Domain and DNS security checklist for small businesses

A business's domain is the one asset its website, email, logins and reputation all depend on. If it expires, is transferred away or has its DNS changed, everything else stops or, worse, keeps working for someone else. Most of the protection is a handful of settings that take an afternoon to get right. This checklist puts them in the order an MSP should work through them.

Ownership and access

1. Know every domain the business uses

List the main domain, old brand names, country variants, campaign domains and anything used for email. Forgotten domains are where problems hide: they expire, or get used for spoofing because nobody protected them.

2. Register it in the business's name

The registrant should be the business, with a contact email the business controls. Domains registered by a former employee, a web designer or a previous IT provider are a common and painful problem when relationships end.

3. Use a contact email that is not on the same domain

Renewal and transfer notices go to the registrant email. If that address is on the domain itself and the domain lapses, the notices go nowhere. Use a second, independent address, or at least make sure the registrar account has one.

4. Turn on two-factor authentication at the registrar

Anyone who can log in to the registrar can change DNS, transfer the domain or let it expire. Two-factor authentication, ideally with an authenticator app or security key, is the single most important protection on this list. Do the same for the DNS host if it is a different company.

Keeping it registered

5. Auto-renew with a valid payment method

Most expirations are accidents: an expired card, a renewal email that went to spam. Turn on auto-renew, check the card, and consider registering for several years at a time. What happens when a domain expires covers the grace periods if it is already too late.

6. Watch the expiry date anyway

Public registration data (RDAP) shows the expiry date to anyone. Put it in a calendar, or watch the domain: Hookgap alerts when a watched domain drops under 30 days from expiry.

Stopping it moving

7. Enable the transfer lock

At the registrar, turn on the transfer lock (sometimes called registrar lock or domain lock). The domain shows clientTransferProhibited in public registration data. Hookgap reports domains without it. Unlock only when you deliberately move registrars.

8. Consider a registry lock for critical domains

For a domain the business could not survive losing, some registries offer a registry lock (serverTransferProhibited, serverUpdateProhibited), where changes need manual verification with the registry. It is usually a paid service and overkill for most small businesses, but worth knowing about.

Protecting DNS

9. Enable DNSSEC where it is one click

DNSSEC signs DNS answers so resolvers can detect forged ones. When the DNS host and registrar are the same company, or both support automatic setup, it is usually a single setting. If it requires copying DS records by hand, document the process, because moving DNS hosts without updating DNSSEC makes the domain unreachable.

10. Add a CAA record

A CAA record lists which certificate authorities may issue certificates for the domain. It is a small, low-risk improvement. See CAA records explained.

11. Protect domains that do not send email

Every domain that never sends mail should publish v=spf1 -all and v=DMARC1; p=reject, so it cannot be used for convincing spoofed email. The main domain needs the full setup in SPF, DKIM and DMARC explained.

12. Review DNS records once a year

Remove records for services the business no longer uses. A CNAME pointing to a cancelled cloud service or website builder can sometimes be claimed by someone else (a "dangling" record), who then serves content on the business's subdomain.

The checklist in one table

The items visible from outside are what a passive assessment can check, which makes them good conversation openers. The rest need access, which is exactly the work a client hires you for.

How Hookgap reports domain security

Each report has a Domain and DNS section with the registrar, domain age, expiry date, transfer lock, DNSSEC, CAA and DNS host, read from RDAP and public DNS. Paste a list of client domains into a bulk check to find the ones expiring soon or missing a lock in one pass.