Domain security
How to Protect Your Business Domain
By PixelPrivate Security Team · Published · Updated · 7 min read
Short answer: Protect your domain by enabling MFA and registrar lock, turning on auto-renewal, using a reputable DNS host with redundancy, removing stale DNS records, restricting certificate issuance with CAA, and considering DNSSEC.
Secure the registrar account
- Use MFA and a unique password.
- Use a shared role mailbox, not a former employee’s address, as the registrant contact.
- Enable registrar lock (transfer lock).
Never let it expire
Enable auto-renewal with a card that does not expire soon, and put the expiry date in a calendar. Expired domains can be bought by anyone, including attackers.
Clean DNS
Delete records for services you no longer use. Dangling CNAMEs can allow subdomain takeover.
Restrict certificates
A CAA record lists which authorities may issue certificates for your domain.
Consider DNSSEC
DNSSEC signs DNS answers. Enable it only if your DNS host and registrar support it cleanly.
Watch for lookalikes
Attackers register similar domains. Monitoring them is more practical than registering every variant.
Checklist
- ☐ Registrar MFA
- ☐ Registrar lock
- ☐ Auto-renew
- ☐ Role-based contact email
- ☐ Stale records removed
- ☐ CAA set
- ☐ Lookalike monitoring
Methodology
Recommendations reflect common registrar/DNS hardening practice and ICANN guidance on domain security.