Registrar lock
Transfer requests are refused until you unlock the domain.
A lock, DNSSEC and privacy: three layers against a domain being moved or hijacked.
Two things decide whether somebody can take a domain from you: the configuration on the domain itself, and how the account behind it is protected.
A hijack is rarely the registrar being breached. It is usually a reused password, one phishing email, or a transfer lock that was never switched on.
Enable the registrar lock on the domain so transfers are refused.
Choose full or partial privacy where the ending allows it.
A unique password, a verified mailbox, and two-factor authentication.
Check the domain list, the contacts and the sign-in history now and then.
Transfer requests are refused until you unlock the domain.
Hide some or all of the published contact details.
A stolen password is not enough on its own.
Spot an unfamiliar session early.
Registrant, admin, tech and billing can be different people.
Sign DNS answers where the ending supports it.
Know the route in, then close it
Tick them off
| Item | Setting | Why |
|---|---|---|
| Account password | Long, unique, not used elsewhere | Reuse is the single most common cause of a takeover |
| Two-factor authentication | On | A password alone stops being enough |
| Registrar lock | On for every domain | Blocks unauthorised transfers outright |
| WHOIS privacy | On where supported | Reduces targeted phishing and nuisance contact |
| Registrant mailbox | A dedicated address with its own 2FA | It decides whether a transfer can be confirmed |
| Contact details | Accurate and current | Inaccurate data can lead to suspension |
Stop the damage, then investigate
Changes that affect control of the account - the email address, two-factor, unlocking a transfer - go through a ticket, and identity is verified first. That step is not skipped because it is urgent.
One switch, per domain or for a whole folder.
Full, partial or off, where the ending allows it.
A second factor at sign-in.
Unverified addresses restrict sensitive actions.
So you can check for yourself.
One compromised mailbox does less damage.
Yes, but you have to unlock it first. The extra step is deliberate: it separates an accident from theft.
Full privacy hides your personal details including your name. Partial privacy hides everything except your name. Not every ending supports it, and where it does not, the registry publishes what its rules require.
No. It substitutes proxy details in the public record. The real registrant record stays with the registrar and is disclosed when a court or a competent authority lawfully requires it.
DNSSEC signs DNS answers so they cannot be forged. It is optional. If you enable it, the registry side and your DNS provider side must match, or the domain can stop resolving.
Open a ticket and provide the identity checks. This is exactly why recovery codes should be stored somewhere you can reach without the phone.
Open the page for this service and finish in a few steps. If you would rather ask first, a ticket reaches a person.