Protecting your domain name: expiration, auth code, transfer lock and forgotten DNS records

Whoever manages your domain name also receives the mail sent to that domain. With that mail, they can click "forgot password" on almost any other account: your accounting, your bank, your online store, your social media. That makes your domain name one of the most important things you own. This article explains how to protect it against expiry, hijacking and forgotten DNS records, and what to set up in My WebOké to do so.

Don't let your domain expire

Domains are most often lost because they aren't renewed on time, for example because a payment card has expired or an invoice went to a colleague who has since left. The domain then goes offline and, after a while, becomes available to anyone. Whoever registers it next receives all the mail still being sent to your old addresses.

• On the domain page in My WebOké, keep Renews annually switched on. This is the default. See Renewal and automatic renewal.
• Pay your renewal invoices by direct debit, so a forgotten invoice can't cost you your domain.
• Keep a list of all your domains, including the ones you only registered just in case.
• Don't simply cancel an old domain you once used for mail. Keep it, and lock it down as a domain that doesn't send mail (see below).

Has it already happened? After cancellation, a .nl domain stays in quarantine for 40 days. During that time, only the last registrant can get it back. Read how this works, including for other extensions, in Recovering an expired or cancelled domain: quarantine and redemption period.

Check the registrant and the registrant's email address

The registrant is the legal owner of the domain. If your web designer, a former employee or a company that no longer exists is listed there, it will be difficult to prove the domain is yours in case of a dispute. So check:

• that your company is registered as the registrant, under the correct name;
• that the registrant's email address works and isn't on the domain itself. If mail on your domain stops working, warnings about that domain won't reach you either. So use an address on a different domain;
• that you confirmed the email address when asked to. For many extensions this is mandatory. If you don't, the domain may be suspended. On the Domain / Email health card on the domain page, you can see under Registrant verification whether it succeeded, and you can have the verification email resent.

Received an email from ICANN or the registry about your domain? Read Emails from ICANN or the registry about your domain: real or fake, and what should you do? first. Such emails are often faked too.

Protect your account, the transfer code and the transfer lock

Anyone who gets into your My WebOké account can change your domain's nameservers or DNS and redirect your website and mail. So treat that account as one of your most important ones:

• Turn on two-factor authentication. See Setting up two-factor authentication in My WebOké and an authenticator app.
• Never log in via a link in an email about your domain ("your domain expires today, pay here"). Go to My WebOké yourself. See also Recognising phishing: how to read a link and a sender.

The transfer code (also called EPP code or authorisation code) is the key to your domain: whoever has it can transfer the domain to another provider. Only request it when you're transferring the domain yourself, and only give it to the provider you're moving to. If you receive a transfer confirmation you weren't expecting, contact us right away.

A transfer lock blocks transfers you didn't request: as long as the lock is on, the registry refuses the transfer. You'll find it on the domain page in the Advanced card, under Transfer lock. If you're staying with WebOké, leave the lock on. Not every extension supports a transfer lock. For .nl, .eu, .be and .nu, among others, the transfer code itself is the protection. Read more in Transferring a domain away: transfer code (EPP) and transfer lock.

Clean up forgotten DNS records

A dangling record is a DNS record that points to something you no longer use: a cancelled online store, a deleted server or a service you've left. If someone else can take over that target, for example by creating a store with the same name on the same platform, your subdomain suddenly shows their pages, under your name. This is called subdomain takeover.

• Cancelling a service? First remove the DNS record pointing to it, then cancel the service.
• Once a year, review all records in My Domains, DNS tab. If you don't know what a record is for, find out. Make a backup of your DNS first, see Making and restoring a backup of your DNS.
• Be careful with a wildcard record (*) that points to an external service.

A domain that doesn't send mail: lock it down

Do you have a domain that never sends or receives mail, such as a brand name you only registered or an old domain? Scammers love using such domains as a sender address, because nobody keeps an eye on them. With three records you make it clear that no mail should go to or from this domain:

MX    @        0 .
TXT   @        v=spf1 -all
TXT   _dmarc   v=DMARC1; p=reject

The MX record with 0 . (a null MX) states that no mail is received on this domain. -all states that no server may send mail on behalf of the domain, and p=reject asks recipients to reject any mail that still uses this domain as its sender. Only do this if there really are no mailboxes, forwarders or services using the domain for mail.

You add the three records yourself in My Domains, DNS tab. For the MX record, use @ as the name, 0 as the priority, and enter just a dot as the mail server. The Domain / Email health card recognises such a null MX: under MX it will show that this domain deliberately doesn't receive mail. If the SPF or DMARC record is still missing, you'll see that there too.

Extra locks: DNSSEC and CAA

DNSSEC adds a digital signature to your DNS responses, so nobody can forge them along the way. It doesn't protect against someone logging into your account. CAA is a DNS record that specifies which issuers may create a certificate for your domain. If you set a CAA record, also include the issuer of the certificate you currently use, otherwise that certificate can no longer be renewed.

You can check whether DNSSEC and CAA are set up correctly for your domain on the Domain / Email health card on the domain page, or with the public Domain health tool. See also Domain and email health: checking and fixing.

Want to learn more? Take the free Safe online course, lesson 4.3 Protecting your domain name.