DNS Security for Businesses: Preventing Domain Hijacking with Registrar Lock, DNSSEC and More

Your domain name is one of the most valuable things your business owns online. Whoever controls the registrar account and DNS controls where your website points, where your email is delivered, and which password-reset messages reach you. Protecting it takes an afternoon. Make sure the business owns the registrar account and secure it with strong MFA. Turn on registrar lock, and ask about registry lock for your main domain. Enable auto-renew with a valid payment method. Turn on DNSSEC if your providers support it. Then audit your DNS records, remove anything pointing to services you no longer use, and add a CAA record to limit who can issue certificates for your name.

Why attackers go after domains

When CISA ordered US federal agencies to act on DNS tampering in 2019 (Emergency Directive 19-01, closed in January 2026), it described a pattern that applies to any business:

1. The attacker gets into an account that can change DNS records, usually with stolen credentials.
2. They change records such as A, MX or NS to point at infrastructure they control.
3. They get a valid certificate for your domain, so visitors see no browser warning.

The result can be a cloned website, intercepted email or password resets sent to the attacker. None of it requires hacking your servers, only the account that controls your domain.

Step 1: Know who owns the registrar login

This is the most common weak point, and it isn't technical. Answer these questions in writing:

• Which registrar holds the domain, and which provider hosts the DNS? They are often different companies, for example a registrar plus Cloudflare or your web host.
• Whose account is it? It should be a business account tied to a company email address, ideally a shared admin mailbox the business controls. A former web designer's or employee's personal account is a real risk.
• Is the registrant contact correct? ICANN's renewal rules send expiration notices to the email address on file. If that address is a dead mailbox, you won't see the warnings.
• Who else has access? Remove anyone who no longer needs it, and include the registrar and DNS host in your offboarding checklist.

Step 2: Lock down the registrar and DNS accounts

• Turn on MFA for every user on the registrar and DNS host. CISA's directive called for MFA on all accounts that can change DNS and recommended against SMS codes. Use an authenticator app or, better, a security key or passkey where the provider supports it. Our MFA guide explains the options.
• Use a unique, long password stored in your team password manager.
• Check the recovery settings. An attacker who controls the recovery email or phone number can bypass the password.
• Turn on change notifications if your provider offers them, so DNS edits and login alerts reach more than one person.
• Limit API tokens. If your DNS host issues API keys for automation, scope them to the zones and actions they need, and delete unused ones.

Step 3: Turn on registrar lock, and consider registry lock

Domains carry status codes that tell the registry what is allowed. You can see your domain's codes in a public lookup such as ICANN's lookup tool.

Status	Set by	What it blocks
clientTransferProhibited	Your registrar (registrar lock)	Transfers to another registrar
clientUpdateProhibited	Your registrar	Changes to the domain, such as nameservers
clientDeleteProhibited	Your registrar	Deletion of the registration
serverTransferProhibited / serverUpdateProhibited / serverDeleteProhibited	The registry (registry lock)	The same actions, enforced at the registry level

• Registrar lock (at least clientTransferProhibited) is usually a free toggle in your registrar's dashboard. Turn it on.
• Registry lock is offered by some registries through some registrars. Server-level codes take precedence over client codes, and removing them takes longer because the request goes through the registry. That delay is the point: a stolen registrar password alone can't move the domain or change its nameservers. It's worth asking about for the domain that carries your email.
• Guard the transfer authorization code (EPP or auth code). Only request it when you're actually moving registrars.

Step 4: Never let the domain expire

An expired domain takes your website and email down, and it can eventually be registered by someone else. Under ICANN's Expired Registration Recovery Policy (ERRP) for generic domains such as .com:

• Registrars must send at least two renewal reminders before expiration, roughly one month and one week before.
• After expiration, the registrar must disrupt the domain's DNS for up to 8 days before deleting it, which can stop your website and email.
• Registrars may offer an auto-renew grace period of 1 to 45 days. Terms vary by registrar.
• After deletion, generic TLD registries must offer a 30-day Redemption Grace Period during which you can restore the name through your registrar, usually for an extra fee.

