Skip to content

DNS and Domain Registration Security

Engineer/DeveloperSecurity SpecialistOperations & Strategy

Authored by:

Raiders
Raiders
Web3Sec.News & Digibastion.com

DNS (Domain Name System) is the backbone of the internet, translating domain names into IP addresses. In Web3, domain security is particularly critical as compromised domains can lead to irreversible financial losses through wallet drainers and phishing attacks. Unlike traditional web applications where stolen funds can sometimes be recovered, blockchain transactions are permanent.

Moreover, DNS controls your email infrastructure through MX records - once compromised, attackers gain the keys to your entire organization through password resets and intercepted communications, making domain security a matter of both financial and operational survival.

Understanding the Attack Surface

How DNS Resolution Works

When users type your domain, their request traverses multiple trust points:

  1. Local device cache
  2. ISP DNS resolver
  3. Root nameservers
  4. TLD registry servers
  5. Your authoritative nameservers

Each step represents a potential attack surface where responses can be intercepted, modified, or poisoned. This multi-step process creates numerous opportunities for attackers to redirect users to malicious sites while their browser still shows the correct domain name.

Common Attack Vectors

  • Social Engineering at Registrars: Attackers convince/bribe support staff they're legitimate owners using publicly available information
  • Expired Domain Sniping: Domains that expire enter a grace period before becoming publicly available to anyone
  • DNS Hijacking: Unauthorized changes to DNS records redirecting traffic to malicious servers
  • Email Interception: Compromised MX records allowing password reset attacks and communication interception
  • DNS Tunneling: Encoding data within DNS queries for covert communication channels, often used for data exfiltration

DNS-Level Security

1. DNSSEC Implementation

DNSSEC (DNS Security Extensions) provides cryptographic authentication of DNS responses, preventing attackers from redirecting your users to malicious sites by tampering with DNS queries. Think of it as a digital signature that proves the DNS response came from the legitimate source.

How it protects you: Without DNSSEC, attackers can intercept DNS queries and return fake IP addresses, redirecting users to malicious sites that look identical to yours. DNSSEC prevents this by cryptographically signing all DNS responses.

Setup process:

  1. Enable DNSSEC signing at your DNS provider (most providers have this as a simple toggle)
  2. Publish DS records to your registrar (your DNS provider will give you these records)
  3. Monitor DNSSEC validation status regularly using online tools
  4. Test configuration using tools like DNSViz or Verisign DNSSEC Debugger

2. CAA Records

Certificate Authority Authorization (CAA) records specify which Certificate Authorities (CAs) are allowed to issue SSL certificates for your domain. This prevents unauthorized certificate issuance, which attackers could use to create fake SSL certificates for your domain.

How it protects you: Without CAA records, any Certificate Authority can issue SSL certificates for your domain. Attackers could potentially obtain fake certificates and use them in sophisticated phishing attacks that appear to have valid SSL encryption.

Before setting CAA records, identify which CA issued your current certificate:

  • Command line: openssl s_client -connect yourdomain.com:443 -servername yourdomain.com | openssl x509 -noout -issuer
  • Web tools: SSL Labs Server Test provides comprehensive certificate analysis including issuer information
  • Browser: Click the padlock icon → Certificate details → Issuer information

Setup process: Add CAA records to your DNS zone. Most DNS providers allow you to add these through their web interface:

# Allow only specific CAs to issue certificates
example.com. CAA 0 issue "letsencrypt.org"
example.com. CAA 0 issue "digicert.com"
 
# Send violation reports when unauthorized CAs attempt issuance
example.com. CAA 0 iodef "mailto:security@example.com"
 
# Control wildcard certificate issuance separately
example.com. CAA 0 issuewild "letsencrypt.org"
 
# Completely disable all certificate issuance (useful for non-web domains)
example.com. CAA 0 issue ";"

3. Email Security Configuration

Email security records protect against email spoofing and phishing attacks. When your domain is compromised, attackers often change email settings to intercept password reset emails and other sensitive communications.

SPF (Sender Policy Framework)

SPF records specify which mail servers are authorized to send emails on behalf of your domain. This prevents attackers from spoofing your domain in phishing emails.

How it protects you: Without SPF, anyone can send emails claiming to be from your domain. Attackers use this for sophisticated phishing campaigns that appear to come from your legitimate email address.

This is particularly dangerous as attackers can impersonate executives or team members to target your own organization and users - imagine receiving a "urgent wire transfer" request from your CFO's email address, or your users getting a "mandatory wallet update" from your official support email.

