Protecting your domain name: expiry, auth code, transfer lock and forgotten DNS records

Whoever manages your domain name also receives the mail on that domain. And with that mail, they can click "forgot password" on almost any other account: your accounting, your bank, your online store, your social media. That's why your domain name is one of the most important things you own. In this article you'll read how to protect it against expiry, hijacking and forgotten DNS records, and what to set up for this in My WebOké.

Don't let your domain expire

Domains are most often lost because they aren't renewed in time, for example because of an expired payment card or an invoice that went to a colleague who has since left. The domain then goes offline and after a while becomes available to anyone. Whoever registers it next receives the mail that is still being sent to your old addresses.

• Keep Renews annually switched on on the domain page in My WebOké. This is the default. See Renewal and automatic renewal.
• Pay your renewal invoices by direct debit, so a forgotten invoice can't cost you your domain.
• Keep a list of all your domains, including the ones you only registered just to be safe.
• Don't simply cancel an old domain you once used for mail. Keep it, and lock it down as a domain that doesn't send mail (see below).

Did it happen anyway? A .nl domain stays in quarantine for 40 days after cancellation. During that time, only the last registrant can get it back. How this works, also for other extensions, is explained in Recovering an expired or cancelled domain: quarantine and redemption period.

Check the registrant and the registrant's email address

The registrant is the legal owner of the domain. If it lists your web developer, a former employee or a company that no longer exists, it can be hard to prove the domain is yours in a dispute. So check:

• whether your company is registered as the registrant, with the correct name;
• whether the registrant's email address works, and that it isn't on the domain itself. If mail on your domain stops working, warnings about that domain won't reach you either. So use an address on a different domain;
• whether you confirmed the email address when asked to. For many extensions this is mandatory. If you don't, the domain may be suspended. On the Domain / Email health card on the domain page, you can see under Registrant verification whether it succeeded, and you can have the confirmation email resent.

Received an email from ICANN or the registry about your domain? Read Emails from ICANN or the registry about your domain: real or fake, and what should you do? first. Such emails are often faked.

Protect your account, the transfer code and the transfer lock

Anyone who gets into your My WebOké account can change your domain's nameservers or DNS and redirect your website and mail. So treat that account as one of your most important ones:

• Turn on two-factor authentication. See Two-factor authentication in My WebOké and setting up an authenticator app.
• Never log in via a link in an email about your domain ("your domain expires today, pay here"). Go to My WebOké yourself. See also Recognising phishing: how to read a link and a sender.

The transfer code (also called EPP code or authorization code) is the key to your domain: whoever has it can transfer the domain to another provider. Only request it when you're transferring yourself, and only give it to the provider you're moving to. If you receive a transfer confirmation you didn't expect, contact us immediately.

A transfer lock blocks transfers you didn't request: as long as the lock is on, the registry refuses the transfer. You'll find it on the domain page in the Advanced card, under Transfer-lock. If you're staying with WebOké, leave the lock on. Not every extension has a transfer lock. For .nl, .eu, .be and .nu, among others, the transfer code itself is the security. Read more in Transferring a domain away: transfer code (EPP) and transfer lock.

Clean up forgotten DNS records

A dangling record is a DNS record that points to something you no longer use: a cancelled online store, a deleted server or a service you've left. If someone else can take over that target, for example by creating a store with the same name on the same platform, your subdomain suddenly shows their pages, under your name. This is called subdomain takeover.

• Cancelling a service? First remove the DNS record that points to it, then cancel the service.
• Once a year, go through all records in My Domains, DNS tab. If you don't know what a record is for, find out. Make a backup of your DNS first, see Making and restoring a backup of your DNS.
• Be careful with a wildcard record (*) that points to an external service.

A domain that doesn't send mail: lock it down

Do you have a domain that never sends or receives mail, such as a brand name you only registered or an old domain? Scammers love using such domains as a sender, because nobody keeps an eye on them. With three records, you make it clear that no mail should come from or go to this domain:

MX    @        0 .
TXT   @        v=spf1 -all
TXT   _dmarc   v=DMARC1; p=reject

The MX record with 0 . (a null MX) says that no mail is accepted on this domain. -all says that no server at all is allowed to send mail on behalf of the domain, and p=reject asks recipients to reject mail that uses this domain as the sender anyway. Only do this if there really are no mailboxes, forwarders or services using the domain for mail. The Domain / Email health card shows a red dot at MX for such a domain. For a domain that never receives mail, that's expected. If you can't get it set up, create a ticket.

Extra locks: DNSSEC and CAA

DNSSEC adds a digital signature to your DNS responses, so nobody can forge them along the way. It doesn't protect against someone logging into your account. CAA is a DNS record that states which issuers may create a certificate for your domain. If you set a CAA record, also include the issuer of the certificate you currently use, otherwise that certificate can no longer be renewed.

You can check whether DNSSEC and CAA are set up correctly for your domain on the Domain / Email health card on the domain page, or with the public Domain health tool. See also Domain and email health: checking and fixing.

Want to learn more? Take the free Safe online course, lesson 4.3 Protecting your domain name.