Why your domain registrar account is a single point of failure
Whoever controls your domain's DNS settings controls where your website points and where your email is delivered. If an attacker gains access to your domain registrar account, they can redirect your website to a fake copy, intercept email by changing mail server records, or issue fraudulent SSL certificates. A domain compromise is often more damaging than a single hacked mailbox, because it can affect every account and every visitor tied to that domain at once.
Securing the registrar account itself
The registrar account, the login used to manage your domain, deserves the same protection level as your most sensitive business account, because in practice it often is.
- Enable MFA on the registrar account, using an authenticator app or hardware key rather than SMS where supported
- Enable registrar lock (also called transfer lock) to prevent unauthorized domain transfers
- Keep registration and admin contact emails on an address your team actually monitors, not a forgotten personal inbox
- Limit who has registrar access to the fewest people necessary, and remove access immediately during offboarding
- Turn on domain expiration and renewal alerts; an expired domain can be re-registered by someone else
DNS records that protect your email specifically
Beyond the registrar login, several DNS records directly control whether attackers can send email that appears to come from your domain.
- SPF, DKIM, and DMARC records tell receiving mail servers which sources are authorized to send as your domain and what to do with messages that fail that check
- Without these records configured correctly, attackers can spoof your domain in phishing emails sent to your own clients and vendors
- DMARC reporting can also alert you when someone else is trying to spoof your domain, which is useful threat intelligence on its own
Watching for signs of DNS tampering
DNS changes are quiet by nature, which is exactly why they need periodic checking rather than being set once and forgotten.
- Periodically review DNS records for entries you do not recognize
- Check registrar account activity logs for logins from unfamiliar locations
- Confirm SSL certificate details on your website match what you issued, since a fraudulent certificate can indicate a DNS-level compromise
- Set a calendar reminder to review domain and DNS settings alongside other quarterly security checks
If a domain hijack happens
Act quickly and involve your registrar's support and, if needed, the domain registry directly, since window of exposure grows the longer records point to attacker-controlled infrastructure.
- Contact your registrar's fraud or abuse team immediately with evidence of unauthorized changes
- Change the registrar account password and enable MFA if it was not already active
- Restore DNS records from your last known-good configuration
- Notify clients and vendors if email was redirected during the incident window
Frequently asked questions
Is registrar lock the same as domain privacy protection?
No. Registrar lock (transfer lock) prevents your domain from being transferred to another registrar without authorization. Privacy protection hides your contact information from public WHOIS lookups. Both are useful, but they solve different problems, and registrar lock is the more important one for preventing hijacking.
Who in a small business should have registrar access?
As few people as possible, ideally one primary admin and one backup, both using MFA. Avoid a scenario where registrar access lives only in one departed employee's personal account, which is a surprisingly common way small businesses lose control of their own domain.
Does having SPF, DKIM, and DMARC actually stop phishing sent to us?
It mainly stops attackers from successfully spoofing your domain when emailing others, protecting your reputation and your clients. It does not directly stop phishing sent to your team from other domains, which requires separate email filtering and staff awareness.