Everything in this course so far — DNSSEC, CAA, every record you publish — depends on your domain still pointing at nameservers you control. One account decides that, and it is usually the least defended thing in the whole estate.
Why registrar compromise beats everything below it
An attacker with your registrar account changes the delegation to nameservers they run. From that moment:
- Every DNS record you ever published is irrelevant. Nobody is asking your servers any more.
- They can pass domain-validated certificate issuance, because they now control the DNS the CA will check. Your CAA record is gone with everything else.
- They receive your mail, by publishing their own MX records.
- Your DNSSEC signing is bypassed rather than broken: they remove the DS at the parent, and the domain becomes an ordinary unsigned domain that validates fine.
The controls below cannot help
DNSSEC protects answers from your nameservers. It does not protect the pointer that says which nameservers those are. Registrar control sits above every technical measure in this course, which is why an assessment that reviews records and never asks who can log in to the registrar has missed the largest single risk.
How accounts are actually taken
| Route | What it looks like |
|---|---|
| Credential reuse | A shared login, reused password, no second factor. Overwhelmingly the most common. |
| Email compromise | The registrant contact mailbox is compromised, and password reset does the rest. |
| Social engineering the registrar | Support is persuaded to make a change or reset access. Defended by locks that require out-of-band confirmation. |
| Expiry | Nobody attacks anything. The renewal fails, the domain lapses, and someone else registers it. |
| Departed staff | The account is in a former employee’s name, with recovery routed to their address. |
Only one of those is an attack in the conventional sense. The rest are administrative failures, which is worth stating plainly: this is a governance problem with a technical blast radius.
Expiry deserves its own paragraph
Losing a domain to a failed renewal is indistinguishable, from the outside, from losing it to an attacker — and it is more common. Card on file expires, the notification goes to an address nobody reads, the renewal fails, and after the grace and redemption periods the domain is released.
Auto-renew plus a payment method that does not expire plus a monitored contact address is a security control, not an accounting preference.
Looking at what is published
Registration data is queryable. RDAP is the structured successor to WHOIS and gives cleaner output:
# RDAP, JSON output curl -s https://rdap.org/domain/example.com | less # or the older interface whois example.com
What to look for, before the next lesson goes through the controls in detail:
- Status codes —
clientTransferProhibitedand friends. Their absence is the finding. - Expiry date — and how close it is.
- Nameservers — do they match what you expect.
- Contacts — increasingly redacted, and where visible, frequently wrong.