Quick answer: Domain security means protecting the registration and DNS settings that decide where your website and email go. Use a reputable registrar, enable registrar lock, turn on strong account authentication, limit DNS edit rights, keep WHOIS/account contacts current, and monitor for unexpected changes. A compromised domain can redirect your site or steal email even when your web host is fine.
People harden WordPress and forget the domain account password is still “Companyname2016”. That is backwards.
Why the domain is a crown jewel
If an attacker changes nameservers or A records, visitors land on a phishing copy. If they change MX records, they intercept mail. SSL certificates and host security cannot save you from a hijacked DNS path.
Treat registrar and DNS credentials with the same care as banking.
Registrar account hardening
Checklist:
- Choose a registrar with a solid reputation and clear support channels
- Use a unique, long password stored in a password manager
- Enable two-factor authentication (2FA) on the registrar account
- Turn on registrar lock / transfer lock so the domain cannot move without extra steps
- Review recovery email and phone numbers; attackers abuse weak recovery flows
- Limit users: not every contractor needs ownership access
- Store customer numbers and auth codes offline in a secure vault for legitimate transfers
If a past employee set up the domain under a personal email, fix that ownership trail immediately.
DNS access control
DNS may live at the registrar or at a dedicated DNS host (Cloudflare, Route 53, your CDN, etc.). Wherever it lives:
- Separate roles: billing owner vs DNS editor when possible
- Prefer SSO or 2FA
- Avoid shared “team@gmail” logins
- Log changes if the provider offers audit history
- Document every record that must exist (A/AAAA, CNAME, MX, TXT)
Unexpected TXT or MX records deserve a same-day investigation.
Email authentication basics (related to domain trust)
While not only “DNS security”, spoofing protection matters:
- SPF: TXT record listing servers allowed to send mail for your domain
- DKIM: cryptographic signatures via DNS
- DMARC: policy telling receivers what to do with failures
Misconfigured SPF/DMARC breaks legitimate mail; take care. Still, leaving them empty makes spoofing easier. Coordinate with whoever runs Google Workspace, Office 365 or your ESP.
SSL and hosting are adjacent, not identical
HTTPS certificates prove you control the domain at issuance time, but they do not stop DNS hijacks afterward. Keep certificates healthy and redirect HTTP to HTTPS, and still lock the registrar. Browser warnings such as Chrome’s not secure warning are hosting/TLS issues; domain theft is a different incident class.
Likewise, cleaning a hacked WordPress site does not help if DNS already points elsewhere.
Lifecycle events attackers love
Watch these moments:
- Domain near expiry (enable auto-renew with a valid card)
- Company rebrands and neglected alternate domains
- Registrar migrations done hastily without locks
- Expired personal cards tied to auto-renew
- Unused subdomains pointing at abandoned services (takeover risk)
Set calendar reminders 60 and 30 days before renewal even with auto-renew on.
Monitoring and response
Practical monitoring:
- External uptime checks on the apex and www
- Alerts if the resolved IP changes unexpectedly
- Certificate transparency monitoring if you have the tooling
- Periodic WHOIS/registrar settings review (quarterly)
If hijack is suspected:
- Contact the registrar immediately via verified channels
- Reset passwords and revoke sessions
- Restore correct nameservers and records from documentation
- Review email routing and advise staff about phishing
- Issue incident notes to customers if abuse emails went out
- Rotate credentials for related services
Document DNS in advance; during an incident nobody wants to reconstruct MX records from memory.
Subdomains and third-party delegations
Marketing often creates campaign subdomains pointed at vendors. When the campaign ends, remove the delegation or the vendor account. Abandoned CNAMEs to expired third parties are a known takeover pattern.
Keep a spreadsheet of subdomains, purpose, owner and target.
Team process
Write a one-page runbook:
- Who owns the registrar login
- Where 2FA backup codes live
- How to request DNS changes
- Who approves MX or nameserver edits
- Where the record inventory is stored
This is dull paperwork that prevents dramatic outages.
Transfers done safely
Legitimate transfers happen during provider changes. Use a checklist: remove the lock only when ready, retrieve auth code over a secure channel, confirm the gaining registrar account has 2FA, relock after success, and update DNS documentation. Never send auth codes through public chat.
If a transfer starts that you did not request, contact both registrars immediately and escalate with proof of ownership documents your company keeps on file.
Related website hardening
Domain security sits beside hosting, TLS and application security. After registrar hygiene, review HTTPS configuration, admin access on the CMS and backup restore tests. Speed and cache layers such as website caching do not replace these controls, but a well-run host makes incident response easier.
Keep a printed or offline copy of critical account numbers. Cloud-only password resets fail when email MX is already compromised.
Vendor and freelancer access
Agencies sometimes need DNS changes for verifications (Google Search Console, email tools, CDN). Grant the least privilege for the shortest time. Prefer temporary user seats over sharing the owner password. After launch, revoke access and rotate credentials if a shared password was ever used.
Write the expectation into onboarding docs so project managers do not send registrar logins through email threads.
Quarterly drill
Once a quarter, verify you can log in to the registrar with 2FA, export or screenshot the DNS zone, and confirm auto-renew settings. A ten-minute drill beats discovering expired access during an outage.
Personal domains and corporate risk
Founders sometimes register the company domain under a personal registrar login years before a company email exists. Transfer ownership to a company-controlled account with documented 2FA before you invest in a redesign. Hosting cutovers are bad moments to discover only one person can approve DNS edits and they are on holiday.
Treat this drill as mandatory after any staff change in marketing or IT.
FAQ
Is privacy WHOIS the same as security?
No. Redacting personal contact data helps privacy. It does not lock the domain against transfer. You still need account security and registrar lock.
Should DNS sit at the registrar or a specialist?
Either can be fine. Specialists may offer better UI, API and secondary DNS. Registrar DNS is simpler for small sites. Security habits matter more than brand.
Do I need DNSSEC?
DNSSEC adds cryptographic validation of DNS data. Support and operational complexity vary. It is worth discussing with your DNS host for higher-risk domains; enable only when you can operate it correctly.
What about domain monitoring services?
Useful for larger brands watching lookalike registrations. Still fix your own account security first.
Lock the name that everything hangs on
Domain and DNS security is foundational. Harden registrar accounts, control DNS edits, authenticate email, monitor changes and rehearse response. Your website hardening is incomplete without it.
If you want help reviewing site and hosting security alongside operational checklists, our CMS and site care work includes practical hardening steps teams can maintain.
