Properly Securing Domain Names for Associations: DNSSEC, Registry Lock, and Transfer Protection as an Invisible Protective Layer Against Hijacking and Deletion by Third Parties

Why Associations Must Especially Protect Their Domain

Associations are often organized on a voluntary basis and usually do not have their own IT department. However, the domain is the digital business card and often also the email address for communication with members, sponsors, and authorities. If the domain is hijacked or deleted by third parties, it can render the association unable to act. Therefore, it is important to secure the domain with technical protective measures. In this article, we show you how to invisibly protect your domain with DNSSEC, Registry Lock, and Transfer Protection.

DNSSEC: Protection Against DNS Spoofing

DNSSEC (Domain Name System Security Extensions) is a security extension for DNS. It protects against manipulation of DNS responses by cryptographically signing the authenticity and integrity of the data. Without DNSSEC, attackers can forge DNS responses and redirect visitors to fake websites. This is particularly important for associations, as members often reach the website via the domain and could enter sensitive data.

Activating DNSSEC is possible with many registrars. At Dezhost, you can easily activate DNSSEC for your domains. After activation, the DNS responses are signed and verified by resolvers. This ensures that visitors actually land on the correct website.

How to Activate DNSSEC

• Check whether your registrar supports DNSSEC.
• Activate DNSSEC in your customer account.
• Store the DS records with your domain registry.
• Test the configuration with tools like dnssec-analyzer.verisignlabs.com.

Registry Lock: Protection Against Unauthorized Changes

A Registry Lock (also known as Domain Lock or Transfer Lock) prevents unauthorized third parties from making changes to the domain. This includes changes to the nameservers, the owner, or a transfer to another registrar. The lock is set directly at the registry and can only be removed by the owner or the registrar.

For associations, a Registry Lock is particularly important because the domain is often managed by multiple people. A lock prevents a former board member or an attacker from misusing the domain. At Dezhost, the Registry Lock is activated by default, but you can also set it manually.

Types of Locks

• Client-Transfer-Prohibited: Prevents a transfer to another registrar.
• Client-Update-Prohibited: Prevents changes to contact data or nameservers.
• Client-Delete-Prohibited: Prevents deletion of the domain.
• Client-Hold: Locks the domain for all changes.

These locks can usually be managed via the registrar's customer account.

Transfer Protection: Prevent Unauthorized Transfers

Transfer protection (also known as Transfer Lock) prevents your domain from being transferred to another registrar without your consent. A transfer can be used by attackers to take control of the domain. The protection consists of two components: the Auth Code (EPP Code) and the Transfer Lock.

The Auth Code is a secret that is required when changing registrars. It should be stored securely. The Transfer Lock prevents a transfer from being initiated at all. At Dezhost, the Transfer Lock is activated by default. You can deactivate it if needed when planning a move.

Best Practices for Transfer Protection

• Keep your Auth Code secret and change it regularly.
• Activate the Transfer Lock in your customer account.
• Monitor the emails sent when a transfer request is made.
• React immediately if you receive an unexpected transfer request.

Further Protective Measures for Association Domains

In addition to technical measures, there are also organizational protective measures. These include regular review of domain settings, use of a reliable email address for the domain, and setting up two-factor authentication for the customer account. Choosing a trustworthy registrar is also crucial. At Dezhost, we offer comprehensive security features for your domain. Also check out our domain offers.

Checklist for Associations

• Activate DNSSEC
• Set Registry Lock
• Activate Transfer Lock
• Store Auth Code securely
• Two-factor authentication for the customer account
• Regular review of domain settings

With these measures, you protect your association domain from hijacking and unauthorized deletion. If you have any questions, our support team is happy to help. You can also find more information in our knowledge base.