Your domain registrar is your single point of failure

The claim

Businesses spend real money on redundant servers, replicated databases and multi-region backups, then protect the domain name that points at all of it with a shared password and a credit card that expired in March. Control of your DNS is control of your email, your certificates, your password resets and your identity with every supplier you deal with. It is the least redundant thing you own.

What an attacker gets with your registrar login

Not just your website. In order of severity:

• Email. Change the MX records and every message sent to your company arrives at the attacker's server instead. Password resets for every SaaS account you own are delivered to that address.
• Certificates. Most certificate authorities validate domain control via a DNS record or an email to an address at the domain. Whoever controls DNS can obtain a valid certificate for your domain within minutes.
• Traffic. Repoint the A record and your customers reach a copy of your site that collects their credentials.

Server-level security is irrelevant to all three. The attacker never touches your server.

The six controls, in order

1. Hardware-key or app-based two-factor on the registrar account. Not SMS — the registrar account is exactly the target worth a SIM-swap. If your registrar does not support app-based 2FA, that is a sufficient reason to transfer.
2. Registrar lock enabled. Check it, do not assume it:

   whois example.ca | grep -i status

   You want to see a client transfer prohibited status. This blocks unauthorised transfers even if someone gets into the account.
3. Registrant contact on a different domain. If your registrar account's recovery email is admin@example.ca and the attacker controls your MX records, recovery is impossible. Use an address on a domain registered elsewhere.
4. Auto-renew on, plus a calendar entry. Auto-renew fails silently when a card expires. The reminder is the backstop:

   whois example.ca | grep -i 'expiry\|expires'

5. Named account, not personal. Domains registered under a departed employee's personal account are a recurring and genuinely expensive problem. For .ca domains, verify that the registrant is the corporation and that the CIRA Canadian Presence Requirements are met by the entity, not by an individual who may leave.
6. Monitor your own records. A daily check that fails loudly if anything changes:

   dig +short NS example.ca > /tmp/ns.now
   diff /tmp/ns.expected /tmp/ns.now || echo "NAMESERVERS CHANGED"

   Do the same for MX. Unauthorised DNS changes are usually noticed by a customer, days later.

Reduce the blast radius with TTLs

Your TTL determines how long a hostile change persists after you fix it. A 3600-second TTL means an hour of stale poisoned records worldwide after you have already corrected the mistake. Run 300 seconds on A and CNAME records for anything customer-facing, and accept the marginally higher query volume — DNS queries cost effectively nothing, and the ability to move an endpoint in five minutes is worth having on the day you need it.

Keep MX records at a longer TTL, 3600 or more, since they change rarely and mail servers retry.

Separate the registrar from the DNS host

There is a reasonable argument for keeping registration at one provider and authoritative DNS at another. It means a compromise of the DNS host does not let an attacker transfer the domain away, and it lets you move nameservers quickly if your DNS provider has an outage — which does happen, and takes every customer of theirs down at once. The cost is a second account to secure and a second bill, typically under $80 CAD per year for a small zone.

The annual review

Once a year, print the list and confirm each line: every domain the business owns, including defensive registrations and the ones from the acquisition; the registrar for each; the expiry date; who has access; whether 2FA is on; whether lock is on; and where the DNS is actually hosted, which is frequently not the registrar.

Most organisations doing this for the first time find at least one domain nobody knew about, one expiring within 90 days, and one still under a former contractor's account. Thirty minutes a year, against a failure mode that takes your email, your certificates and your website simultaneously and cannot be fixed from your side.