Your domain is the key to your website, email and every account that sends password resets to your inbox. If someone takes control of it, they can redirect visitors, read your mail and impersonate your business. Several protection layers make that very hard.
How domains are attacked
- Account takeover: a stolen password for the registrar account lets the attacker change nameservers or transfer the domain.
- Unauthorised transfer: an unlocked domain plus a leaked EPP code moves it to another registrar.
- Expiry sniping: a forgotten renewal releases the domain to drop-catchers.
- DNS spoofing: forged DNS answers send visitors to a fake server.
The protection layers
| Layer | What it stops |
|---|---|
Registrar lock (clientTransferProhibited) | Transfers until you unlock it. Keep it on except while transferring. |
| Registry lock | Any change to nameservers or ownership without manual verification by the registry. Offered for high-value domains on some TLDs. |
| DNSSEC | Forged DNS answers. Records are cryptographically signed and resolvers verify them. |
| Two-factor authentication | Logins with a stolen password, at both the registrar and hosting dashboards. |
| Auto-renew and correct contacts | Accidental expiry and missed security notices. |
How DNSSEC works, briefly
The DNS provider signs your zone with a private key and publishes a matching public key. A fingerprint of that key (the DS record) is placed at the registry through your registrar. Validating resolvers then check each answer's signature up the chain to the root. If the DS record and the zone keys do not match, for example after changing nameservers without updating DNSSEC, validating resolvers treat the domain as broken, so always remove or update the DS record when moving DNS.
A quick security checklist
- Use a unique password and 2FA on your registrar and MdmHost dashboard.
- Keep the registrar lock on.
- Use a registrant email on a different domain, so a problem with the domain does not lock you out of its recovery address.
- Turn on auto-renew and register key domains for several years.
- Review the domain's status now and then with the WHOIS checker.