# Domain and DNS security: preserve control of the address your users trust

Canonical: https://www.web3sec.news/blog/domain-dns-security-runbook
Author: Raiders (https://www.web3sec.news/about)
Format: guide
Topic: Domains & DNS
Published: 2026-11-08
Updated: 2026-11-08

A runbook for registrar ownership, scoped DNS changes, renewal resilience and safe nameserver recovery.

## Record ownership and independent recovery

Give domain ownership to the organization, with a named accountable administrator and a backup custodian. Record the registrar, authoritative DNS provider, registrant contact, renewal date, payment owner, nameservers and recovery channels. Distinguish the registrar from the DNS host and the website host: each can redirect or interrupt a different part of the customer journey, and they may be managed through separate accounts.

Protect registrar and DNS administrators with strong authentication and review delegated access. Avoid making recovery depend exclusively on mail delivered through the same domain. Keep an offline record of the provider support process and proof of organizational control. Expiry or a failed renewal payment can look like an attack to customers, so route billing failures to more than one responsible person.

## Separate transfer protection from DNS integrity

ICANN describes registrar locking as protection associated with domain transfer restrictions. Verify the actual status and the provider’s unlock procedure; do not assume that a transfer lock prevents every change to DNS records. Our recommendation is to restrict API tokens to the zones and actions they need, keep deployment automation away from registrar ownership changes and require review for nameserver or mail-routing modifications.

Cloudflare’s DNSSEC documentation explains signed DNS and the relationship to the parent DS record. Enable and migrate DNSSEC through a planned provider-specific process. An incorrect DS configuration can make a legitimate domain fail validation. Record the current state before changes, validate from an external resolver and prepare a rollback that accounts for caching and the registrar’s response time.

## Monitor the changes that redirect trust

Watch registrar contact changes, transfers, nameservers, apex and application records, mail exchangers and domain-authentication records. Monitor certificates and website behavior as supporting signals, while recognizing that a certificate alert alone does not explain who changed the DNS. Keep a dated zone export and approved change record so an unfamiliar entry can be compared with an intended deployment.

When a suspicious change appears, first establish whether the registrar, DNS account or hosting configuration is affected. Preserve audit events and then revoke the relevant tokens or sessions from a clean account. Restore approved records and check the site, email delivery and certificate behavior. Do not publish a reassuring all-clear while cached malicious destinations may still be reachable by part of the audience.

## Practice a migration without risking the production domain

Use a dedicated test subdomain or low-impact domain to exercise record restoration and provider escalation. Make an approved change, confirm that monitoring catches it and restore the prior state. For a nameserver or DNSSEC migration, stage the zone and verify expected records before changing delegation. The operator should be able to explain what happens to email and verification records during the transition.

Review the inventory after acquisitions, marketing campaigns and vendor offboarding. Remove obsolete CNAME records only after checking whether the destination is still claimed and used. Keep useful defensive registrations under the same renewal discipline. The test passes when a backup administrator can find the approved configuration, reach support and restore service without relying on the unavailable primary owner.

## Controls to take away

- A transfer lock is not a universal DNS-change control.
- Recovery must work when the primary domain cannot deliver email.
- DNSSEC migrations need externally verified delegation and rollback.

## Working checklist

Assign owners and record supporting evidence in your team's system.

- [ ] Separate registrar, DNS and hosting ownership records.
- [ ] Verify renewal payment and alternate recovery contacts.
- [ ] Scope DNS tokens and protect ownership changes.
- [ ] Test DNSSEC validation and rollback on a safe domain.
- [ ] Monitor nameservers, mail routing and critical records.

## Sources & further reading

- [ICANN: locked domains and transfer status](https://www.icann.org/resources/pages/locked-2013-05-03-en)
- [Cloudflare: DNSSEC documentation](https://developers.cloudflare.com/dns/dnssec/)

Incident facts are attributed to the linked reports. Recommendations are Web3Sec's analysis.

[Research methodology](https://www.web3sec.news/methodology) · [Editorial policy](https://www.web3sec.news/editorial-policy) · [Send a correction](https://www.web3sec.news/contact)