The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Protect a new domain in layers: secure the registrar account and its recovery email, configure DNS and email records safely, monitor for lookalike registrations, and report phishing with evidence. These steps protect your domain and improve your response—but they cannot stop someone else from registering a confusingly similar name.
How do I stop someone from stealing my domain?
Start with the registrar account: an attacker who can access it may be able to change domain settings, transfer the name, or delete it. ICANN advises registrants to choose a reputable registrar, secure account access, and request a registrar lock. Accreditation is not a security certification, so assess the registrar’s reputation, recovery support, and available controls as well as its accreditation status. See ICANN’s domain-owner guidance.
As an Amazon Associate I earn from qualifying purchases.
- Use a unique password. Generate a strong password with a password manager; do not reuse a password from another service.
- Turn on multifactor authentication (MFA). Prefer phishing-resistant FIDO/WebAuthn authentication if the registrar supports it. A physical security key, such as a YubiKey, is one option; check that both the registrar and your recovery-email provider support it, and enroll a recovery method before relying on the key. CISA explains MFA options in its small-business MFA guidance. MFA protects account access; it does not stop a third party registering a lookalike domain.
- Protect the recovery route. Use a dedicated registrar login email separate from public registration contact details, and secure that mailbox with MFA. Keep recovery information accessible to the organization, and make sure the people responsible for it remain current.
- Use the registrar’s secure sign-in page. Access it over HTTPS, preferably through a saved bookmark or by entering the known address yourself rather than following an unexpected email link.
- Request registrar lock. Ask the registrar to apply the available lock to help restrict unauthorized changes, transfers, or deletion. As ICANN notes, a lock can help prevent changes to registration information and block transfer or deletion attempts; it is a safeguard, not a substitute for securing the account.
- Limit administrative access. Give registrar access only to people who need it, and review access when responsibilities change.
How do I prevent email spoofing on my domain?
Email spoofing makes a message appear to come from your domain. Configure DNS records according to whether the domain sends mail; parked or unused domains still need deliberate defaults. NCSC’s registrar security guidance specifically calls out MX, DKIM, and SPF for parked domains and suggests considering CAA. The right records depend on your mail provider and intended use.
Recommended Free Tools
If the domain will not send email
Ask your DNS or email provider how to configure a safe no-mail posture so the domain is not an easy source of sender impersonation. Do not add guessed record values: providers’ supported configurations differ. Check whether any existing MX, SPF, or DKIM records are needed before changing them, especially if a service sends mail on your behalf.
#1 Best Overall
If the domain will send email
Configure SPF to identify authorized senders, DKIM to sign mail, and DMARC to publish how receivers should handle mail that fails authentication checks. Inventory every service that sends using your domain before setting policy. Test changes and confirm legitimate messages authenticate before moving to a restrictive DMARC policy; an overly strict policy applied before the inventory is complete can disrupt legitimate mail.
Consider DNSSEC and CAA for their specific jobs
DNSSEC lets validating resolvers check that DNS answers match data signed by the domain owner, reducing the risk of substituted answers. It does not prevent someone from registering a similar name or protect the registrar login. Enable it only with support from both your DNS host and registrar, and ensure the delegation is configured correctly. NIST’s Secure Domain Name System (DNS) Deployment Guide, Revision 3, finalized March 19, 2026, covers DNS integrity and authenticity, including DNSSEC for authoritative DNS.
CAA records can restrict which certificate authorities may issue certificates for your domain, if that fits your certificate-management process. They are not an anti-typosquatting measure and do not replace account security.
How can I find fake domains that look like mine?
Typosquatting is the registration of a name that is confusingly similar to another domain. Protecting your own account and DNS cannot prevent those registrations, so detection and response are separate parts of the plan. NCSC says monitoring new registrations can help identify misleading domains before they are used for abuse.
- Watch relevant registrations. Monitor your brand, common misspellings, and plausible variants across the domain endings that matter to your organization. No monitoring method covers every variant or guarantees detection.
- Use signals as leads, not proof. Brand-monitoring services, DNS changes, and certificate-transparency logs can surface domains or activity worth checking. An ICANN-published 2024 document names DNS Twist and brand monitoring as examples; these are detection approaches, not prevention guarantees. See the ICANN DNS Abuse Mitigation Program document.
- Route alerts to someone who can act. Assign responsibility for validating a suspected lookalike, preserving evidence, and deciding whether to notify your registrar, your organization’s security contact, or affected customers.
- Compare providers on coverage and evidence. When evaluating a monitoring service, ask which domain endings and variants it checks, how quickly it alerts, how it handles false positives, what evidence it supplies, and whether response or takedown assistance is included. The cited guidance does not establish a universal detection rate or ideal monitoring cadence.
What should I do if a lookalike domain is phishing?
Phishing uses deception—such as a fraudulent email or copycat website—to persuade someone to disclose sensitive information or take an unsafe action. ICANN distinguishes it from pharming, which involves redirection, for example through DNS hijacking or poisoning. Before reporting, preserve enough information for the recipient to assess the case.
- Capture evidence. Record the exact domain and full URL, when and where you encountered it, and screenshots. Preserve the email or message; include full headers when available. Save evidence promptly in case the page changes.
- Report it to the sponsoring registrar. Use the registrar’s published abuse-report channel and provide the evidence. ICANN’s May 2, 2024 advisory on DNS Abuse obligations quotes the registrar agreement: “When Registrar has actionable evidence that a Registered Name sponsored by Registrar is being used for DNS Abuse, Registrar must promptly take the appropriate mitigation action(s) that are reasonably necessary to stop, or otherwise disrupt, the Registered Name from being used for DNS Abuse.” The obligation applies within the relevant contractual scope; what is prompt depends on the facts and potential harm, and mitigation should account for collateral damage.
- Notify the impersonated organization. If the site or message pretends to represent a particular company, send the evidence to that company through its official security or abuse contact as well.
- Escalate an inadequate response when applicable. For a gTLD, if you have reported the matter to the registrar and reasonable time has passed without an adequate response, ICANN’s DNS Abuse Mitigation Program page describes escalation to ICANN Contractual Compliance. The program concerns the applicable gTLD contractual obligations; it is not a universal takedown route for every domain ending.
ICANN’s DNS Abuse definition for the relevant gTLD contractual obligations covers malware, botnets, phishing, pharming, and spam when spam is used to deliver one of those forms of abuse. It is a contractual scope, not a complete taxonomy of online harm. A compromised legitimate domain may need targeted remediation rather than suspension, so provide precise evidence and describe the harmful content or activity.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute
