Treat the domain registrar as a business-critical control plane

Source fact: a domain registration is an operational asset

ICANN’s Security and Stability Advisory Committee states that domain registrations should be managed with the rigor applied to other valuable digital and physical assets. Registrar accounts can control ownership information, renewal, transfer status, and the name servers to which a domain is delegated. That authority sits above the ordinary DNS records managed by a hosting provider.

ICANN documents that unauthorized registrar access can redirect web visitors, reroute or interrupt email, support impersonation and phishing, change registration contacts, delete a registration, or transfer control away from the rightful holder. Similar disruption can result from administrative error or a missed renewal. Protecting a DNS server alone does not prevent a registrar-level change from delegating the entire domain elsewhere.

Source fact: recovery can depend on information the domain itself provides

Registration accounts are exposed to password theft, phishing, social engineering, endpoint compromise, and attacks against registrar processes. A circular recovery design creates additional risk: if registrar notices and account recovery both depend on an email address under the affected domain, an attacker who redirects or disables that domain may also interfere with warnings and recovery.

ICANN recommends accurate registration records, controlled access, distinct credentials, multifactor authentication when available, registrar locks, monitoring, preserved proof of registration, multiple appropriate contacts, and documented registrar support procedures. ICANN also advises registrants to understand the safeguards and recovery services offered by a registrar before relying on it for a high-value domain.

DSE recommendation: create a complete domain register

Inventory every domain owned, managed, or depended upon by the organization—not only the primary website. Record the registrar, registry, expiration date, auto-renew status, payment owner, registrant entity, administrative and technical contacts, authoritative name servers, DNSSEC status, lock status, recovery channels, business owner, and services that use the name.

Include defensive registrations, campaign domains, old domains that still receive mail, domains embedded in certificates or applications, and name-server domains used by other zones. Mark which domains support email, identity federation, remote access, customer portals, or safety and security services. Those dependencies determine recovery order.

DSE recommendation: harden access and change authority

1. Use an organization-owned account. Do not leave a critical domain in a former employee’s personal registrar account or under an untracked reseller login.
2. Require strong MFA. Prefer phishing-resistant authentication when the registrar supports it. Store recovery material through a separately protected process.
3. Separate recovery channels. Maintain at least one verified contact path that does not depend on the protected domain. Keep it current without publishing it unnecessarily.
4. Limit administrators. Grant access only to named personnel with a current business need. Avoid shared identities and remove access promptly after role changes.
5. Enable available locks. Use registrar transfer and update locks. For the highest-impact domains, evaluate registry-lock services that require additional out-of-band steps.
6. Control changes. Require a recorded request, independent approval, expected record set, maintenance window, validation plan, and rollback for delegation or registration changes.
7. Protect renewal. Enable auto-renew where appropriate, maintain a valid payment method, and alert well before expiration through more than one channel.

DSE recommendation: monitor the layer above DNS

Monitor registration data, name-server delegation, lock states, DNSSEC delegation data, expiration, and certificate issuance—not merely A and MX records inside the zone. Alerts should reach people who can verify whether a change was authorized. Establish the normal registrar notification addresses and teach administrators to reach the portal through a known bookmark rather than a link in an unexpected renewal message.

Reconcile the domain register at least quarterly and after mergers, brand changes, provider migrations, or staff departures. Save invoices, registration agreements, corporate ownership evidence, historical records, support case numbers, and authorized-contact information in a protected location accessible during an outage.

DSE recommendation: write and exercise the recovery call tree

Document the registrar’s emergency process, support numbers, escalation path, identity-verification requirements, registry contact where applicable, DNS host, email provider, certificate contacts, legal owner, communications lead, and DSE support path. Record which changes must be frozen while evidence is preserved.

Run a tabletop exercise in which an unauthorized delegation change has redirected both web and email. The test should prove that staff can detect the change, communicate outside the affected domain, authenticate ownership, reach the registrar, restore known-good delegation, validate DNSSEC and mail, and monitor for follow-on abuse. A domain is not fully protected until recovery works without relying on the domain that may be lost.

Official references

• ICANN SSAC SAC 044: A Registrant’s Guide to Protecting Domain Name Registration Accounts
• ICANN: Securely Managing Your Domain Name
• ICANN SSAC SAC 007: Domain Name Hijacking
• ICANN: About Lost Domain Names