Hacker News Reader

Comment by 71a54xd | Hacker News Reader

Thanks for this! THis kind of domain security is usually poorly articulated or just not out in the open. I still think the basis of most risk for small companies is their domains. Lose control of those and well.. you're fucked. Any recs for "high security" domain providers?

View on HN

You are 100% right that the domain is the keys to the kingdom.

Definitely only use registrars and DNS providers that have 2FA. Google has a registrar now, as well as DNS in GCP https://cloud.google.com/domains/docs/register-domain and https://cloud.google.com/dns. By using those you can leverage your Google account's security (use separate accounts for admin level access on GCP and enforce hardware 2FA), and control who gets access using IAM. AWS has similar options.

This ties into a issue I preach everywhere I can: At least three different companies I've been associated with, including one F500, lost control of their domain due to the following process:

Someone in marketing got an email from some contracted SEO consultant, which said "I need your domain transfer codes". Marketing goes to a VP and overrides everyone ops, everyone in security, and basically everyone who would say "no" because tech people just get in the way.

So suddenly, the domain is transferred to Bluehost using their DNS, the MX records that served 8000 mailboxes are pointed at some "cPanel with five free POP3 accounts" service, and the subdomain that ran your SaaS no longer resolves. But your landing page has better SEO.

Cloudflare also offers a registrar and 2FA if you don’t want all your eggs in one basket (and I would recommend not putting every egg in one basket since Google occasionally does shut down accounts and you’d even future emails if you are locked out of their registrar)

Reply on news.ycombinator.com