Domain and DNS security: a practical checklist

Why the domain is your most important account

If someone takes over your registrar account or your DNS, they can point your site to their server, read your incoming email, and pass the domain checks certificate authorities use, so the browser shows a valid padlock on their copy. No server hardening helps once DNS is gone. Most of the protection is a few settings you change once.

1. Secure the registrar and DNS accounts

• Turn on two-factor authentication at the registrar and at the DNS host (often the same company, or Cloudflare).
• Use a recovery email on a different domain. If the recovery address is on the domain itself and the domain stops working, you can’t receive the reset email.
• Register the domain to the business, with a shared role address, not to a former employee or the agency that built the site.
• Write down who has access, and remove people who have left.

2. Never let the domain expire

Expired domains are sometimes bought within days by others, together with the traffic and the email that still arrives. Turn on auto-renew, keep the card current, and check the expiry date and status codes:

whois yourdomain.com | grep -iE 'expir|status'

3. Turn on the transfer lock

In the status lines above you want to see clientTransferProhibited. It means the domain can’t be moved to another registrar until you unlock it yourself. Most registrars call it “registrar lock” or “transfer lock”. For high-value domains, ask whether the registry lock service (server-side locks changed only after manual verification) is available for your extension.

4. Publish CAA records

A CAA record lists the certificate authorities allowed to issue certificates for your domain; every public CA must check it before issuing. Find out which CA your host or CDN uses, then publish records like these (this example allows only Let’s Encrypt and forbids wildcard certificates):

yourdomain.com.  3600  IN  CAA  0 issue "letsencrypt.org"
yourdomain.com.  3600  IN  CAA  0 issuewild ";"
yourdomain.com.  3600  IN  CAA  0 iodef "mailto:security@yourdomain.com"

dig +short CAA yourdomain.com

Be careful: if your CDN or host issues certificates through another CA and it isn’t listed, its renewals will fail. Many CDNs document which CAA values to add, and some add them for you.

5. Enable DNSSEC

DNSSEC signs your DNS answers, so resolvers that validate them can detect forged responses. Turn it on at your DNS host, then add the DS record it gives you at the registrar (many registrars do this automatically when they also host your DNS). Check that the DS record exists and that a validating resolver sets the ad (authenticated data) flag:

dig +short DS yourdomain.com
dig @1.1.1.1 +dnssec yourdomain.com A | grep -E 'flags:'

One warning: when you move DNS to another provider, remove the DS record first (or follow the new provider’s DNSSEC migration steps), otherwise validating resolvers can’t resolve your domain at all.

6. Remove dangling records (subdomain takeover)

A “dangling” record points to a service you no longer use: a deleted cloud storage bucket, an old landing-page tool, a closed hosting account. If someone else can claim that name on the same service, they control content on your subdomain, with your domain in the address bar. List your subdomains from your DNS host and check where each CNAME points:

for h in www shop blog staging old mail; do
  t=$(dig +short CNAME "$h.yourdomain.com")
  [ -n "$t" ] && echo "$h -> $t ($(dig +short "$t" | head -n1))"
done

Empty parentheses mean the target no longer resolves: find out what it was and delete the record. A target that resolves can still be dangling if the account behind it was closed, so open each subdomain and make sure it shows what you expect. Remove the DNS record before you cancel the service it points to.

7. Protect email on the same domain

Publish SPF and DMARC so others can’t send email that looks like it comes from you, and add a DKIM key for each service that sends for you. See SPF, DKIM and DMARC for small businesses. Domains that never send email should publish v=spf1 -all and a DMARC reject policy.

What HackGrade checks

The free scan checks HTTPS, your certificate, and the SPF and DMARC records for your domain. It doesn’t check registrar settings, CAA, DNSSEC or dangling records, so use this checklist for those, and repeat it whenever you add or retire a service.