Your domain controls your website, your email and every password reset sent to a company address. Protect the registrar account like a root account: company ownership, a group email, strong MFA, a transfer lock, automatic renewal and two people who can recover it. An attacker with your domain can receive your mail.
Why a domain is a crown jewel
If someone takes control of your DNS, they can redirect your site, intercept email and pass verification checks for services that trust your domain. Password resets for many tools go to a mailbox on that domain. A domain loss is slow and painful to reverse.
It is also easy to neglect. Registration is done once, often by one founder with a personal email, then forgotten.
The checklist
- Ownership. Register in the company's name, not a person's. Record the legal registrant and the account owner.
- Account email. Use a group address that more than one person can read, and keep it on a different domain from the one being protected, so that a lost domain does not lock you out of the account that controls it.
- MFA. Turn it on for the registrar account, with a hardware key or authenticator app, and register a backup method held by a second person.
- Transfer lock. Most registrars let you lock a domain against unauthorised transfer. Turn it on. Ask your registrar whether they offer a stronger lock that needs extra verification for changes.
- Auto renew. Enable it, and keep a valid payment card on file. Set a calendar reminder two months before expiry anyway.
- Contacts. Keep contact details current. Those details are used for recovery and notices.
- DNS access. Limit who can edit records. Remove old users and old API tokens.
- Registrar support. Learn the account recovery process now, and check what proof the registrar will accept.
Related records to watch
Keep an inventory of subdomains and delete DNS records that point to services you no longer use, since abandoned records can be claimed by someone else. See our post on dangling DNS and subdomain takeover. Publish SPF, DKIM and DMARC for email, covered in the email authentication setup guide.
Review rhythm
Check the list each quarter. Look at the DNS change history if your provider offers it, and at the user list. If a domain you own for a retired product still exists, decide whether to renew it or let it lapse in a controlled way.
What to do if it is hijacked
Contact the registrar through their emergency channel, reset credentials and MFA from a clean device, check email forwarding and DNS records, and tell your team and customers if phishing is likely to follow. Keep screenshots and timestamps.
Common pitfalls
Practical notes. Take a screenshot of your DNS records before any change, so that you can restore them if something breaks. Keep a copy of the registrar's support contact details somewhere other than the domain you protect. If you use several registrars, write each into the inventory with its owner. Consolidating to one or two reduces the number of accounts to defend, and it is often a good use of an afternoon.
Quick check
Should the registrar and email be on the same domain?
Avoid it. If the domain is lost, the account recovery email on that same domain is lost too.
Last reviewed: 19 October 2026.