Setup: Add an SPF record to your DNS zone:

example.com. TXT "v=spf1 include:_spf.google.com ~all"

DKIM (DomainKeys Identified Mail)

DKIM adds a digital signature to your emails, allowing receiving servers to verify that emails actually came from your domain and haven't been tampered with.

How it protects you: DKIM signatures prove email authenticity and integrity, making it much harder for attackers to successfully spoof your domain in phishing campaigns.

Setup: Configure with your email provider and publish public keys in DNS (your email provider will provide the specific records).

MTA-STS (Mail Transfer Agent Strict Transport Security)

MTA-STS enforces encrypted connections between mail servers, preventing man-in-the-middle attacks on email transmission.

How it protects you: Without MTA-STS, emails can be intercepted in transit. This is especially critical for password reset emails and other sensitive communications.

Setup: Add an MTA-STS record to your DNS zone:

_mta-sts.example.com. TXT "v=STSv1; id=20240101000000"

DMARC (Domain-based Message Authentication)

DMARC builds on SPF and DKIM to provide policy enforcement for email authentication. It tells receiving mail servers what to do with emails that fail authentication checks.

How it protects you: DMARC prevents email spoofing by instructing receiving servers to reject or quarantine emails that fail authentication, protecting your users from phishing attacks.

Setup: Add a DMARC record to your DNS zone:

_dmarc.example.com. TXT "v=DMARC1; p=reject; rua=mailto:dmarc@example.com; ruf=mailto:forensics@example.com"

Registrar Security

1. Choosing a Secure Registrar

Your domain registrar is the company that manages your domain registration with the central registry. This is often the weakest link in domain security, as many registrars have poor security practices and are vulnerable to social engineering attacks.

Enterprise-Grade Registrars (Recommended)

These registrars are designed for high-value domains and have security measures that consumer registrars lack:

  • MarkMonitor: Used by Fortune 500 companies, requires legal documentation for changes, dedicated security team
  • AWS Route53: IAM policy integration, CloudTrail logging, uses Amazon Registrar for major TLDs (but check TLD support)
  • Cloudflare Registrar: No markup pricing, automatic DNSSEC, built-in DDoS protection, requires Cloudflare services

Consumer Registrars to Avoid for Critical Domains

These registrars are designed for personal use and lack the security measures needed for Web3 projects:

  • GoDaddy: History of social engineering vulnerabilities, call center support vulnerable to manipulation
  • Namecheap: While better than GoDaddy, still vulnerable to social engineering and lacks enterprise-grade security controls
  • Consumer-focused services (Google Domains/Squarespace): Designed for personal use, not enterprise security
  • Resellers: Add another layer of complexity and potential attack surface

2. Registrar-Level Protections

Registry Lock (EPP Lock)

Registry lock prevents unauthorized transfers at the registry level, not just the registrar. This is the strongest protection available for domain security.

EPP Status Codes that protect your domain:

  • clientTransferProhibited: Prevents domain transfers to another registrar
  • clientUpdateProhibited: Prevents any DNS or contact information changes
  • clientDeleteProhibited: Prevents domain deletion
  • serverTransferProhibited: Registry-level transfer protection (stronger than client-level)
  • serverUpdateProhibited: Registry-level update protection
  • serverDeleteProhibited: Registry-level deletion protection

How it protects you: Standard transfer locks only prevent transfers between registrars, but registry locks with full EPP protections prevent ALL unauthorized changes including DNS updates, contact modifications, and deletions. Server-level locks require manual verification with the registry operator (like Verisign for .com domains), making social engineering attacks at the registrar level completely ineffective.

Setup: Contact enterprise registrars for registry-operator level locks. This typically requires additional fees and documentation but provides the highest level of security.

Multi-Factor Authentication

Multi-factor authentication (MFA) adds an extra layer of security beyond just passwords, which are easily compromised through phishing or data breaches.

Authentication options (in order of security):

  • Hardware Security Keys (YubiKey/FIDO2): Most secure option, immune to phishing
  • TOTP Applications (Google Authenticator, Authy): Minimum acceptable standard
  • Avoid SMS 2FA: Vulnerable to SIM swapping attacks

Dedicated Security Contact Email

Use a dedicated email address for domain security that's completely separate from your main domain and personal accounts.

Why this matters: If your main domain is compromised, you need a way to receive security notifications and regain control. Using the same domain creates a circular dependency.

