Domain Security & DNS Hardening Checklist (2025)

Critical controls (do these first)

1. Registry lock

Enable registry lock on premium domains so nameservers, auth codes, and contacts cannot be changed without high-trust verification from the registry.

2. DNSSEC

Turn on DNSSEC (sign zones and publish DS records) to prevent cache poisoning. Verify after enabling; many outages are misconfigured DS records.

3. MFA + least privilege

Require hardware keys for registrar and DNS logins. Create separate roles for editing zones vs billing, and disable shared accounts.

4. DMARC enforcement

Publish SPF/DKIM correctly, monitor DMARC reports for 30-60 days, then move to p=quarantine or p=reject to block spoofing.

DNS hardening checklist

Use dual DNS providers or secondary DNS to survive provider outages.
Set low-but-safe TTLs (300–600s) for web records; higher (1–4h) for MX to reduce flapping.
Separate MX (email) from web/CDN provider; avoid single point of failure.
Monitor for unauthorized changes via registrar/DNS change alerts and external diff checks.
Enforce HSTS preload and redirect HTTP → HTTPS permanently.
Enable CAA records to restrict which CAs can issue certificates.
Use ALIAS/ANAME for apex when pointing to CDNs; avoid brittle CNAME-at-apex hacks.
Keep vanity nameservers consistent; rotate glue records carefully with a rollback plan.

Anti-hijack and audit steps

Control	Action	Cadence
WHOIS privacy & contacts	Keep org/legal email current; use distribution list, not a single user.	Quarterly
Auth codes & transfer lock	Rotate auth codes; keep transfer lock on except during planned moves.	Quarterly
Zone change review	Require approvals for NS/MX/CNAME edits; log who/when/why.	Every change
Backups	Export zone files and store encrypted off-provider.	Weekly
Uptime + DNS monitors	Monitor A/AAAA/CNAME resolution, SSL validity, and MX health.	24/7

Document an emergency rollback: previous zone snapshot, provider contacts, and a comms template to inform customers if records are tampered with.

Email authentication quickstart

SPF & DKIM

Publish a single SPF record that includes all senders; remove ~all/ptr. Enable DKIM for every sending service (marketing, product, support) and rotate keys yearly.

DMARC to protect brand

Start with p=none to collect reports, then move to p=quarantine and finally p=reject once alignment is clean. Add a reporting address you actually monitor.

Need a security-first domain handoff?

Names.Center delivers premium domains with registry lock, DNSSEC, DMARC, SSL, and a rollback plan so you launch without risk.

Talk to us