Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsProtect a domain at three points: secure the registrar account and its recovery email, lock down who can change or transfer the domain, and monitor for unexpected changes. A registrar lock is useful but is not a substitute for account security; DNSSEC protects a different layer and cannot stop an authorized registrar-account user from requesting a change.
What a domain takeover can involve
A takeover is not limited to a password theft. It can include impersonation, fraudulent account or transfer messages, an unauthorized transfer, changes to registrant details, or changes to DNS settings. With control of the registrar account, an attacker may redirect a domain by changing its nameservers or other DNS configuration. Even a temporary malicious DNS change can disrupt a business and cause financial or reputational harm, ICANN warns in its Domain Name Hijacking report.
As an Amazon Associate I earn from qualifying purchases.
Secure the registrar login and recovery path
Use unique credentials and strong MFA
- Use a long, unique password for the registrar account. A password manager can help you avoid reusing it elsewhere.
- Enable the strongest multifactor authentication (MFA) the registrar offers. If it supports phishing-resistant security keys, consider using one; otherwise choose its strongest available method. Store backup codes and protect recovery methods as carefully as the password.
- Secure the email account used for registrar notices and password resets with its own unique password and MFA. If someone controls that mailbox, they may be able to undermine registrar-account recovery.
The UK National Cyber Security Centre (NCSC) identifies MFA and change notifications as priorities, and advises that MFA should be enabled by default where possible and at least offered to customers. Its guidance notes that MFA can help prevent password guessing and basic social-engineering password-reset attacks: Make strong security features available to customers.
Limit people and automation with access
- Give registrar access only to people who need it for domain administration. Keep a current list of authorized users and remove access promptly when responsibilities change.
- Revoke unused API tokens. For automation, use separate credentials with limited permissions where the registrar supports them, and confirm that tokens can be revoked.
- If domains use EPP authInfo codes for transfers, treat each code as sensitive authorization data. ICANN’s hijacking report recommends a distinct code for each domain.
Use locks, but check what each one actually blocks
“Domain lock” can refer to different safeguards. Ask your registrar whether each control prevents a transfer, update, deletion, nameserver change, or changes to host or contact objects. Do not assume a transfer lock blocks every kind of account or DNS change.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Registrar or EPP client lock
A registrar-facing EPP client status can prevent specified actions, such as a transfer, update, or deletion. The precise scope depends on the status and registrar implementation. NCSC describes client statuses such as clientTransferProhibited and recommends understanding how registrar controls work.
Registry or server lock
A registry/server-side status adds a separate control path. A status such as serverTransferProhibited is not amended through ordinary EPP; it is governed by registry rules or an out-of-band process. Availability, identity checks, and activation or removal steps depend on the TLD and registrar. Ask whether it is available for your domain and document the legitimate unlock and emergency escalation process.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Additional safeguards can make legitimate transfers or changes slower. For an important domain, keep written instructions for authorized unlocks and urgent restoration, and make sure more than one trusted decision-maker knows where to find them.
DNSSEC is not an account lock
DNSSEC helps protect the authenticity and integrity of DNS data. It does not establish that a person controlling a registrar account is authorized, nor does it prevent that person from asking the registrar to change domain settings. NIST’s current DNS deployment guide is SP 800-81 Rev. 3, published March 19, 2026; it supersedes Rev. 2. Treat DNSSEC as a DNS-layer protection, alongside—not instead of—account MFA, access controls, locks, and monitoring.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Turn on alerts and check the domain’s state
Enable registrar notifications for logins and changes where available. Prioritize alerts for contact information, nameservers or DNS, lock status, and transfer requests. Use notification addresses that are independent of the registrar account where possible, so an attacker who changes the account email does not silence every warning.
Review registration data, nameservers, DNS records, and lock status on a schedule appropriate to the domain’s value. ICANN recommends routine checks and notes that more frequent queries improve the chance of timely detection. A public registration-data lookup may not show the registry’s current lock state immediately: ICANN’s 2005 report cautioned that Whois lock information could be as much as 24 hours out of date. That is dated guidance, not a guarantee of current lookup behavior; use the registrar’s or registry’s authoritative current status view when possible.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Evaluate a registrar’s security and incident response
For a high-value domain, compare providers on the controls that affect both prevention and recovery. ICANN’s SAC044 guide recommends asking registrars and registries about their registration processes and protection mechanisms before choosing a provider.
- Which MFA methods are supported, including hardware security keys?
- Can API tokens be scoped, audited, and revoked?
- Which domain, host, or contact locks are offered, and exactly which actions do they prevent?
- Is a registry/server lock available for this TLD? What identity checks and procedures govern activation or removal?
- Which login, contact, DNS, lock, or transfer changes trigger notices? Can notices go to more than one independent contact?
- How are requests to change nameservers, registrant details, account email, or transfer a domain authenticated?
- What is the emergency support route and response coverage, and what evidence is required to restore access or reverse an unauthorized change?
- How easy is it for an authorized administrator to transfer or recover a domain without weakening safeguards?
Prepare for a suspected takeover
Keep a short incident playbook with registrar and registry contacts from known official channels, proof of domain control and organizational ownership, authorized internal decision-makers, expected DNS settings, and steps for freezing account activity, activating locks, and restoring DNS. ICANN recommends including urgent restoration procedures in business-continuity planning and keeping emergency contacts current.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
If you suspect an attacker has changed the domain, act promptly:
- Contact the registrar through a known official channel—not a link or phone number in a suspicious message. Ask it to secure or freeze the account and transfers, investigate recent changes, and reverse unauthorized registration or DNS changes where possible.
- Secure the registrar-linked email account and any identity accounts used for recovery. Change compromised credentials, revoke unknown sessions or tokens where the services allow it, and restore MFA.
- Preserve notices, support correspondence, and available account or DNS logs. Record when you noticed the issue and what changed.
- Verify the result independently by checking registration status, nameservers, and DNS records against your expected settings. Continue monitoring while the registrar investigates.
Registrar procedures vary, so the steps above are a practical response sequence rather than a promise that every provider offers the same freeze or restoration process.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
