How to protect your domains

June 16, 2018 (Sat). A domain is a critical company asset. It's a digital address where you build your store to sell million dollars of products. For a good domain, its value also increases over time; when one day you close your business, you can sell your domain and make a capital gain. Because domains are valuable, they must be protected.

First, a very simplistic explanation. Domains are stored at the registry owning the domain extension. For example, Verisign in USA owns the .com extension. However, when you acquire a domain, you do not deal with the registry directly. Instead, you manage ownership of your domain through a domain registrar. Basically, your domains can be protected at two levels: registrar level and registry level.

Your domain registrar usually provides many security measures for you to use. One of them is called two-step verification. When you opened an account with your domain registrar, you also registered your mobile phone number. Now, when you sign in to your account, the 1st step involves entering your user ID and password. If they are correct, your registrar will send an additional password (number) to your mobile phone. In the 2nd step, you enter this additional password. Only when the two steps are correctly performed can you get in. This means that even if your user ID and password are stolen, hackers cannot get into your account because the mobile phone is still with you.

Some registrars offer a set of security questions with answers as the second line of defense. You set them up when you opened the account. Now, even if a hacker can somehow break the first line of defense and get into your account, nothing can happen without answering the security questions correctly.

Another feature is called domain locking. Once locked, your domain will always stay in your account and cannot be transferred to another domain registrar. This is to prevent a hacker from sending a fake authorization code to your registrar to move your domain away. In other words, no one can transfer your domain out of your account until they can break both the first and second lines of defense.

So far, we have discussed the security measures you can take at the registrar level. If your domain is critical in your business, then the ultimate protection may be domain locking at the registry level. When locked, any change to the ownership data of your domain requires verification done manually, such as a phone call with security questions and answers.

Also, make sure your ownership details are correct. The registrant (owner) section should contain the name, address, phone, email, and other information of your company. This is particularly important if you use a contractor to manage the domain for you. Check that the contractor's personal data is not used in the registrant section.

Finally, how do you prove you are the owner of a domain if it is stolen? Make sure you keep documents related to the acquisition of your domain in case one day you need to use them to prove the ownership in court. You can also use a web content archive such as to store your company profile and contact pages with time stamps.

In short, recognize that domains are valuable digital assets, and protect them properly.

Join me on LinkedIn for further discussion.