Securing your domain name and DNS

Your domain name is the one piece of your membership business that everything else hangs from. Your website, login page, checkout, email and every password reset you send depend on it pointing to the right place. Whoever controls the domain can send members to a fake login page, receive email addressed to you, or simply let the domain expire. Yet many owners could not tell you which company their domain is registered with, let alone who holds the login.

Domain security comes down to two accounts: the registrar account, where you rent the domain name itself, and the DNS account, where the records live that tell the internet where your website and email are. Sometimes these are with the same company; often they are not. Here is how to take control of both and keep it.

Find out who really controls your domain

Many domains were registered by a web designer, a former business partner or a helpful relative, inside their own account. In practice, that can make them the person in control. Check:

• Which registrar holds the domain. A public lookup of your domain’s registration record usually shows the registrar’s name, even when personal details are hidden.
• Whose account it sits in. Log in and confirm the domain appears in an account that belongs to your business, not to an individual contractor.
• Who is listed as the registrant. The registrant is the legal holder of the domain. It should be you or your business, with accurate details, even if a privacy service hides them from public view.
• Where DNS is hosted. The registration record lists your domain’s nameservers, which tell you which company runs your DNS. It might be the registrar, your host or a separate DNS provider.

If the domain is in someone else’s account, ask them to move it to an account you own now, while relations are good. Most registrars have a simple process for this. If you are still choosing a domain name for a new membership, register it in a business account from day one.

Lock down the registrar account

Treat your registrar login as one of the most sensitive credentials you have.

1. Use a long, unique password stored in a password manager, and turn on two-factor authentication, preferably with an authenticator app or security key rather than text messages.
2. Check the account email address. Renewal notices and transfer approvals go to this address. It should be one you read, and ideally not an address on the same domain. If the domain breaks, email on that domain breaks with it, and you could be locked out of the very account you need to fix it.
3. Add a second trusted contact if the registrar allows it, so renewal warnings are not lost if one inbox fails.
4. Remove old users. If a designer or assistant was given access, remove it when the work is done.
5. Learn the recovery process. Find out how you would prove ownership if you lost access. If the registrar offers a support PIN or similar extra check for phone requests, set one.

Stop the domain expiring or being moved

Domains are lost through neglect more often than through hacking. A card expires, the renewal fails, the warnings go to an old address and the domain lapses. After a grace period it can be registered by someone else, sometimes a buyer who specializes in lapsed domains.

• Turn on automatic renewal and keep the payment card current. Set a reminder a few weeks before the card on file expires.
• Consider renewing several years ahead for your main domain, so one failed payment is not a crisis.
• Switch on the transfer lock, sometimes called a registrar lock, which blocks a move to another registrar until you remove it.
• Guard the transfer authorization code, which is needed to move the domain away. Never send it to anyone you have not verified, and request a new one if an old code may have been exposed.
• For a very valuable domain, ask whether your registrar offers an extra lock that requires manual confirmation before any change.

Keep DNS changes under control

DNS records are short lines of text, and one changed line can send your members’ login traffic somewhere else. Protect the DNS account the same way as the registrar, then:

• Record what is there. Export or screenshot your current records and store the copy safely. If something changes unexpectedly, you will know what it should be.
• Turn on change notifications if your DNS provider offers them, so any edit triggers an email to you.
• Clean up old records. A record that points a subdomain at a service you have stopped using can be a risk: in some cases, someone else can claim that old service account and publish content on your subdomain. Delete records for anything you no longer use.
• Limit who can edit. Your developer may need DNS access for a project. Grant it for the project, then take it back.

A worked example: a sailing school’s domain record card

Tomasz runs a hypothetical sailing school membership. During a tidy-up he discovers the domain is still in the account of the designer who built his first site. The designer moves it across, and Tomasz writes a one-page record card, stored in the team password manager and on paper:

Domains: the main domain, plus two common misspellings that redirect to it. Registrar: name, account number and support phone number. Account owner: the business; login held by Tomasz; second contact is the operations manager. Account email: a business address on a different domain. Security: two-factor authentication by app; recovery codes stored offline. Renewal: automatic, paid several years ahead; card expiry reminder in the calendar. Transfer lock: on. DNS host: provider name and where the login is kept; change alerts on. Record snapshot: exported and saved after every change. Last reviewed: date of the most recent check.

The card took an hour to put together, and anyone covering for Tomasz can now find everything in one place, which is the whole point of writing down how your membership runs.

Your next steps

1. Look up your domain’s registrar and nameservers.
2. Confirm the domain sits in an account your business owns, with you as the registrant.
3. Turn on two-factor authentication at both the registrar and the DNS host.
4. Switch on automatic renewal and the transfer lock, and check the card on file.
5. Export a snapshot of your DNS records and remove any you no longer need.
6. Write your own domain record card.