Prevention
Lock, 2FA, DNSSEC: so it never gets that far.
- 2FA for domain accounts: which method actually protects
2FA for domain accounts done right: passkey or security key over app codes, app codes over SMS. Plus recovery codes, team access and the inbox behind it.
- Enable DNSSEC: setup and checks with dig
Enable DNSSEC in 4 steps: sign the zone, publish the DS record via your registrar, verify the ad flag with dig, and switch DNS providers without an outage.
- Prevent domain expiry: never lose a domain to a lapse
Prevent domain expiry with auto-renew, a valid card and a contact email off the domain. Plus the ICANN timeline, including the 30-day redemption period.
- Registrar lock vs registry lock: what each one stops
A registrar lock (clientTransferProhibited) blocks transfers; a registry lock also blocks changes from a hijacked account. How to check both with WHOIS.