Security budgets have never been larger. Companies run endpoint detection, cloud posture management, phishing simulations, and quarterly penetration tests. The one record that makes all of it reachable - the domain name - sits in a shared inbox linked to a card that expired eighteen months ago and an admin who left in 2023.
That is not a hypothetical scenario. According to CSC's 2024 Domain Security Report, 72% of Forbes Global 2000 companies have less than half of domain security measures in place and 112 have a score of zero. Control over the domain is control over the identity. Everything built on top of it inherits that exposure.
The reason this persists is structural. Entrepreneurs still see domain names as a technical detail, cheap and set to auto-renew. That puts them in the procurement category rather than the infrastructure category. That is a huge and costly mistake. A registrar account deserves the same diligence as a cloud root account. Your domain strategy belongs in that same stack - version-controlled, reviewable, with a change history that survives the person who made the change.
What an Attacker Can Do in One Hour With Your Domain
Domain hijacking means gaining unauthorised access to a domain's registration or DNS configuration. The attacker does not need to breach the internal network. They redirect, and the network comes to them.
Within one hour of controlling DNS, an attacker can reroute MX records to a server they control and begin receiving every password reset email for every SaaS tool the company uses. They can validate domain ownership with a certificate authority and issue a valid TLS certificate. They can serve a cloned version of the product to every user who visits the real URL.
The clearest public demonstration came in August 2022, when attackers altered the nameserver configuration behind Curve Finance and redirected visitors to a cloned frontend that prompted them to approve a malicious contract. Around $570,000 was drained. The smart contracts were untouched. The protocol worked exactly as designed. The failure was entirely at the name layer.
Curve was operating on a .fi domain at the time - the country extension for Finland, often borrowed by financial startups for the obvious abbreviation. They have since moved to .finance. When they abandoned the .fi domain, the team explicitly noted that country-code registrars were inadequate and had unacceptably slow response times during the incident.
The orange banner now greeting visitors on curve.finance - telling users to always verify the URL - is an acknowledgement that the threat has not gone away. A company warning its own users to double-check the address bar is a company that knows it is operating in a namespace it does not fully control.
The domain curve.com belongs to a different fintech. Every piece of press coverage, every social mention, every user who types the obvious URL rather than the extension - that traffic goes somewhere else. The brandtax on a name like Curve, operating on anything other than curve.com compounds quietly and continuously. The banner is just a symptom.
How Organisations Lose Control
Billing Drift and Expiry
The most common cause is the most mundane. The billing email was a contractor's personal address. The card was cancelled or simply expired and nobody updated it. The domain enters a grace period, then a redemption period with high recovery costs, then drops — and drop-catch services are watching. A recognised brand domain can be picked up within minutes of expiry. The new holder can receive email for that domain immediately.
Registrar Account Compromise
Registrar credentials sit outside most corporate SSO estates. They are often shared accounts, used a few times a year, with inconsistent multi-factor authentication. That makes them targets.
The Sea Turtle campaign, documented by Cisco Talos in 2019, compromised at least 40 organisations across 13 countries by gaining access at the registrar and registry layer — not by breaching victim networks. Talos noted that wider use of registrar locks would have prevented the redirection entirely.
Portfolio Fragmentation
As organisations grow, domains accumulate. Marketing registers campaign names. A regional office acquires its ccTLD. An acquisition brings a set of domains registered under credentials nobody can locate. Fragmentation means nobody can answer a basic incident question: what account owns this domain, and who is authorised to make changes?
We see this pattern across companies. The domain portfolio grows faster than the governance around it. The fix is consolidation — all domains under a single, well-secured account with defined role-based access — and it requires planning and consistent strategy.
DNS Managed Through a Dashboard
The less discussed operational risk is the dashboard itself. Most DNS changes happen through a web interface: someone opens a tab, edits a record, closes the tab. No request. No approver. No version history. No way to know, six months later, who changed what or why.
