DNS Registrar — Security Checklist

Do you maintain documented policies and procedures governing domain management operations?

Is there a clearly designated person or team accountable for domain security (policy maintenance, security reviews, renewal management)?

Do you maintain a comprehensive inventory of all domains including ownership, purpose, criticality classification, expiration dates, and relationships to business services/applications?

Do you document and maintain current configuration baselines for all critical domains (DNS records, security settings, registrar configurations)?

Do you maintain a formal classification system for domains based on criticality, financial exposure, and operational impact?

Do you map domain classifications to required security controls (monitoring frequency, approval requirements, backup procedures)?

Do you maintain security evaluation criteria for selecting domain registrars and DNS hosting providers?

Do you maintain documented procedures for managing access to domain registrar accounts?

Do you enforce multi-factor authentication requirements for all registrar and DNS management accounts?

Do you maintain a separate, dedicated security contact email for domain management that is independent from your primary domain?

Do you conduct periodic access reviews for all personnel with domain management privileges?

Do you maintain documented approval workflows for critical domain operations (transfers, deletions, nameserver changes)?

Do you maintain documented standards for DNS security configurations (DNSSEC, CAA records, TTL policies)?

Do you maintain documented standards for email authentication (SPF, DKIM, DMARC, MTA-STS)?

Do you have procedures for monitoring and responding to DMARC reports and policy violations?

Do you maintain documented procedures for implementing domain locks (transfer locks, registry locks, EPP status codes)?

Do you have procedures for out-of-band verification of domain changes through registrar support channels?

Do you maintain documented procedures for TLS certificate lifecycle management, including issuance, renewal, revocation, and monitoring for expiration across all domains and services?

Do you maintain documented procedures for domain registration, renewal, decommissioning, and expiration prevention (auto-renewal, multiple reminders, backup payment methods)?

Do you maintain documented procedures for secure domain transfers between registrars?

Do you maintain formal change management procedures for DNS record modifications?

Do you maintain continuous monitoring for unauthorized DNS record changes across all critical domains?

Do you monitor for specific indicators of DNS compromise (TTL changes, nameserver modifications, record anomalies)?

Do you maintain procedures for monitoring Certificate Transparency logs for unauthorized certificate issuance?

Do you monitor domain registration status and registrar lock settings for unauthorized changes?

Do you maintain procedures for detecting and responding to domain expiration risks?

Do you maintain incident response procedures specific to domain hijacking and DNS compromise scenarios?

Do you maintain emergency contact information for registrars and DNS hosting providers?

Do you maintain procedures for emergency registry lock activation to prevent unauthorized domain changes?

Do you have documented procedures for regaining control of compromised domains?

Do you maintain procedures for validating DNS record integrity after incident recovery?