Domain Security & DNS Hardening Checklist (2025)

Critical controls (do these first)

DNS hardening checklist

• Use dual DNS providers or secondary DNS to survive provider outages.
• Set low-but-safe TTLs (300–600s) for web records; higher (1–4h) for MX to reduce flapping.
• Separate MX (email) from web/CDN provider; avoid single point of failure.
• Monitor for unauthorized changes via registrar/DNS change alerts and external diff checks.
• Enforce HSTS preload and redirect HTTP → HTTPS permanently.
• Enable CAA records to restrict which CAs can issue certificates.
• Use ALIAS/ANAME for apex when pointing to CDNs; avoid brittle CNAME-at-apex hacks.
• Keep vanity nameservers consistent; rotate glue records carefully with a rollback plan.

Anti-hijack and audit steps

Document an emergency rollback: previous zone snapshot, provider contacts, and a comms template to inform customers if records are tampered with.

Email authentication quickstart

Domain Hijacking: How It Happens and How to Stop It

Domain hijacking is the unauthorized transfer of a domain name to another registrar or registrant. It's more common than most domain owners realize — and the consequences are catastrophic: loss of email, website downtime, loss of search rankings, and in some cases permanent loss of the domain. Here's how attacks work and how to prevent each vector:

Attack Vector 1: Social Engineering of Registrar Support

The most common attack. A bad actor calls registrar support claiming to be the account owner, often using leaked personal data to pass security checks. They request an auth code or contact email change. Prevention: Enable registry lock (requires multi-step in-person or hardware-key verification at the registry level, not just the registrar), use a shared team email (not individual) for WHOIS contact, and enable all available security notifications.

Attack Vector 2: Email Account Takeover

If the email address on your registrar account is compromised, an attacker can trigger password resets and take control. Prevention: Use a dedicated domain management email (e.g., [email protected]), never the same address you use for newsletters or public contact. Enable MFA on that inbox using hardware keys, not SMS.

Attack Vector 3: DNS Cache Poisoning

Attackers corrupt resolver caches to redirect queries for your domain to malicious servers. Victims see the correct URL in their browser but are served attacker-controlled content. Prevention: Enable DNSSEC to cryptographically sign your zone. Verify DNSSEC is working correctly at dnssec-analyzer.verisignlabs.com — a misconfigured DS record is worse than no DNSSEC because it causes NXDOMAIN for legitimate users.

Attack Vector 4: Expired Domain Theft

Forgetting to renew a domain — even briefly — allows competitors or bad actors to register it. Prevention: Enable auto-renewal on all critical domains, set renewal reminders 90 days before expiry, and set up domain monitoring alerts. Keep credit card payment methods current on registrar accounts.

Incident Response: When Your Domain Is Hijacked

Speed is critical. Every hour of downtime means lost revenue, damaged relationships, and compromised email delivery. Keep this playbook saved offline (since your domain's email may be the attack target):

Key pre-work: Save your registrar's abuse phone number in your team's emergency contacts. Save a zone file export. Create a rollback runbook before you need it.

Related Articles