A domain is the address customers use to find your website, so protecting it requires more than choosing a strong password once. This domain security checklist shows how to reduce the risk of hijacking, unauthorized DNS changes, privacy exposure, and accidental expiration through a small set of recurring checks.
Overview
Domain theft and expiration can interrupt email, website access, advertising campaigns, and other services connected to your domain. The practical goal is not to eliminate every risk; it is to make unauthorized changes harder, make legitimate recovery possible, and give you enough warning to respond.
Start by treating the domain registrar account, the email account used to manage it, and the DNS configuration as three connected control points. If an attacker gains access to the registrar account, they may be able to change ownership or DNS settings. If they compromise the account’s recovery email, they may bypass otherwise useful safeguards. If DNS is changed without authorization, visitors can be sent somewhere other than your website even when the domain registration itself has not moved.
For a broader launch process, see the website launch checklist. This guide focuses on the ongoing security and maintenance work that begins after registration.
What to track
1. Registrar account access
Use a long, unique password for the registrar account and enable multi-factor authentication if the registrar offers it. Prefer an authenticator app or security key when those options are available to you. Do not reuse the registrar password for email, hosting, social media, or payment accounts.
Review the account’s user list and permissions. Remove former employees, contractors, and old personal accounts. If the registrar supports separate users or roles, give each person only the access needed for their work. Keep at least two trusted administrators for a business-critical domain, but avoid sharing one login.
2. Recovery contacts and notifications
Confirm that the account email address is current, monitored, and protected with its own strong authentication. Check the recovery email address and phone number as well. A domain account is difficult to recover if its contact details point to an abandoned inbox or an employee who no longer has access.
Enable notifications for login attempts, contact changes, transfers, renewals, DNS edits, and other account events when available. Treat unexpected notices as a prompt to investigate through the registrar’s official website or support channel, rather than by clicking a link in the message.
3. Registrar lock and transfer controls
Keep the registrar or transfer lock enabled unless you are actively moving the domain. A lock can add a barrier to an unauthorized transfer, but it is not a substitute for account security. Before a planned transfer, verify the destination registrar, confirm who is authorized to approve it, and store any transfer authorization code securely. Re-enable the lock after the transfer is complete if the new registrar provides that control.
Record the registrar, renewal date, domain owner, and approved administrators in a secure internal document. This information helps you distinguish a legitimate transfer or account change from a suspicious one.
4. Expiration and renewal safeguards
Turn on automatic renewal when it fits your payment and budgeting process, and keep the payment method current. Automatic renewal should be treated as a backup, not the only reminder. Add calendar reminders well before the expiration date and check that renewal notices reach a monitored inbox.
Review the renewal period after any domain transfer or registrar account change. Confirm that the registration has been extended as expected and that the displayed expiration date is consistent with your records. Never rely on a promotional message or an urgent invoice alone; verify the domain and billing details inside the registrar account.
5. WHOIS privacy and public contact details
Check whether WHOIS privacy or a comparable registration-data privacy service is enabled, where available and appropriate. Privacy services can reduce the amount of personal contact information displayed publicly, but they do not remove the need for accurate registrar records. Keep the legal registrant and administrative information accurate in the account, and understand how your registrar handles privacy, verification, and contact requests.
6. DNS records and change monitoring
Keep a current inventory of important DNS records, including nameservers, website records, mail records, verification records, and any services connected to subdomains. Note the purpose of each record and who approved it. This makes it easier to identify an unexplained change.
Limit DNS access to the people and systems that need it. Use separate credentials where supported, protect DNS provider accounts with multi-factor authentication, and remove unused integrations. If you are unsure how DNS changes affect hosting, review this guide to connecting a domain to web hosting.
7. Email, website, and hosting dependencies
List every service that depends on the domain: website hosting, business email, payment pages, analytics, marketing tools, certificates, and third-party applications. Domain security problems often become visible first as missing email, certificate warnings, redirects, or an unreachable website.
Keep backups of website content and important configuration information separately from the registrar account. A backup will not restore domain ownership, but it can shorten recovery if DNS or hosting settings must be rebuilt.
Cadence and checkpoints
A recurring schedule is more reliable than trying to remember every setting. Use this as a baseline and adjust it to the importance of the domain.
- Monthly: Review registrar and DNS notifications, upcoming expiration dates, recent logins, payment status, and any unexpected DNS or contact changes.
- Quarterly: Review administrators, recovery contacts, multi-factor authentication, registrar lock, WHOIS privacy, DNS records, and connected services. Remove access that is no longer necessary.
- After personnel changes: Remove departing users promptly, rotate shared credentials if they exist, and confirm ownership of recovery email addresses and security keys.
- Before a launch or migration: Export or document current DNS settings, verify the domain expiration date, confirm who can approve changes, and establish a rollback plan. The domain transfer checklist can help organize a planned move.
- After a major change: Check the website, email, certificates, redirects, and key subdomains. Save the final configuration and approval record.
How to interpret changes
Not every account notification indicates an attack. A DNS record may change because of a hosting migration, an email provider setup, certificate renewal, or a marketing tool. The important questions are whether the change was expected, who approved it, and whether it matches the documented purpose.
Investigate immediately if you see an unfamiliar login, an unexpected password or contact change, a disabled registrar lock, a transfer notice you did not request, a new nameserver, or a DNS record pointing to an unknown service. Also investigate sudden website redirects, missing email, certificate warnings, or a registrar message claiming that ownership or payment details must be updated urgently.
If you suspect unauthorized access, use a trusted device to change the registrar and email passwords, revoke unknown sessions, and enable multi-factor authentication. Contact the registrar through its official support route and ask what account, transfer, and DNS recovery steps are available. Preserve emails, timestamps, screenshots, and DNS records. Do not approve a transfer or delete evidence while investigating. If payment information, personal data, or business systems may also be affected, follow your organization’s broader incident-response process.
When to revisit
Revisit this checklist monthly for a quick review and quarterly for a full audit. Return to it immediately after changing registrars, moving hosting, launching a subdomain, changing business ownership, replacing an administrator, or receiving an unexpected security notification. Domain policies, account features, and privacy controls can also change, so verify the settings shown in your registrar and DNS provider accounts rather than assuming an old configuration remains active.
For a practical next step, create a one-page domain record containing the registrar, expiration date, approved administrators, recovery contacts, DNS provider, critical records, renewal method, and emergency support path. Store it in a restricted location and update it after every approved change. Then set a recurring calendar reminder for the monthly and quarterly checks above. Consistent review gives you an early warning system and makes legitimate domain management easier to verify.
