Every control in this course lives inside a zone, and the zone is served by nameservers named in a delegation, and the delegation is controlled by a registrar account. Whoever holds that account can replace all of it in under a minute.
What the account controls
registrar account └── nameserver delegation -> point the domain anywhere └── DS records -> remove DNSSEC entirely └── contact details -> capture recovery email └── transfer authorisation -> move the domain away └── the domain itself -> let it expire, or delete it Your CAA record, your DMARC policy, your signed zone: all served by nameservers the account can replace.
This is why registrar security outranks every zone-level control, and why a domain-security assessment that examines records without examining the account has assessed the wrong layer.
The controls, ranked
| Control | Stops | Cost |
|---|---|---|
| Phishing-resistant MFA on the account | The overwhelmingly common attack: credential theft | A hardware key, and the discipline to enrol more than one |
| Individual logins, not a shared one | An account nobody can attribute actions in, whose password left with a leaver | Registrars that support it. Some still do not. |
| Registry lock on critical domains | Everything, including full account compromise | An annual fee and real friction |
| A recovery address on a different domain | A circular dependency: the recovery email for example.com being @example.com | Nothing |
| Auto-renew plus a calendar reminder | Expiry, which is a slow-motion total loss | Nothing |
| Contact details that reach a role, not a person | A transfer notice going to someone who left in 2022 | Nothing |
The dependency worth checking today
If the registrar sends password resets to an address at the domain it controls, then losing the domain loses the means of recovering it. The same applies to MFA delivered to a phone number whose account recovery runs through that mailbox.
- Recovery address on an unrelated domain, ideally a different provider.
- MFA that is not SMS, and enrolled on more than one device.
- At least two people able to reach the account, so it is not one person’s laptop.
Expiry is a hijack with no attacker
A domain that lapses passes through a redemption period and then becomes available to anyone. There are people who watch for exactly this, and recovering a domain after it has been re-registered is a legal process with no guaranteed outcome. Auto-renew on a card that has not expired, plus a reminder that does not depend on the mailbox at that domain, is the entire control and it costs nothing.