Ask what your company’s most critical IT asset is and nobody says “the domain name” — yet yourcompany.com is the single point everything else hangs from: email routes by it, the website lives at it, your sender authentication is published on it, and a decade of client trust is attached to it. Someone who controls your domain controls, functionally, your identity — they can receive your email, impersonate you perfectly, and redirect your web traffic, all without touching a single computer you own. The protections are cheap and mostly one-time; the exposure, at most businesses, has simply never been looked at. Here’s the look.
Threat one: losing control of the domain itself
Domain hijacking rarely involves exotic hacking — it involves the registrar account. The unglamorous checklist: know where the domain is registered and who owns the login — an alarming number of businesses discover it’s a departed employee’s email or the founder’s personal account, which is a single-point-of-failure with a personality; move it to a company-controlled account with named access · MFA on the registrar account, which guards the keys to everything above · transfer lock enabled (a standard registrar feature that blocks domain transfers without an explicit unlock — on by default at good registrars, worth verifying at all of them) · and registry lock for the truly critical — a higher-assurance option where changes require out-of-band verification, cheap insurance for a domain that is the business.
And the embarrassing classic: expiration. Domains lapse because the renewal notice went to an inbox nobody reads, the card on file expired, or the “person who handles that” left in 2022. A lapsed domain means email stops company-wide — and expired domains get snapped up by speculators within hours. The fixes take five minutes: auto-renew on, a current payment method, the renewal on the same calendar as everything else, and multi-year registration for the flagship domain because the marginal cost is lunch money.
Threat two: the DNS records themselves
DNS is the address book the internet consults about you, and whoever edits it steers your traffic and mail. The hygiene: access to DNS management treated like the admin access it is — few hands, MFA, changes logged · a periodic records review, because DNS accumulates archaeology — records pointing at long-dead services and third-party platforms you’ve left. Stale records aren’t just clutter: a record pointing at a deprovisioned cloud resource can sometimes be claimed by an attacker (subdomain takeover), who then operates a credible-looking piece of your domain. Fifteen minutes a year reconciling records against the current service inventory retires the risk · and the authentication records kept current — SPF, DKIM, DMARC live here, and every mail-sending vendor you add or drop is a DNS edit someone must actually make.
Threat three: the DNS your users consume
The flip side — not your domain, but the lookups your machines perform all day. Protective DNS filtering points your company’s resolution at a service that refuses to resolve known-malicious destinations: the phishing page’s domain, the malware’s command-and-control, the typo-squat. It’s one of the quietest, highest-value controls per dollar in security — a click that resolves to nothing can’t harvest anything — it protects laptops off-network too (via the endpoint agent versions), and it generates useful visibility as a byproduct: which machine keeps trying to reach the bad neighborhood is an investigation lead. Most managed security stacks include it precisely because it’s cheap prevention that catches what email filtering missed.
The bottom line
The domain is the name everything answers to, and its security is mostly a one-afternoon project: company-owned registrar account with MFA and locks, expiration made impossible, DNS access treated as admin access with an annual records reconciliation, and protective DNS filtering the traffic your people generate. None of it is glamorous — which is fitting protection for the asset nobody thinks about until the day everything attached to it stops working.