Hacker News new | ask | show | jobs
by sshine 1209 days ago
To prevent domain hijacking:

Tip 1: Pick an enterprise-class domain name registry.

Tip 2: Set up 2FA that isn't phone-based.

Tip 3: Request DNSSEC from your registrar.

5 comments

> registry

Registrar. You can't buy directly from the registry unless you become registrar yourself.

Some other important tips:

- make sure auto-renew is enabled with a reliable credit card

- make sure to update your personal data once a year. Registrars are mandated by the registry to send a reminder email once a year, but for an important domain I'd also set a recurring reminder every year, 2 weeks before expiration to make sure that everything is ok. You probably shouldn't "setup and *forget*" your domain names

- if you can afford it, make sure to register multiple years at once, the max is usually 10 years, but I'd recommend registering for only 9 years, because if you need to transfer to another registrar for some reason, the registration will be bumped 1 year. If you're already at 10, you're stuck.

I have always skimped on giving real life details to registrars, I don't trust them to handle my data well, especially cheapo ones like namecheap.
If you don't have real details on file, and you get UDRP'ed, you might not receive the complaint, and you'll lose by default if you don't respond.
The email is correct, so I should be OK.
And secure the email addresses used for your registrar account with 2FA, and disable weak recovery methods.
Done.
Also register it out for 10 years and turn auto renew on
Setting up DNSSEC will not do anything to prevent domain hijacking, which is an attack that occurs at the registrar level.
Regarding tip number 1, how can one find an enterprise-class domain name registry? Any advice?
Pick your top 10-100 large enterprises, especially those with a major internet presence. Use whois to find the registry they use. See if you can get sales to call you back.

My experience is many years old now, but when Network Solutions's incompetence resulted in our glue records getting changed by hackers, the startup I was at switched to MarkMonitor. At the time, MarkMonitor charged a large premium per domain year, and a significant annual cost to setup 'registry lock' (which prevents the customer or the registrar from making changes to the domain without going through a proccess with the registry), and they had IIRC a $10k/year minimum spending commitment. A lot has changed since then, it's probably worth getting them on the phone if you're serious about your domain, but it's probably still going to be expensive. Get on the phone with at least CSC Domains as well.

Most enterprise class registrars (registry =/= registrar) are brand protection and brand monitoring services. Quite expensive for individuals and probably not in the price range of OP, according to the description of his circumstances.

I've used name.com, namecheap.com, sav.com and porkbun.com as registrars without difficulty, although one will always find anecdotal reports of problems other users have had with any service.

GoDaddy, on the other hand, is to be avoided. It's like the PayPal of domains. Awful customer service and dark patterns everywhere.

How about Cloudflare Registrar?
I like them as a company, but I wouldn't use them as a registrar if there was a significant risk of UDRP. Domains are not their core business and customer service is close to non-existent if you're not at least a pro-level customer. For your case, you should use a dedicated domain registrar, such as the ones I outlined earlier. Infomaniak is another registrar that I've found good in terms of customer service and price. They're Swiss based, and I've found them to be competent and professional.
Thanks! Does it make a difference that the registrar is in your country, or at least in your "continent" (i.e.: EU) for those bad things that can happen like UDRP, etc.?
I understand and really appreciate the feedback.
1. How bad is Cloudflare? 2. Done. 3. Done.