphrase, set one and store it in the company password manager. The PIN defeats the support-desk scenario above, so only the domain administrators should know it.
Offboarding staff and agencies
Write the procedure before you need it. On the day an employee, developer or agency leaves, remove their named user, revoke any API key they created, change any shared password they knew, confirm they are not a recovery contact, and check that every domain’s registrant, admin and tech contacts are company addresses. A developer who registered the domain under their own account has, in the registrar’s eyes, been the owner all along; our guide to preventing domain hijacking covers that case.
Consolidating scattered registrations
Companies accumulate domains at five or six registrars, registered by marketing, by IT, by an acquired business and by a contractor long gone, and each account is a separate attack surface. Consolidate the portfolio into one corporate account, and keep an inventory recording each domain’s registrar, expiration date, nameservers and purpose. Stale nameserver records are a risk in their own right: ICANN’s SSAC found that unauthorized parties gained control of more than 163,000 gTLD domains through registrar nameserver management practices, as documented in SAC125, the SSAC Report on Registrar Nameserver Management. A domain pointed at an unmaintained nameserver can be hijacked without anyone touching your account.
Logging and alerting
Turn on every notification the registrar offers, from new logins to nameserver changes, transfer requests and lock removal, routed to a monitored distribution list. Then add independent monitoring, because a compromised account can have its notifications switched off. External monitoring such as DNShield domain name monitoring alerts you when the registration record, nameservers or DNS change, regardless of who changed them. Train staff on the fake renewal and verification messages that circulate constantly; our write-up on fake ICANN verification emails shows why clicking one hands over the account.
Choosing a registrar for security
Retail registrars compete on price and convenience, and their support desks are built to make access recovery easy, the opposite of what a company holding valuable domains needs. Corporate registrars charge more and in return offer named users, role separation, executive lock, registry lock and verified callbacks. Before moving, ask which MFA methods are supported and whether SMS can be disabled, whether an account-level lock with out-of-band verification exists, which registries it can place registry lock with, whether it provides a change log, and who you can reach at two in the morning when a domain stops resolving.
The registrar account security checklist
- The registrant email is a dedicated company mailbox on a separate domain, protected by hardware-key MFA.
- MFA is enforced on every registrar login with a hardware key, passkey or authenticator app, and SMS is disabled where possible.
- Every person has a named user account, and DNS editors, domain administrators and billing contacts hold separate roles.
- Every API key has a known owner and purpose, and unaccounted keys have been revoked.
- An account PIN is set, and any executive or high-security lock the registrar offers is enabled.
- Every domain carries the three client prohibited status codes, and business-critical domains carry registry lock.
- Recovery contacts are current and company-controlled.
- A written offboarding procedure removes access, keys and contact listings the day a person or agency leaves.
- All domains sit in one corporate account with a maintained inventory, and none points at an unmaintained nameserver.
- Change notifications go to a monitored list, and independent external monitoring watches the registration records.
What DNAccess does
We review registrar accounts against this checklist as part of our domain name management service, consolidate scattered portfolios, arrange registry lock and high-security account options, and run DNShield monitoring so that any change to a registration record reaches your team whether or not the registrar reports it. If a domain has already been taken through the account, we handle the recovery. To arrange a review, contact us.