What to do: turn on auto-renew, register your main domain for several years, keep a valid company card on file and keep the registrant email current. Put the expiration date in a shared calendar as a backup.

Step 5: Enable DNSSEC

DNSSEC adds digital signatures to your DNS data. Resolvers that validate DNSSEC can then detect forged answers, such as a cache-poisoning attempt, and reject them instead of sending users to a fake server. It doesn't encrypt anything, and it doesn't protect you if an attacker logs into your DNS account and makes "legitimate" changes. That's why Steps 1 to 3 come first.

Turning it on is usually two steps: enable signing at your DNS host, then add the DS record it generates at your registrar. Some providers do the second step automatically when they're also your registrar.

Be careful when changing DNS providers. Cloudflare's documentation, for example, warns that if you switch nameservers while an old DS record is still cached, validating resolvers will return errors (SERVFAIL) and your domain can go dark. Plan the move: remove the old DS record, wait for its TTL to expire, change nameservers, then enable DNSSEC with the new provider.

Step 6: Audit your DNS records

Export your zone file and review each record with someone who knows what it's for:

• NS: do the nameservers belong to your current DNS provider?
• A / AAAA: does every IP address belong to a server you use?
• MX and email TXT records: do they match your current email provider? Our SPF, DKIM and DMARC guide covers those records in detail.
• CNAME: does every alias point to a service you still pay for?
• TXT: remove verification records for tools you no longer use, but keep the ones for services you still rely on.

Repeat the review at least once a year and after any website, hosting or email migration. Watching certificate transparency logs, the public record of every certificate issued, can also alert you to a certificate for your domain that you didn't request.

Step 7: Remove dangling records before someone uses them

A dangling record is a DNS entry that still points to a resource you've deleted. Microsoft calls CNAME records especially vulnerable. Say promo.yourcompany.com points to a cloud app, landing page or storefront you've cancelled. Someone else may be able to claim that same resource name and serve their own content on your subdomain, which works well for phishing and can even get a valid certificate.

Prevention is a process: whenever a service is shut down, delete the DNS record first and keep an inventory of what each subdomain is for.

Step 8: Add a CAA record

A CAA record lists which certificate authorities may issue certificates for your domain, and authorities are required to check it. With no CAA record, any public authority that can validate control of the domain may issue one. A simple example:

yourcompany.com.  CAA 0 issue "letsencrypt.org"

List every authority you actually use, including any your hosting provider, CDN or email platform relies on. Otherwise certificate renewals can fail.

Quick checklist

1. The business owns the registrar and DNS accounts, using a company email address.
2. MFA is on for every user; SMS is avoided where possible.
3. Registrar lock is on; registry lock is considered for the main domain.
4. Auto-renew is on, payment details are current, and the expiration date is in a shared calendar.
5. DNSSEC is enabled, with a plan for future provider changes.
6. DNS records have been audited, and dangling CNAMEs are removed.
7. A CAA record lists the certificate authorities you use.

If you suspect someone has already changed your DNS, treat it as a security incident. Our guide to the first 24 hours after a breach is a good starting point.

Core Florida IT reviews domain and DNS security as part of our cybersecurity and business email services for companies in Miami-Dade and across South Florida. Request a free IT assessment and we'll check who controls your domain and how well it's protected.

Sources

• ED 19-01: Mitigate DNS Infrastructure Tampering (CISA)
• EPP Status Codes: What Do They Mean, and Why Should I Know? (ICANN)
• About the Expired Registration Recovery Policy (ICANN)
• DNSSEC: What Is It and Why Is It Important? (ICANN)
• DNSSEC (Cloudflare documentation)
• Prevent dangling DNS entries and avoid subdomain takeover (Microsoft Learn)
• Certificate Authority Authorization (CAA) (Let's Encrypt)