DNS changes should live in the same place as the rest of your infrastructure — in configuration files, under version control, reviewed before they are applied. The same engineer who wouldn't deploy an infrastructure change without a pull request will edit a DNS record through a browser tab without a second thought. That inconsistency is a gap.
What Good Domain Security Looks Like
Registrar Lock, Registry Lock, DNSSEC
Enable registrar lock to prevent unauthorised transfer initiation. For domains where any downtime is unacceptable, ask about registry lock — an additional layer requiring out-of-band verification before any nameserver or contact changes can be made. Enable DNSSEC where the registrar supports it. Use hardware multi-factor authentication on the registrar account.
These are not advanced controls. They are baseline, and they are frequently absent.
Secondary DNS
Most organisations run all their DNS through a single provider. A DDoS attack, misconfiguration, or outage at that provider takes everything with it. Secondary DNS - a synchronised replica of the primary zone on separate infrastructure - means resolvers can reach the second provider if the first goes down. For domains where downtime has a cost, the question is not whether secondary DNS is worth it. It is why it isn't already in place.
DNS as Code
A DNS change should be a reviewable configuration change, not a manual edit in a web interface. Version control, approval gates, and a history of who changed what are not luxuries - they are the minimum required to operate DNS safely at any meaningful scale.
Certificate Rotation
TLS certificate validity is shortening. The CA/Browser Forum has passed requirements cutting maximum validity from 398 days to 100 days in March 2027, and to 47 days by March 2029. At 47 days, manual rotation runs to 8 rotations per year per certificate across every domain and subdomain in a portfolio. That is not operationally viable. Automation is not optional at that cadence — it is the only way the certificates stay current.
Monitor DNS and Certificate Transparency
Watch for nameserver changes, MX changes, and contact changes. Monitor Certificate Transparency logs for unauthorised certificate issuance. Audit for dangling CNAME records pointing to retired cloud assets — subdomain takeover via abandoned infrastructure is a documented and common attack vector.
The AI Dimension
Two developments are making this problem more acute.
Generative AI has made brand impersonation trivial to execute at scale. If a domain is hijacked and a spoofed interface is served, the tells that would once alert a careful user - the poor grammar and inconsistent design - are gone. The only reliable signal is the domain in the address bar. That puts more weight on the domain than it has ever carried before.
Simultaneously, AI is changing how discovery works. The models that surface and recommend businesses do not browse the way a human does. They read signals. A domain that resolves correctly, has clean DNSSEC status, valid SSL, and coherent email authentication sends a different signal from one with expired certificates and inconsistent nameservers. The technical health of a domain is increasingly a proxy for the credibility of everything built on top of it.
AI agents are also starting to interact with domain infrastructure directly — registering domains, managing DNS records, running diagnostics. Access control for those agents matters in exactly the same way it matters for human operators: the credential sets the boundary, not the agent's judgment. A scoped API token that covers one zone is a different risk posture than an account-level token with access to everything.
Three Tools Worth Running Now
Most companies do not have a clear view of their domain's technical health, governance structure, or strategic gaps. These three tools address that directly.
Domain Strategy Quiz — a two-minute assessment that scores current domain strategy across credibility, governance, and growth readiness. Most companies find at least one gap they were not aware of.
Domain Governance Generator — generates a board-ready domain governance policy tailored to the organisation, covering ownership, access controls, renewal procedures, and escalation paths. The output is a PDF that can go directly to legal or the board.
Domain Technical Health Dashboard — a single-view check across all domains covering SSL status, DNSSEC, domain expiry, DNS resolution, email authentication (SPF, DKIM, DMARC), and payment method validity. The check that most companies have never run.
All three are free.
Domain security is not glamorous and it rarely appears on a board deck. But it is the record that everything else depends on and in most organisations, it is the least governed asset in the stack.
Most of what I describe here is preventable with the right checks in place before something breaks. If you want to know where your domain setup stands, a 20-minute intro call covers exactly that.