Your domain is the master key. Protect it

Whoever controls your domain can read your email, reset your passwords and replace your website. Yet the registrar account is often protected by an old password and somebody’s personal email.

Ten minutes, six settings:

1. MFA on the registrar and DNS accounts.
2. The account email should be a company address you control, not a former employee’s Gmail.
3. Auto-renew on, with a valid card and a reminder a month before expiry.
4. Transfer lock on (registrar lock), so nobody can move the domain away quietly.
5. Remove old DNS records pointing to services you no longer use. A forgotten record pointing at a deleted cloud resource can let someone else take over that subdomain.
6. SPF, DKIM and DMARC for email, so others can’t send mail as you.

If you have domains you don’t use, keep renewing the ones people know. An expired company domain can be bought by anyone, along with every password reset email that still goes there.