❌ admin@yourdomain.com (circular dependency - if domain is hijacked, you lose email access)
❌ personal@gmail.com (too many attack vectors, likely used across multiple services)
⚠️ domain-security@protonmail.com (better than gmail, but still a shared service)
✅ security@yourcompany-domains.com (best - separate domain dedicated to domain management)

As a best practice register a separate domain specifically for domain management (e.g., yourproject-domains.com or yourproject-security.com) with a different registrar than your main domain. This ensures you maintain communication channels even if your primary domain is completely compromised.

Access Control Best Practices

Limit and monitor who has access to your domain registrar account, as each person with access represents a potential attack vector.

Key practices:

  • Document all personnel with registrar access
  • Use role-based access where available
  • Implement approval workflows for critical changes
  • Regular access audits (quarterly minimum)

WHOIS Privacy Protection

WHOIS records contain personal information about domain owners that is publicly accessible by default, including names, addresses, phone numbers, and email addresses.

Why it matters: Without WHOIS privacy, your personal information is exposed to:

  • Attackers gathering information for social engineering attacks
  • Spammers harvesting contact details
  • Competitors researching your infrastructure
  • Anyone running a simple WHOIS lookup

Setup:

  • Enable WHOIS privacy/proxy service through your registrar (often free or low-cost)
  • Use company information instead of personal details where privacy isn't available
  • Consider using a separate business entity for domain registration
  • Be aware that some TLDs (.us, .ca) don't allow WHOIS privacy

Important: WHOIS privacy doesn't affect your legal ownership - you remain the legitimate owner, the privacy service just shields your personal information from public view.

Domain Expiration Protection

Domain expiration is a critical yet often overlooked security risk. When domains expire, they enter a grace period before becoming publicly available, creating an opportunity for attackers to snipe your domain.

Expiration timeline:

  • Day 0: Domain expires (site goes down)
  • Day 1-45: Auto-renew grace period (can renew at normal price)
  • Day 46-75: Redemption period (costs 10x+ to recover)
  • Day 76-80: Pending delete
  • Day 81: Public availability (bot armies compete to register)

Protection measures:

  • Enable auto-renewal on all critical domains
  • Set multiple renewal reminders at 90, 60, 30, and 7 days before expiration
  • Register domains for maximum period (up to 10 years for most TLDs)
  • Use a domain monitoring service that alerts on upcoming expirations
  • Document renewal dates in your security calendar
  • Ensure payment methods stay current - expired credit cards are a common cause of accidental expiration
  • Designate a backup person responsible for domain renewals

Pro tip: Set calendar reminders to check auto-renewal status quarterly - don't assume it's working until you verify.

Monitoring and Detection

1. DNS Record Monitoring

DNS record monitoring involves continuously checking your domain's DNS records for unauthorized changes. Attackers often modify DNS records to redirect traffic to malicious servers while keeping your site partially functional.

What to watch for:

  • Nameserver (NS) record changes: Attackers change your nameservers to point to their own DNS servers, giving them complete control over all DNS records
  • TTL values dropping below 60 seconds: Very low TTLs can indicate preparation for rapid DNS changes during an attack
  • CAA record removal: Allows any Certificate Authority to issue certificates for your domain
  • DNSSEC disabled unexpectedly: Removes cryptographic protection from DNS responses

If nameservers remain unchanged, also monitor:

  • A/AAAA record modifications: IP address changes could redirect users to malicious sites
  • MX record modifications: Email server changes could intercept password reset emails
  • TXT record changes: Could affect email security (SPF/DMARC) or domain validation

Tools for DNS monitoring:

  • MXToolbox - Comprehensive DNS record monitoring and alerts
  • DNSViz - DNSSEC chain validation and debugging
  • DNS Dumpster - DNS reconnaissance and record discovery
  • Hetrix Tools - Free DNS monitoring with email alerts

Note: If attackers change your NS records, they control everything. But attackers with DNS panel access might make subtle changes without touching NS records to avoid detection, which is why monitoring individual record types remains important.

2. Certificate Transparency Monitoring

Certificate Transparency (CT) logs are public records of all SSL certificates issued by Certificate Authorities. Monitoring these logs helps detect unauthorized certificate issuance.

Why it matters: Attackers sometimes obtain fake SSL certificates for legitimate domains to make phishing sites appear more credible. CT monitoring helps you detect these certificates before they're used in attacks.

Setup and tools:

  • crt.sh - Search and monitor CT logs for your domain
  • Cert Spotter - Free CT monitoring with API access
  • Watch for wildcard certificates if you don't use them (could indicate broader compromise)

3. Passive DNS Monitoring

Passive DNS monitoring tracks historical DNS resolution data across the internet, helping you detect brief changes that might be missed by periodic checks.

