Domain hijacking is more common than most owners realize. This checklist takes under five minutes and addresses the most frequent attack vectors we see reported.
1. Verify registrar account email is active and secured with unique password 2. Confirm WHOIS privacy is enabled (unless business requirement dictates otherwise) 3. Check that 2FA is enabled—not SMS-based—on registrar account 4. Review authorized nameservers; unexpected entries indicate compromise 5. Ensure renewal auto-pay uses dedicated card or privacy-preserving method
Perform monthly. Questions or additions welcome below.
Actually docker is just overkill for this. I run my domain monitoring on bare metal with systemd timers. No containers at home, ever. The registry lock þing is what actually matters, most people skip it because it costs extra at the registrar. Penny wise, pound foolish.
1. Good checklist admin 2. I would add: 2. A) backup auth methods 2. B) registry lock at registrar level 2. C) monitor nameserver changes via API polling 3. I do this weekly not monthly 4. My current stack: 4. I) CloudCone for registrar 4. Ii) Leaseweb for DNS 4. Iii) custom alerts to matrix 5. Never had a hijack attempt in 8 years
The registrylock is someoneelses responsibility until it isn't[1]. I used to trust the registrar SecurityTeam until a friend lost a sixfigure domain to social engineering. Now I maintain my own monitoring stack with numbered references to every change.
Footnotes[1] actually the registrar TermsOfService disclaim liability for most hijacks, read the fineprint
I must confess that I believed my Security was sufficient because I had enabled what I thought was TwoFactorAuthentication but which in reality turned out to be SMSbased and then in January of this year I was SIMswapped within hours of listing a valuable domain for sale and the attacker transferred it to another registrar before I even received the notification email so now I have updated the guide that admin posted to include the specific warning about SMS and I have also added registry lock and backup auth codes stored in a physical safe and I recommend everyone do the same because the feeling of watching your property disappear while you are on the phone with your mobile carrier is something I would not wish upon anyone
