Domain security
What is DNS security and how do I protect my domain?
DNS security protects the records that tell the internet where your website and email live. The main steps are locking your domain at the registrar, using two-factor sign-in, signing your zone with DNSSEC, restricting certificate issuers with CAA records, and removing DNS entries that point at services you no longer use.
The steps that matter most
- Protect the registrar account. Use a strong unique password and two-factor sign-in. Losing the account means losing the domain.
- Turn on registrar lock so the domain cannot be transferred without an extra step.
- Use a reputable DNS host with access controls and change history.
- Enable DNSSEC if your registrar and DNS host support it.
- Add CAA records that name the certificate authorities allowed to issue certificates for you.
- Clean up old records. A CNAME that points at a service you cancelled can let someone else claim that name.
- Authenticate email with SPF, DKIM and DMARC. See what is DMARC?
What DNSSEC does
DNSSEC adds cryptographic signatures to DNS answers, so a resolver can check that a record was not altered on the way. It does not encrypt traffic and it does not hide your records. It protects against forged answers such as cache poisoning.
A CAA example
example.com. CAA 0 issue "letsencrypt.org"Review on a schedule
DNS drifts. New tools, migrations and staff changes alter records. Review them every quarter and after any provider change.
How SageRank helps
The free report does not test domain security. SageRank’s Sentinel and Ultimate plans run ten levels of domain security checks through ShieldAI. See ShieldAI.