What it detects:

  • Brief record changes: Attackers often make quick changes to avoid detection
  • Geographic anomalies: DNS records resolving to unexpected countries or regions
  • Suspicious hosting provider changes: Sudden switches to hosting providers known for malicious activity

Tools for passive DNS:

Setting Up Alerts

Critical Alerts (Immediate Response Required)

  1. Registrar Changed
    • What it monitors: Changes to your domain's registrar
    • Why it's critical: Indicates potential domain hijacking or unauthorized transfer
    • Response: Immediate verification and potential incident response activation
  2. Nameserver Changed
    • What it monitors: Changes to nameserver records
    • Why it's critical: Attackers often change nameservers to redirect traffic to malicious servers
    • Response: Verify legitimacy, check if you initiated the change
  3. DNSSEC Broken
    • What it monitors: DNSSEC validation failures or disabled DNSSEC
    • Why it's critical: DNS responses can be tampered with, leading to man-in-the-middle attacks
    • Response: Investigate signing issues, check for configuration changes
  4. CAA Records Removed
    • What it monitors: Removal of Certificate Authority Authorization records
    • Why it's critical: Allows any CA to issue certificates for your domain, enabling SSL certificate attacks
    • Response: Restore CAA records immediately, investigate who removed them
  5. TTL Drop Under 60 Seconds
    • What it monitors: Time-to-live values dropping below 60 seconds
    • Why it's critical: Very low TTLs can indicate preparation for rapid DNS changes (attack preparation)
    • Response: Investigate why TTL was lowered, verify it's legitimate

High Priority Alerts (When NS Unchanged)

  1. A Record Changed
    • What it monitors: IP redirects without NS changes
    • Why it's important: Could redirect users to malicious servers
    • Response: Verify the new IP address is legitimate and expected
  2. MX Record Changed
    • What it monitors: Changes to mail server configurations
    • Why it's important: Could intercept emails, including password reset messages
    • Response: Verify mail server changes are authorized
  3. DMARC Policy Weakened
    • What it monitors: Changes from "reject" to "quarantine" or "none"
    • Why it's important: Weaker policies allow more spoofed emails to reach users
    • Response: Investigate why policy was weakened, restore if unauthorized
  4. Unexpected Certificate Issued
    • What it monitors: New SSL certificates issued for your domain
    • Why it's important: Could indicate certificate-based attacks or unauthorized issuance
    • Response: Verify the certificate was requested by your team, revoke if unauthorized

Incident Response Plan

Immediate Response

  1. Verify the compromise - Check DNS records via multiple resolvers
  2. Access registrar account - Attempt login, check for lockout
  3. Contact registrar security team - Use pre-documented emergency contacts
  4. Document everything - Screenshot all current settings

Containment

  1. Invoke registry lock if available
  2. Update NS records if you maintain access
  3. Warn users via social media/status page
  4. Contact law enforcement if significant theft occurred

Recovery

  1. Regain control through registrar security procedures
  2. Audit all DNS records against known-good baseline
  3. Reset all credentials for registrar and DNS hosting
  4. Review access logs to understand attack vector

Post-Incident

  1. Conduct thorough investigation
  2. Update security measures based on lessons learned
  3. Consider legal action if appropriate
  4. Publish transparency report to rebuild trust

Web3-Specific Considerations

Why Domain Security is Critical in Web3

Domain security is exponentially more critical in Web3 compared to traditional web applications due to the unique characteristics of blockchain technology:

  • Irreversible transactions: Unlike traditional banking where stolen funds can sometimes be recovered, blockchain transactions are permanent. Once funds are stolen through a domain hijack, they're gone forever.
  • Direct wallet interactions: Users connect their wallets directly to your domain, giving attackers immediate access to user funds without needing to compromise individual accounts.
  • Reputation damage: One domain hijack incident can permanently destroy protocol trust, as users lose confidence in the project's security practices.

Historical Context

Notable Domain Security Incidents

Domain hijacking has impacted numerous Web3 projects:

These incidents highlight the critical importance of proper domain security measures and the recurring nature of these attacks.

References and Resources

Incident Response Contacts

  • SEAL911 TG Bot - Web3 emergency response team
  • Your registrar's security team (document contact info)
  • Local FBI/law enforcement cybercrime division

Standards and Best Practices

Help us improve!

Spotted an error or have ideas to enhance this content?

Your contributions are valuable to us. Learn more

✏️ Contribute today!