For a domain account, a passkey or FIDO2 hardware security key is the strongest second factor, because it is bound to your registrar's real domain and won't work on a phishing site. An authenticator app is the next best choice. Use SMS codes only when nothing else is offered, and protect the email account behind your registrar login with 2FA as well.
Whoever gets into your registrar account controls your domain. And whoever controls the domain gets your email, can reset passwords for almost everything else and can run phishing under your name. That makes the registrar account one of the few where 2FA isn’t a recommendation but a must. The only question is which kind.
2FA for domain accounts: the methods compared
Not every second factor protects equally. The difference is whether an attacker can intercept it or trick you into handing it over on a fake page.
| Method | Stops leaked passwords | Stops phishing pages | Stops SIM swapping | Notes |
|---|---|---|---|---|
| Passkey | Yes | Yes | Yes | Bound to the registrar’s domain |
| Security key (FIDO2/WebAuthn) | Yes | Yes | Yes | Physical key via USB or NFC |
| Authenticator app (TOTP) | Yes | No | Yes | Code can be typed into a fake site |
| Push approval | Yes | Partly | Yes | Risk of approving by reflex |
| SMS code | Yes | No | No | NIST: restricted authenticator |
| Email code | Yes | No | Yes | Useless if the inbox is compromised |
The column that matters most is the third. With an authenticator app you type a six-digit code. If the page in front of you is a convincing copy of your registrar’s login, you type it there, and the attacker relays it within seconds. Passkeys and security keys work differently: the browser checks the domain and refuses to sign in on a forgery. That’s why they are practically immune to homograph attacks and typo domains.
Why SMS is the weakest option
In SIM swapping, an attacker persuades your mobile carrier to move your number to a new SIM. From then on, your text messages go to them. It takes preparation and only pays off against valuable targets, but a valuable domain is exactly such a target.
The US National Institute of Standards and Technology lists SMS in its digital identity guidelines (SP 800-63B) as “restricted”, meaning an authenticator with known weaknesses for which alternatives should be offered. If your registrar only supports SMS, use it. If it offers more, remove SMS as a fallback, because attackers always pick the weakest route.
The inbox behind the account
The best 2FA on the registrar account won’t help much if someone can reset the password through your inbox and talk a support agent round. The inbox is part of your defence:
- 2FA there too, with the same care.
- Not on the same domain. If your registrar contact is
[email protected]and that domain gets redirected, the reset lands with the attacker. An address with an unrelated provider breaks that loop. - Check forwarding rules. A quiet forward is the first thing attackers set up in a compromised inbox.
What such a break-in looks like, and what to do, is in registrar account hacked.
Setting it up without locking yourself out
The biggest worry with 2FA isn’t the attacker but the lost phone. Three precautions prevent that:
- Register two factors. For instance a passkey on your laptop and a security key on your keyring, or two hardware keys with one kept in a drawer.
- Store recovery codes. Print them and file them with important papers, or keep them in your password manager. Not as a photo on the phone you’re trying to protect.
- Test. Sign out once and sign back in with the second factor. Then you know it works.
Passkeys: what changes
Passkeys build on the same standard as security keys, FIDO2 with WebAuthn. The difference is that the key lives in your operating system’s or password manager’s keychain, often synced across devices, and you open it with a fingerprint, face or device PIN.
For a domain owner that has two consequences. The good one: signing in is easier than typing app codes and still phishing-resistant, since a passkey only works on the registrar’s real domain. The less good one: your security now depends on the account that syncs your passkeys, so your Apple, Google or password-manager account needs strong protection too. If you can, use a synced passkey day to day and a hardware key as a backup that doesn’t depend on any cloud account.
Teams and agencies
If an agency manages your domains, the same applies to their account, with more people involved. Ask: does each person have their own login and 2FA? Is access removed when someone leaves? Is the domain registered in your name?
API access, for instance for automated DNS changes from a deployment, has no 2FA. Other controls take over: keys with the fewest permissions possible, bound to fixed IP addresses and rotated regularly. An API key committed to a public Git repository is an open registrar account.
What 2FA doesn’t replace
2FA protects the login. It doesn’t stop a social-engineering call to support, an expired domain or forged DNS answers in transit. Other pieces cover those: a registry lock for domains that matter, and DNSSEC for DNS answers.
Next step: open your registrar’s security settings and see which methods are on offer. If you find the basics missing, betadomain is a registrar with DNSSEC and fixed prices, with pages for every extension such as .com domains, and a domain search for new projects.
Step by step
- Inbox firstEnable 2FA on the email address used for your registrar account, ideally with a passkey or security key.
- Pick the methodChoose the strongest method your registrar offers: passkey or security key over app, app over SMS.
- Register a backup factorAdd a second key or device so losing one doesn't lock you out.
- Store recovery codesPrint the recovery codes or save them in your password manager, away from your phone.
- Clean up old accessRemove unused sessions, sub-accounts and API keys, and drop SMS as a fallback where you can.
Found your domain? You can check and register it directly at check your domain – yearly price from €2.99.
FAQ
My registrar doesn't offer 2FA. What should I do?
That's a good reason to consider switching. Until then, use a long, unique password from a password manager and secure the linked email account with 2FA, because every password reset goes there. Check whether the registrar can notify you of new sign-ins.
What if I lose the phone with my authenticator app?
That's what recovery codes are for. You get them during setup and should print them or store them in your password manager. Without them, only the registrar's support can help after verifying your identity, which can take days. A second registered factor, such as a security key, avoids this.
Is SMS 2FA better than nothing?
Yes, by a long way. It stops logins with passwords leaked in data breaches. It does little against targeted SIM swapping or real-time phishing, which is why NIST classes SMS as a restricted authenticator.
Should colleagues share one registrar login?
Better not. A shared login usually means a shared password and one 2FA device owned by one person. If the registrar supports sub-accounts or team roles, give each person their own login and second factor.